Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
u08NgsGNym.exe

Overview

General Information

Sample name:u08NgsGNym.exe
renamed because original name is a hash value
Original sample name:23e0d0f06f84e215822d36bc160a0afd6a7e55263ca788e69a69eecb5b48f5b4.exe
Analysis ID:1571339
MD5:5d1c90bbe14678ab16a7495e576422b9
SHA1:7544c71c22d7507a4576f6c00c802abb0b0bffbe
SHA256:23e0d0f06f84e215822d36bc160a0afd6a7e55263ca788e69a69eecb5b48f5b4
Tags:busquedasxurl-comexeuser-JAMESWT_MHT
Infos:

Detection

Python Stealer
Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Contains functionality to infect the boot sector
Found pyInstaller with non standard icon
Yara detected Generic Python Stealer
Binary contains a suspicious time stamp
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to enumerate running services
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
File is packed with WinRar
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • u08NgsGNym.exe (PID: 7820 cmdline: "C:\Users\user\Desktop\u08NgsGNym.exe" MD5: 5D1C90BBE14678AB16A7495E576422B9)
    • hotmailpulse.exe (PID: 7988 cmdline: "C:\Users\user\AppData\Local\Temp\hotmailpulse.exe" MD5: 6EB94393FE46226E4839EAEE0A785900)
      • hotmailpulse.exe (PID: 7400 cmdline: "C:\Users\user\AppData\Local\Temp\hotmailpulse.exe" MD5: 6EB94393FE46226E4839EAEE0A785900)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: hotmailpulse.exe PID: 7400JoeSecurity_GenericPythonStealerYara detected Generic Python StealerJoe Security

    Sigma Signatures

    ⊘No Sigma rule has matched

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for submitted file
    Source: u08NgsGNym.exeReversingLabs: Detection: 18%
    AI detected suspicious sample
    Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.8% probability
    Source: u08NgsGNym.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
    Source: u08NgsGNym.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
    Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1363777844.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1365511367.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356526532.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1357769709.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: hotmailpulse.exe, 00000004.00000002.1865868212.00007FF8217D9000.00000002.00000001.01000000.00000026.sdmp
    Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356093028.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1362720803.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1363505875.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: hotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmp
    Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1365669633.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: hotmailpulse.exe, 00000004.00000002.1862825006.00007FF820799000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1869412323.00007FF830408000.00000002.00000001.01000000.0000001C.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: hotmailpulse.exe, 00000002.00000003.1352840557.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb** source: hotmailpulse.exe, 00000004.00000002.1858081978.00007FF81F780000.00000002.00000001.01000000.0000002D.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356875585.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1363021068.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: hotmailpulse.exe, 00000002.00000003.1353052794.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1868447060.00007FF82D8A5000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1362430797.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1363392688.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb source: hotmailpulse.exe, 00000004.00000002.1858081978.00007FF81F780000.00000002.00000001.01000000.0000002D.sdmp
    Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356219933.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1868856056.00007FF82F417000.00000002.00000001.01000000.00000020.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: hotmailpulse.exe, 00000004.00000002.1865868212.00007FF8217D9000.00000002.00000001.01000000.00000026.sdmp
    Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1358133902.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1355701641.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1870441456.00007FF8328B8000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356347166.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1363269279.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
    Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1359104041.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: hotmailpulse.exe, 00000002.00000003.1353052794.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1868447060.00007FF82D8A5000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: X509_SIGPKCS8_encrypt_excrypto\pkcs12\p12_p8e.cPKCS8_set0_pbe_excompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: hotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmp
    Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1365950297.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: u08NgsGNym.exe, 00000000.00000000.1308101156.00000000005E6000.00000002.00000001.01000000.00000003.sdmp, u08NgsGNym.exe, 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: hotmailpulse.exe, 00000004.00000002.1863841719.00007FF820CF4000.00000002.00000001.01000000.0000000B.sdmp
    Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356799707.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: hotmailpulse.exe, 00000004.00000002.1859222363.00007FF81FC9F000.00000002.00000001.01000000.00000023.sdmp
    Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: hotmailpulse.exe, 00000004.00000002.1862825006.00007FF820831000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: hotmailpulse.exe, 00000004.00000002.1867396530.00007FF821D34000.00000002.00000001.01000000.00000018.sdmp
    Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: hotmailpulse.exe, 00000002.00000003.1362613004.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1358050990.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1355936904.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1363138714.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: hotmailpulse.exe, 00000002.00000003.1352840557.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: hotmailpulse.exe, 00000004.00000002.1858377544.00007FF81F8CC000.00000002.00000001.01000000.0000002A.sdmp
    Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1364132565.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: hotmailpulse.exe, 00000002.00000003.1357328633.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: hotmailpulse.exe, 00000004.00000002.1862825006.00007FF820831000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: hotmailpulse.exe, 00000002.00000003.1358260975.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1357960221.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1366068641.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1362116641.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1362902586.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1362292219.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356646528.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1365384076.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1357057935.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: crypto\stack\stack.cOPENSSL_sk_dupOPENSSL_sk_deep_copysk_reserveOPENSSL_sk_new_reserveOPENSSL_sk_reserveOPENSSL_sk_insertOPENSSL_sk_seti=%dcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC3.1.4built on: Fri Nov 24 00:12:45 2023 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptoOPENSSL_atexitcrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: hotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-7t032bmh\src\rust\target\release\deps\cryptography_rust.pdbcQ source: hotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmp
    Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-7t032bmh\src\rust\target\release\deps\cryptography_rust.pdb source: hotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmp
    Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356944715.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: hotmailpulse.exe, 00000004.00000002.1868075535.00007FF82C45F000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: hotmailpulse.exe, 00000004.00000002.1831263020.0000015D5BEA0000.00000002.00000001.01000000.0000000D.sdmp
    Source: Binary string: D:\a\1\b\libssl-3.pdb source: hotmailpulse.exe, 00000004.00000002.1867396530.00007FF821D34000.00000002.00000001.01000000.00000018.sdmp
    Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1363678248.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1365830372.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005BC4A8 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,0_2_005BC4A8
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005CE560 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,0_2_005CE560
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005DD998 FindFirstFileExA,0_2_005DD998
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F9488D0 FindFirstFileExW,FindClose,2_2_00007FF72F9488D0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F957E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,2_2_00007FF72F957E4C
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F957E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,2_2_00007FF72F957E4C
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F961EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF72F961EE4
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F012E70 memset,PyList_New,SetErrorMode,PyArg_ParseTuple,PyObject_IsTrue,PyEval_SaveThread,GetLogicalDriveStringsA,PyEval_RestoreThread,PyErr_SetFromWindowsErr,SetErrorMode,PyEval_SaveThread,GetDriveTypeA,PyEval_RestoreThread,GetVolumeInformationA,strcat_s,SetLastError,strcat_s,strcat_s,strcat_s,FindFirstVolumeMountPointA,strcpy_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,FindNextVolumeMountPointA,FindVolumeMountPointClose,strcat_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,strchr,SetErrorMode,FindVolumeMountPointClose,SetErrorMode,_Py_Dealloc,_Py_Dealloc,4_2_00007FF81F012E70
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile opened: C:\Users\user\AppData\Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile opened: C:\Users\user\Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI79882\Jump to behavior
    Source: Joe Sandbox ViewIP Address: 34.224.200.202 34.224.200.202
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: global trafficDNS traffic detected: DNS query: httpbin.org
    Source: hotmailpulse.exe, 00000004.00000002.1842425846.0000015D5E1C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
    Source: hotmailpulse.exe, 00000004.00000002.1837281861.0000015D5CE80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://aka.ms/vcpython27
    Source: hotmailpulse.exe, 00000004.00000002.1837281861.0000015D5CE80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://aka.ms/vcpython270
    Source: hotmailpulse.exe, 00000004.00000003.1810853271.0000015D5C8F8000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1821251727.0000015D5C8FE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1837903084.0000015D5D29E000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808997373.0000015D5FD35000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809079831.0000015D5D29C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814226149.0000015D5D2B3000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814037412.0000015D5C8F9000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809358729.0000015D5C8AE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1829519430.0000015D5FD3A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824019656.0000015D5C8FF000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1827016414.0000015D5C8B2000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816691992.0000015D5CA33000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1811492092.0000015D5C8AE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1827327667.0000015D5CA36000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1837978760.0000015D5D2B6000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1851917416.0000015D5FCD1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1835469962.0000015D5C8B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
    Source: hotmailpulse.exe, 00000002.00000003.1353999323.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353692719.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355187980.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355029786.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
    Source: hotmailpulse.exe, 00000002.00000003.1353999323.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353692719.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355187980.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355029786.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
    Source: hotmailpulse.exe, 00000002.00000003.1353999323.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353692719.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355187980.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355029786.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
    Source: hotmailpulse.exe, 00000002.00000003.1353999323.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353692719.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355187980.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355029786.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
    Source: hotmailpulse.exe, 00000004.00000003.1687899921.0000015D5CA26000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1825758493.0000015D5C396000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1820855923.0000015D5C7A8000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810252926.0000015D5C395000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1688399162.0000015D5CA88000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816370187.0000015D5C396000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814143725.0000015D5CA7F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1823531891.0000015D5C7B8000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1688189580.0000015D5CA50000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812535464.0000015D5C396000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1834766298.0000015D5C7B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
    Source: hotmailpulse.exe, 00000004.00000003.1687899921.0000015D5CA26000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1688324215.0000015D5D295000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814431216.0000015D5CA77000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1688189580.0000015D5CA50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
    Source: hotmailpulse.exe, 00000004.00000003.1805940101.0000015D5FD9C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE1A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805508150.0000015D5FD97000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806080819.0000015D5FDF1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805411783.0000015D5FEA8000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1822750915.0000015D5C9B1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1825561117.0000015D5C9BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
    Source: hotmailpulse.exe, 00000004.00000002.1847093411.0000015D5FA2E000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805940101.0000015D5FD9C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE1A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805508150.0000015D5FD97000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806690104.0000015D5FA11000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814667533.0000015D5C2EB000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806080819.0000015D5FDF1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816370187.0000015D5C330000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812535464.0000015D5C2E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
    Source: hotmailpulse.exe, 00000004.00000003.1805821144.0000015D5FE4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
    Source: hotmailpulse.exe, 00000004.00000003.1805940101.0000015D5FD9C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE1A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805508150.0000015D5FD97000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806080819.0000015D5FDF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
    Source: hotmailpulse.exe, 00000004.00000003.1805821144.0000015D5FE4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlst
    Source: hotmailpulse.exe, 00000004.00000003.1805411783.0000015D5FEA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
    Source: hotmailpulse.exe, 00000004.00000003.1822750915.0000015D5C9B1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1825561117.0000015D5C9BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
    Source: hotmailpulse.exe, 00000004.00000003.1805940101.0000015D5FD9C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE1A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805508150.0000015D5FD97000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806080819.0000015D5FDF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crli
    Source: hotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE3F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810439184.0000015D5FE47000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1853035964.0000015D5FE48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
    Source: hotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE3F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810439184.0000015D5FE47000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1853035964.0000015D5FE48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
    Source: hotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE3F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810439184.0000015D5FE47000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1853035964.0000015D5FE48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crlqX
    Source: hotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE3F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810439184.0000015D5FE47000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1853035964.0000015D5FE48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
    Source: hotmailpulse.exe, 00000004.00000002.1847093411.0000015D5FA2E000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805940101.0000015D5FD9C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE1A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805508150.0000015D5FD97000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806690104.0000015D5FA11000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806080819.0000015D5FDF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
    Source: hotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE3F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810439184.0000015D5FE47000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1853035964.0000015D5FE48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlUX
    Source: hotmailpulse.exe, 00000002.00000003.1353999323.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353692719.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355187980.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355029786.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
    Source: hotmailpulse.exe, 00000002.00000003.1353999323.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353692719.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355187980.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355029786.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
    Source: hotmailpulse.exe, 00000002.00000003.1353999323.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353692719.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355187980.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355029786.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
    Source: hotmailpulse.exe, 00000002.00000003.1355187980.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.cr
    Source: hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
    Source: hotmailpulse.exe, 00000002.00000003.1353999323.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353692719.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355187980.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355029786.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
    Source: hotmailpulse.exe, 00000004.00000003.1810853271.0000015D5C8F8000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1821251727.0000015D5C8FE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814037412.0000015D5C8F9000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809358729.0000015D5C8AE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824019656.0000015D5C8FF000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1827016414.0000015D5C8B2000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1811492092.0000015D5C8AE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1835469962.0000015D5C8B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
    Source: hotmailpulse.exe, 00000004.00000003.1809079831.0000015D5D29C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814226149.0000015D5D2B3000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816691992.0000015D5CA33000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1827327667.0000015D5CA36000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1837978760.0000015D5D2B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
    Source: hotmailpulse.exe, 00000004.00000002.1837903084.0000015D5D29E000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809079831.0000015D5D29C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
    Source: hotmailpulse.exe, 00000004.00000003.1810853271.0000015D5C8F8000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1846682013.0000015D5F9F1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842943559.0000015D5E730000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1821251727.0000015D5C8FE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1823289898.0000015D5DA6A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E840000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E8B8000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814037412.0000015D5C8F9000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809358729.0000015D5C8AE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824019656.0000015D5C8FF000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1841979728.0000015D5DA6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
    Source: hotmailpulse.exe, 00000004.00000002.1842425846.0000015D5E1C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
    Source: hotmailpulse.exe, 00000004.00000002.1837539996.0000015D5D090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
    Source: hotmailpulse.exe, 00000004.00000002.1837539996.0000015D5D090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
    Source: hotmailpulse.exe, 00000004.00000003.1687899921.0000015D5CA26000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1837018610.0000015D5CC50000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1688189580.0000015D5CA50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
    Source: hotmailpulse.exe, 00000004.00000003.1816214011.0000015D5C81C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809358729.0000015D5C811000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810215523.0000015D5C81A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1825064823.0000015D5C81C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/unittest.html
    Source: hotmailpulse.exe, 00000004.00000002.1837018610.0000015D5CC50000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://foo/bar.tar.gz
    Source: hotmailpulse.exe, 00000004.00000002.1837018610.0000015D5CC50000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://foo/bar.tgz
    Source: hotmailpulse.exe, 00000004.00000002.1843237328.0000015D5EA28000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806201524.0000015D5D390000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://goo.gl/zeJZl.
    Source: hotmailpulse.exe, 00000004.00000003.1816214011.0000015D5C7FD000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809833651.0000015D5C7D0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1834944330.0000015D5C800000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824184745.0000015D5C7FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
    Source: hotmailpulse.exe, 00000004.00000002.1836589322.0000015D5CA90000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814143725.0000015D5CA7F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
    Source: hotmailpulse.exe, 00000004.00000003.1690354586.0000015D5D3A0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1813002199.0000015D5C835000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809603916.0000015D5C82E000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1811856247.0000015D5D3A0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809358729.0000015D5C811000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1815309398.0000015D5D3A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
    Source: hotmailpulse.exe, 00000004.00000003.1806690104.0000015D5F9C2000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E8B8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
    Source: hotmailpulse.exe, 00000004.00000003.1814667533.0000015D5C2EB000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816370187.0000015D5C330000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812535464.0000015D5C2E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
    Source: hotmailpulse.exe, 00000004.00000002.1847093411.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808118699.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
    Source: hotmailpulse.exe, 00000004.00000003.1814667533.0000015D5C2EB000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816370187.0000015D5C330000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812535464.0000015D5C2E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.esex
    Source: hotmailpulse.exe, 00000002.00000003.1353999323.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353692719.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355187980.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355029786.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
    Source: hotmailpulse.exe, 00000002.00000003.1353999323.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353692719.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355187980.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355029786.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
    Source: hotmailpulse.exe, 00000002.00000003.1353999323.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353692719.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355187980.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355029786.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
    Source: hotmailpulse.exe, 00000002.00000003.1353999323.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353692719.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355187980.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355029786.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
    Source: hotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
    Source: hotmailpulse.exe, 00000004.00000002.1840756070.0000015D5D77D000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809198885.0000015D5FE66000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812380522.0000015D5DA75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
    Source: hotmailpulse.exe, 00000004.00000002.1847093411.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808118699.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/0
    Source: hotmailpulse.exe, 00000004.00000002.1838418707.0000015D5D3A8000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690354586.0000015D5D3A0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1811856247.0000015D5D3A0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1815309398.0000015D5D3A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tip.tcl.tk/48)
    Source: hotmailpulse.exe, 00000004.00000002.1851917416.0000015D5FCD7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
    Source: hotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E8B8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5297
    Source: hotmailpulse.exe, 00000004.00000003.1805508150.0000015D5FD97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
    Source: hotmailpulse.exe, 00000004.00000002.1842425846.0000015D5E1C0000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1832832790.0000015D5C2ED000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814667533.0000015D5C2EB000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812535464.0000015D5C2E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
    Source: hotmailpulse.exe, 00000004.00000002.1851917416.0000015D5FCD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
    Source: hotmailpulse.exe, 00000004.00000003.1805940101.0000015D5FD9C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805508150.0000015D5FD97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/ll
    Source: hotmailpulse.exe, 00000004.00000002.1847093411.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814667533.0000015D5C2EB000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808118699.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816370187.0000015D5C330000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812535464.0000015D5C2E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
    Source: hotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE3F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810439184.0000015D5FE47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
    Source: hotmailpulse.exe, 00000004.00000002.1847093411.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808118699.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
    Source: hotmailpulse.exe, 00000004.00000003.1805821144.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807914722.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808779409.0000015D5FE85000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
    Source: hotmailpulse.exe, 00000004.00000002.1847093411.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808118699.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
    Source: hotmailpulse.exe, 00000004.00000002.1847093411.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805821144.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807914722.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808118699.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808779409.0000015D5FE85000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
    Source: hotmailpulse.exe, 00000004.00000002.1837539996.0000015D5D090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
    Source: hotmailpulse.exe, 00000004.00000003.1805821144.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814431216.0000015D5CA77000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812463774.0000015D5FEA0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1853632211.0000015D5FEA0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807542339.0000015D5FE8A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807997377.0000015D5FE9B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
    Source: hotmailpulse.exe, 00000004.00000003.1808997373.0000015D5FD35000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1829519430.0000015D5FD3A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1851917416.0000015D5FCD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
    Source: hotmailpulse.exe, 00000002.00000003.1353999323.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353692719.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355187980.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355029786.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
    Source: hotmailpulse.exe, 00000004.00000002.1839578501.0000015D5D4EF000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805821144.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812463774.0000015D5FEA0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1853632211.0000015D5FEA0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807542339.0000015D5FE8A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807997377.0000015D5FE9B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
    Source: hotmailpulse.exe, 00000004.00000003.1809358729.0000015D5C8AE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1811492092.0000015D5C8AE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1835374937.0000015D5C8AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
    Source: hotmailpulse.exe, 00000004.00000002.1840315196.0000015D5D6E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
    Source: hotmailpulse.exe, 00000004.00000003.1805940101.0000015D5FD9C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805508150.0000015D5FD97000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1851917416.0000015D5FCD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
    Source: hotmailpulse.exe, 00000004.00000002.1851917416.0000015D5FCD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
    Source: hotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1866847291.00007FF821C68000.00000008.00000001.01000000.0000001F.sdmpString found in binary or memory: http://www.zlib.net/D
    Source: hotmailpulse.exe, 00000004.00000002.1838167948.0000015D5D329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
    Source: hotmailpulse.exe, 00000004.00000003.1815309398.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1811856247.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1838236074.0000015D5D36C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1838455900.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690708475.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806201524.0000015D5D405000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html
    Source: hotmailpulse.exe, 00000004.00000002.1836589322.0000015D5CA90000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1839578501.0000015D5D4D3000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814143725.0000015D5CA7F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html
    Source: hotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E840000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
    Source: hotmailpulse.exe, 00000004.00000002.1836879587.0000015D5CB40000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1834402844.0000015D5C640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue44497.
    Source: hotmailpulse.exe, 00000004.00000002.1842299685.0000015D5DC90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://busquedasxurl.com/login/conexion/
    Source: hotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E840000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://busquedasxurl.com/login/conexion/bloqueadoreslogs.php?ip=
    Source: hotmailpulse.exe, 00000004.00000002.1842299685.0000015D5DC90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://busquedasxurl.com/login/conexion/d.
    Source: hotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E840000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://busquedasxurl.com/login/conexion/recibidor.php
    Source: hotmailpulse.exe, hotmailpulse.exe, 00000004.00000002.1857016622.00007FF81F0DD000.00000002.00000001.01000000.0000002F.sdmpString found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
    Source: hotmailpulse.exe, 00000004.00000002.1838236074.0000015D5D36C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1821708928.0000015D5D4B4000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806478407.0000015D5D4B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/archive/p/casadebender/wikis/Win32IconImagePlugin.wiki
    Source: hotmailpulse.exe, 00000004.00000002.1846638121.0000015D5F9A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/
    Source: hotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmpString found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
    Source: hotmailpulse.exe, 00000004.00000003.1825471481.0000015D5C7A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
    Source: hotmailpulse.exe, 00000004.00000003.1825064823.0000015D5C814000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809358729.0000015D5C811000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816214011.0000015D5C813000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
    Source: hotmailpulse.exe, 00000004.00000002.1842425846.0000015D5E1C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/socket.html#socket.socket.connect_ex
    Source: hotmailpulse.exe, 00000004.00000003.1823289898.0000015D5DA6A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://exiv2.org/tags.html)
    Source: hotmailpulse.exe, 00000004.00000002.1842299685.0000015D5DC90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
    Source: hotmailpulse.exe, 00000004.00000002.1837018610.0000015D5CC50000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842197328.0000015D5DB90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
    Source: hotmailpulse.exe, 00000004.00000003.1815680328.0000015D5D416000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1811856247.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814466985.0000015D5D412000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690708475.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806201524.0000015D5D405000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
    Source: hotmailpulse.exe, 00000004.00000003.1821324422.0000015D5BF24000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1831679621.0000015D5BF58000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812786585.0000015D5BF50000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824565515.0000015D5BF58000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1663682360.0000015D5BF5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
    Source: hotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E840000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
    Source: hotmailpulse.exe, 00000004.00000002.1837018610.0000015D5CC50000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
    Source: hotmailpulse.exe, hotmailpulse.exe, 00000004.00000002.1861370032.00007FF82018E000.00000002.00000001.01000000.0000002B.sdmpString found in binary or memory: https://github.com/mhammond/pywin32
    Source: hotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/platformdirs/platformdirs
    Source: hotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
    Source: hotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/8996
    Source: hotmailpulse.exe, 00000004.00000002.1842197328.0000015D5DB90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging
    Source: hotmailpulse.exe, 00000004.00000002.1836879587.0000015D5CB40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
    Source: hotmailpulse.exe, 00000004.00000003.1690235667.0000015D5D457000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842551421.0000015D5E2D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-pillow/Pillow/
    Source: hotmailpulse.exe, 00000004.00000002.1831136950.0000015D5BE0C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
    Source: hotmailpulse.exe, 00000004.00000003.1663682360.0000015D5BF5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
    Source: hotmailpulse.exe, 00000004.00000003.1821324422.0000015D5BF24000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1831679621.0000015D5BF58000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812786585.0000015D5BF50000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824565515.0000015D5BF58000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1663682360.0000015D5BF5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
    Source: hotmailpulse.exe, 00000004.00000003.1673607996.0000015D5C38E000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816497855.0000015D5C407000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1672286295.0000015D5C780000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1817217141.0000015D5C40A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1680948776.0000015D5C3EE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1672976565.0000015D5C38E000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1675233940.0000015D5C3EE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809979782.0000015D5C3CD000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810161382.0000015D5C3CF000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1683521684.0000015D5C3BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
    Source: hotmailpulse.exe, 00000004.00000002.1836879587.0000015D5CB40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/issues/396
    Source: hotmailpulse.exe, 00000004.00000002.1836879587.0000015D5CB40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/issues/396P
    Source: hotmailpulse.exe, 00000004.00000003.1821324422.0000015D5BF24000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1831679621.0000015D5BF58000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812786585.0000015D5BF50000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824565515.0000015D5BF58000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1663682360.0000015D5BF5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
    Source: hotmailpulse.exe, 00000004.00000002.1842299685.0000015D5DC90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
    Source: hotmailpulse.exe, 00000004.00000003.1826789749.0000015D5CA4C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1836424289.0000015D5CA5C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816691992.0000015D5CA33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
    Source: hotmailpulse.exe, 00000004.00000002.1842425846.0000015D5E1C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
    Source: hotmailpulse.exe, 00000004.00000002.1842425846.0000015D5E1C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/29200
    Source: hotmailpulse.exe, 00000004.00000003.1690354586.0000015D5D3D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
    Source: hotmailpulse.exe, 00000004.00000003.1815765971.0000015D5D3C9000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1822750915.0000015D5C9B1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1838455900.0000015D5D3C9000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690354586.0000015D5D3D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
    Source: hotmailpulse.exe, 00000004.00000002.1836672827.0000015D5CB02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
    Source: hotmailpulse.exe, 00000004.00000003.1807743858.0000015D5CB1B000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810332074.0000015D5CB27000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1836765915.0000015D5CB28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
    Source: hotmailpulse.exe, 00000004.00000003.1690354586.0000015D5D3D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
    Source: hotmailpulse.exe, 00000004.00000002.1842551421.0000015D5E2D0000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1825561117.0000015D5C9BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
    Source: hotmailpulse.exe, 00000004.00000002.1843237328.0000015D5EACC000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E840000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/ip
    Source: hotmailpulse.exe, 00000004.00000002.1843237328.0000015D5EACC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/ip0
    Source: hotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E840000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/ipp
    Source: hotmailpulse.exe, 00000004.00000003.1814431216.0000015D5CA77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
    Source: hotmailpulse.exe, 00000004.00000002.1834402844.0000015D5C640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
    Source: hotmailpulse.exe, 00000004.00000003.1685945185.0000015D5C8B8000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824184745.0000015D5C7D0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812535464.0000015D5C2E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
    Source: hotmailpulse.exe, 00000004.00000003.1815680328.0000015D5D416000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1811856247.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690040135.0000015D5D473000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814466985.0000015D5D412000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690708475.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806201524.0000015D5D405000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
    Source: hotmailpulse.exe, 00000004.00000003.1808997373.0000015D5FD35000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809526912.0000015D5FD3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
    Source: hotmailpulse.exe, 00000004.00000002.1837147512.0000015D5CD70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
    Source: hotmailpulse.exe, 00000004.00000002.1837281861.0000015D5CE80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
    Source: hotmailpulse.exe, 00000004.00000003.1811492092.0000015D5C8C4000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1815159267.0000015D5C8EA000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1683703294.0000015D5C8B8000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814505635.0000015D5C8CC000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809358729.0000015D5C8AE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1685945185.0000015D5C8B8000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814550566.0000015D5C8E5000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1825142849.0000015D5C8EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
    Source: hotmailpulse.exe, 00000004.00000002.1837147512.0000015D5CD70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
    Source: hotmailpulse.exe, 00000004.00000002.1837147512.0000015D5CD70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/P
    Source: hotmailpulse.exe, 00000004.00000002.1836879587.0000015D5CB40000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1834402844.0000015D5C640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
    Source: hotmailpulse.exe, 00000004.00000002.1834402844.0000015D5C640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
    Source: hotmailpulse.exe, 00000004.00000002.1863841719.00007FF820CF4000.00000002.00000001.01000000.0000000B.sdmpString found in binary or memory: https://peps.python.org/pep-0263/
    Source: hotmailpulse.exe, 00000004.00000002.1837281861.0000015D5CE80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0685/
    Source: hotmailpulse.exe, 00000004.00000002.1837018610.0000015D5CC50000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1837147512.0000015D5CD70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/build/).
    Source: hotmailpulse.exe, 00000004.00000002.1837018610.0000015D5CC50000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842197328.0000015D5DB90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
    Source: hotmailpulse.exe, 00000004.00000003.1814431216.0000015D5CA77000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842551421.0000015D5E2D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
    Source: hotmailpulse.exe, 00000004.00000002.1837281861.0000015D5CE80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/
    Source: hotmailpulse.exe, 00000004.00000002.1838122137.0000015D5D302000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
    Source: hotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
    Source: hotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages0
    Source: hotmailpulse.exe, 00000004.00000002.1842720871.0000015D5E3D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/11993290/truly-custom-font-in-tkinter/30631309#30631309
    Source: hotmailpulse.exe, 00000004.00000002.1842720871.0000015D5E3D0000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842551421.0000015D5E2D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666#70724666
    Source: hotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E840000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
    Source: hotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://t.me/DarkSenderSMTP
    Source: hotmailpulse.exe, 00000004.00000003.1687899921.0000015D5CA26000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814143725.0000015D5CA7F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1836545713.0000015D5CA83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1688189580.0000015D5CA50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/DarkSenderSMTPrG
    Source: hotmailpulse.exe, 00000004.00000003.1687899921.0000015D5CA26000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814143725.0000015D5CA7F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1836545713.0000015D5CA83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1688189580.0000015D5CA50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/DarkSenderSMTPrG)
    Source: hotmailpulse.exe, 00000004.00000003.1687899921.0000015D5CA26000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814143725.0000015D5CA7F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1836545713.0000015D5CA83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1688189580.0000015D5CA50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/maleficacvu
    Source: hotmailpulse.exe, 00000004.00000002.1833668316.0000015D5C3C1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810252926.0000015D5C395000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1827580652.0000015D5C3C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
    Source: hotmailpulse.exe, 00000004.00000003.1809079831.0000015D5D29C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814226149.0000015D5D2B3000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816691992.0000015D5CA33000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1827327667.0000015D5CA36000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1837978760.0000015D5D2B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
    Source: hotmailpulse.exe, 00000004.00000003.1808997373.0000015D5FD35000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1829519430.0000015D5FD3A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1851917416.0000015D5FCD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
    Source: hotmailpulse.exe, 00000004.00000003.1807743858.0000015D5CB1B000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810332074.0000015D5CB27000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1836765915.0000015D5CB28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
    Source: hotmailpulse.exe, 00000004.00000003.1815765971.0000015D5D3C9000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1815985752.0000015D5BF3A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1838455900.0000015D5D3C9000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824565515.0000015D5BF4B000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690354586.0000015D5D3D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
    Source: hotmailpulse.exe, 00000004.00000002.1836879587.0000015D5CB40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://upload.pypi.org/legacy/
    Source: hotmailpulse.exe, 00000004.00000002.1836879587.0000015D5CB40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://upload.pypi.org/legacy/y
    Source: hotmailpulse.exe, 00000004.00000002.1842299685.0000015D5DC90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
    Source: hotmailpulse.exe, 00000004.00000002.1842299685.0000015D5DC90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyP
    Source: hotmailpulse.exe, 00000004.00000002.1842197328.0000015D5DB90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
    Source: hotmailpulse.exe, 00000004.00000003.1823289898.0000015D5DA6A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1841979728.0000015D5DA6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.archive.org/web/20120328125543/http://www.jpegcameras.com/libjpeg/libjpeg-3.html
    Source: hotmailpulse.exe, 00000004.00000003.1809358729.0000015D5C865000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824679689.0000015D5C865000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1688324215.0000015D5D295000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1821509298.0000015D5C865000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1826597392.0000015D5C86F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1835374937.0000015D5C872000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
    Source: hotmailpulse.exe, 00000004.00000003.1828944183.0000015D5D51B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mia.uni-saarland.de/Publications/gwosdek-ssvm11.pdf
    Source: hotmailpulse.exe, 00000004.00000002.1867495899.00007FF821D6F000.00000002.00000001.01000000.00000018.sdmp, hotmailpulse.exe, 00000004.00000002.1863441070.00007FF8208DA000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: https://www.openssl.org/H
    Source: hotmailpulse.exe, 00000004.00000003.1814431216.0000015D5CA77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
    Source: hotmailpulse.exe, 00000004.00000003.1815680328.0000015D5D416000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1811856247.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690040135.0000015D5D473000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814466985.0000015D5D412000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690708475.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806201524.0000015D5D405000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
    Source: hotmailpulse.exe, 00000004.00000003.1664692652.0000015D5BFD9000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1664591123.0000015D5BFCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
    Source: hotmailpulse.exe, 00000004.00000002.1864570695.00007FF820EAE000.00000008.00000001.01000000.0000000B.sdmpString found in binary or memory: https://www.python.org/psf/license/
    Source: hotmailpulse.exe, 00000004.00000002.1863841719.00007FF820CF4000.00000002.00000001.01000000.0000000B.sdmpString found in binary or memory: https://www.python.org/psf/license/)
    Source: hotmailpulse.exe, 00000004.00000003.1805821144.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807542339.0000015D5FE8A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
    Source: hotmailpulse.exe, 00000004.00000003.1805940101.0000015D5FD9C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE1A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805508150.0000015D5FD97000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806080819.0000015D5FDF1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1822750915.0000015D5C9B1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1825561117.0000015D5C9BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
    Source: hotmailpulse.exe, 00000004.00000003.1805821144.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807542339.0000015D5FE8A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/R
    Source: hotmailpulse.exe, 00000004.00000003.1815765971.0000015D5D3C9000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1822750915.0000015D5C9B1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1838455900.0000015D5D3C9000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690354586.0000015D5D3D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
    Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F011E90 PyList_New,GetActiveProcessorCount,PyErr_SetFromWindowsErr,_Py_Dealloc,free,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,PyExc_RuntimeError,PyErr_SetString,malloc,PyErr_NoMemory,NtQuerySystemInformation,Py_BuildValue,PyList_Append,_Py_Dealloc,free,_Py_Dealloc,4_2_00007FF81F011E90
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F015810 PyArg_ParseTuple,OpenProcess,GetLastError,NtSetInformationProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct,4_2_00007FF81F015810
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F014D00 PyArg_ParseTuple,OpenProcess,GetLastError,PyObject_IsTrue,NtSuspendProcess,NtResumeProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct,4_2_00007FF81F014D00
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F016600 PyList_New,EnterCriticalSection,GetProcessHeap,HeapAlloc,PyErr_NoMemory,_Py_Dealloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,PyExc_RuntimeError,PyErr_SetString,GetCurrentProcess,DuplicateHandle,PyUnicode_FromWideChar,PyList_Append,_Py_Dealloc,GetProcessHeap,HeapFree,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,_Py_Dealloc,GetProcessHeap,HeapFree,LeaveCriticalSection,4_2_00007FF81F016600
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F015720 PyArg_ParseTuple,OpenProcess,GetLastError,NtQueryInformationProcess,CloseHandle,Py_BuildValue,4_2_00007FF81F015720
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F016250 GetProcessHeap,HeapAlloc,GetFileType,SetLastError,NtQueryObject,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,PyErr_NoMemory,GetProcessHeap,HeapFree,4_2_00007FF81F016250
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F016E40 PyExc_RuntimeError,PyErr_SetString,OpenProcess,GetLastError,NtQueryInformationProcess,CloseHandle,CloseHandle,calloc,PyErr_NoMemory,CloseHandle,NtQueryInformationProcess,calloc,PyErr_NoMemory,free,CloseHandle,wcscpy_s,free,CloseHandle,4_2_00007FF81F016E40
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F014A70 PyArg_ParseTuple,OpenProcess,GetLastError,GetProcessHeap,HeapAlloc,NtQueryVirtualMemory,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQueryVirtualMemory,PyExc_RuntimeError,PyErr_SetString,CloseHandle,PyErr_Clear,GetProcessHeap,HeapFree,CloseHandle,GetProcessHeap,HeapFree,CloseHandle,Py_BuildValue,PyErr_NoMemory,CloseHandle,4_2_00007FF81F014A70
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F012480 GetActiveProcessorCount,PyErr_SetFromWindowsErr,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,PyExc_RuntimeError,PyErr_SetString,malloc,PyErr_NoMemory,NtQuerySystemInformation,free,malloc,PyErr_NoMemory,NtQuerySystemInformation,malloc,PyErr_NoMemory,NtQuerySystemInformation,free,free,free,free,free,Py_BuildValue,4_2_00007FF81F012480
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F014680 PyArg_ParseTuple,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,Py_BuildValue,PyUnicode_FromWideChar,GetProcessHeap,HeapFree,PyErr_NoMemory,4_2_00007FF81F014680
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F016AA0 OpenProcess,GetLastError,NtQueryInformationProcess,RtlNtStatusToDosErrorNoTeb,PyErr_SetFromWindowsErrWithFilename,CloseHandle,ReadProcessMemory,GetLastError,CloseHandle,ReadProcessMemory,NtQueryInformationProcess,CloseHandle,ReadProcessMemory,ReadProcessMemory,VirtualQueryEx,GetLastError,PyErr_SetFromWindowsErrWithFilename,CloseHandle,calloc,PyErr_NoMemory,CloseHandle,ReadProcessMemory,GetLastError,CloseHandle,free,CloseHandle,4_2_00007FF81F016AA0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0173F0 malloc,NtQuerySystemInformation,free,malloc,PyErr_NoMemory,free,free,4_2_00007FF81F0173F0
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005B7FD3: _wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,0_2_005B7FD3
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005BF9630_2_005BF963
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005B99060_2_005B9906
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005CEA070_2_005CEA07
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005C8C7E0_2_005C8C7E
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005E40440_2_005E4044
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005C60F70_2_005C60F7
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005C91110_2_005C9111
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005C21250_2_005C2125
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005C82D00_2_005C82D0
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005BE3940_2_005BE394
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005C64450_2_005C6445
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005C14760_2_005C1476
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005C976F0_2_005C976F
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005D77380_2_005D7738
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005C09490_2_005C0949
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005D79670_2_005D7967
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005DFA900_2_005DFA90
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005B3AB70_2_005B3AB7
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005B4C6E0_2_005B4C6E
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005C5E860_2_005C5E86
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005DFF3E0_2_005DFF3E
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005B2FCB0_2_005B2FCB
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005C0FAC0_2_005C0FAC
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F957E4C2_2_00007FF72F957E4C
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F9663702_2_00007FF72F966370
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F9672BC2_2_00007FF72F9672BC
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F9479502_2_00007FF72F947950
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F9520A02_2_00007FF72F9520A0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F95E01C2_2_00007FF72F95E01C
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F9518802_2_00007FF72F951880
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F948FD02_2_00007FF72F948FD0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F969FF82_2_00007FF72F969FF8
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F960F382_2_00007FF72F960F38
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F941F502_2_00007FF72F941F50
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F96471C2_2_00007FF72F96471C
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F955F302_2_00007FF72F955F30
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F957E4C2_2_00007FF72F957E4C
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F9586D02_2_00007FF72F9586D0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F961EE42_2_00007FF72F961EE4
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F9536E02_2_00007FF72F9536E0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F951E942_2_00007FF72F951E94
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F9665EC2_2_00007FF72F9665EC
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F952D502_2_00007FF72F952D50
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F966D702_2_00007FF72F966D70
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F957C982_2_00007FF72F957C98
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F95E4B02_2_00007FF72F95E4B0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F95A4302_2_00007FF72F95A430
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F951C902_2_00007FF72F951C90
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F95EB302_2_00007FF72F95EB30
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F9522A42_2_00007FF72F9522A4
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F953AE42_2_00007FF72F953AE4
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F951A842_2_00007FF72F951A84
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F9642802_2_00007FF72F964280
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F960F382_2_00007FF72F960F38
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F011E904_2_00007FF81F011E90
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F012B004_2_00007FF81F012B00
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0166004_2_00007FF81F016600
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F018F304_2_00007FF81F018F30
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F012E704_2_00007FF81F012E70
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0139904_2_00007FF81F013990
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0199D04_2_00007FF81F0199D0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F014DF04_2_00007FF81F014DF0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0324304_2_00007FF81F032430
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F031FD04_2_00007FF81F031FD0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0448204_2_00007FF81F044820
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0445D04_2_00007FF81F0445D0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F051D804_2_00007FF81F051D80
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0524A04_2_00007FF81F0524A0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0535504_2_00007FF81F053550
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0529C04_2_00007FF81F0529C0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F052EC04_2_00007FF81F052EC0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F051FF04_2_00007FF81F051FF0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0621104_2_00007FF81F062110
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F061D404_2_00007FF81F061D40
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F071F104_2_00007FF81F071F10
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0721C04_2_00007FF81F0721C0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F091FA04_2_00007FF81F091FA0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0A20504_2_00007FF81F0A2050
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0A1F404_2_00007FF81F0A1F40
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0B22D04_2_00007FF81F0B22D0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0B1D404_2_00007FF81F0B1D40
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0CB4504_2_00007FF81F0CB450
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FB912F04_2_00007FF81FB912F0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FB918A04_2_00007FF81FB918A0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FEF21604_2_00007FF81FEF2160
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF020704_2_00007FF81FF02070
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF242004_2_00007FF81FF24200
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FFF63704_2_00007FF81FFF6370
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF94DA04_2_00007FF81FF94DA0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF84FE04_2_00007FF81FF84FE0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF930504_2_00007FF81FF93050
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF250804_2_00007FF81FF25080
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FFE72304_2_00007FF81FFE7230
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF213104_2_00007FF81FF21310
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FFE568E4_2_00007FF81FFE568E
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF8F9104_2_00007FF81FF8F910
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF43D004_2_00007FF81FF43D00
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF9FE204_2_00007FF81FF9FE20
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF541104_2_00007FF81FF54110
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FFC41904_2_00007FF81FFC4190
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF941F04_2_00007FF81FF941F0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FFC9D604_2_00007FF81FFC9D60
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF99E904_2_00007FF81FF99E90
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF4FEE04_2_00007FF81FF4FEE0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FFFBF704_2_00007FF81FFFBF70
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF25FB04_2_00007FF81FF25FB0
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: String function: 005D1590 appears 57 times
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: String function: 005D1D60 appears 31 times
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: String function: 00007FF81F011D70 appears 39 times
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: String function: 00007FF81F77C090 appears 35 times
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: String function: 00007FF81F011070 appears 43 times
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: String function: 00007FF72F942B30 appears 47 times
    Source: _overlapped.pyd.2.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
    Source: api-ms-win-crt-conio-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-file-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-rtlsupport-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-crt-environment-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-sysinfo-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-memory-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-util-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-errorhandling-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-interlocked-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-processenvironment-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-synch-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-file-l2-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-timezone-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-handle-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-synch-l1-2-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-debug-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-localization-l1-2-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-datetime-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-processthreads-l1-1-1.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-crt-filesystem-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-crt-convert-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-crt-math-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-crt-heap-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-file-l1-2-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-libraryloader-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-crt-private-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-processthreads-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-heap-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-console-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-string-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-profile-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-core-namedpipe-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: api-ms-win-crt-locale-l1-1-0.dll.2.drStatic PE information: No import functions for PE file found
    Source: u08NgsGNym.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
    Source: classification engineClassification label: mal64.troj.evad.winEXE@5/1029@1/1
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005B7BFF GetLastError,FormatMessageW,0_2_005B7BFF
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F017DB0 GetCurrentProcess,OpenProcessToken,GetLastError,ImpersonateSelf,OpenProcessToken,GetLastError,PyErr_SetFromWindowsErrWithFilename,LookupPrivilegeValueA,GetLastError,PyErr_SetFromWindowsErrWithFilename,AdjustTokenPrivileges,GetLastError,PyErr_SetFromWindowsErrWithFilename,AdjustTokenPrivileges,RevertToSelf,CloseHandle,4_2_00007FF81F017DB0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F012A30 PyArg_ParseTuple,PyUnicode_AsWideCharString,PyEval_SaveThread,GetDiskFreeSpaceExW,PyEval_RestoreThread,PyMem_Free,PyExc_OSError,PyErr_SetExcFromWindowsErrWithFilenameObject,Py_BuildValue,4_2_00007FF81F012A30
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F01601F PyDict_New,memset,CreateToolhelp32Snapshot,PyErr_SetFromWindowsErr,_Py_Dealloc,Process32First,PyLong_FromLong,PyLong_FromLong,PyDict_SetItem,_Py_Dealloc,_Py_Dealloc,Process32Next,CloseHandle,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,CloseHandle,4_2_00007FF81F01601F
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005CC652 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,0_2_005CC652
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F018AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct,4_2_00007FF81F018AA0
    Source: C:\Users\user\Desktop\u08NgsGNym.exeFile created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5416265Jump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCommand line argument: sfxname0_2_005D037C
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCommand line argument: sfxstime0_2_005D037C
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCommand line argument: pP_0_2_005D037C
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCommand line argument: STARTDLG0_2_005D037C
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCommand line argument: >G^0_2_005E4690
    Source: u08NgsGNym.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
    Source: C:\Users\user\Desktop\u08NgsGNym.exeFile read: C:\Windows\win.iniJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: hotmailpulse.exe, 00000004.00000002.1858377544.00007FF81F8CC000.00000002.00000001.01000000.0000002A.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
    Source: hotmailpulse.exe, 00000004.00000002.1858377544.00007FF81F8CC000.00000002.00000001.01000000.0000002A.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
    Source: hotmailpulse.exe, 00000004.00000002.1858377544.00007FF81F8CC000.00000002.00000001.01000000.0000002A.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
    Source: hotmailpulse.exe, 00000004.00000002.1858377544.00007FF81F8CC000.00000002.00000001.01000000.0000002A.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
    Source: hotmailpulse.exe, hotmailpulse.exe, 00000004.00000002.1858377544.00007FF81F8CC000.00000002.00000001.01000000.0000002A.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
    Source: hotmailpulse.exe, 00000004.00000002.1858377544.00007FF81F8CC000.00000002.00000001.01000000.0000002A.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
    Source: hotmailpulse.exe, 00000004.00000002.1858377544.00007FF81F8CC000.00000002.00000001.01000000.0000002A.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
    Source: u08NgsGNym.exeReversingLabs: Detection: 18%
    Source: hotmailpulse.exeString found in binary or memory: -help
    Source: hotmailpulse.exeString found in binary or memory: -startline must be less than or equal to -endline
    Source: C:\Users\user\Desktop\u08NgsGNym.exeFile read: C:\Users\user\Desktop\u08NgsGNym.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\u08NgsGNym.exe "C:\Users\user\Desktop\u08NgsGNym.exe"
    Source: C:\Users\user\Desktop\u08NgsGNym.exeProcess created: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe "C:\Users\user\AppData\Local\Temp\hotmailpulse.exe"
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeProcess created: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe "C:\Users\user\AppData\Local\Temp\hotmailpulse.exe"
    Source: C:\Users\user\Desktop\u08NgsGNym.exeProcess created: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe "C:\Users\user\AppData\Local\Temp\hotmailpulse.exe" Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeProcess created: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe "C:\Users\user\AppData\Local\Temp\hotmailpulse.exe" Jump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: <pi-ms-win-core-localization-l1-2-1.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: dxgidebug.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: sfc_os.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: dwmapi.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: riched20.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: usp10.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: msls31.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: windowscodecs.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: textshaping.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: textinputframework.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: coreuicomponents.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: coremessaging.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: propsys.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: edputil.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: urlmon.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: iertutil.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: windows.staterepositoryps.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: appresolver.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: bcp47langs.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: slc.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: sppc.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: onecorecommonproxystub.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: pcacli.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: vcruntime140.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: libffi-8.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: propsys.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: libcrypto-3.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: libssl-3.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: tcl86t.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: tk86t.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: netapi32.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: zlib1.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: logoncli.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: samcli.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: textinputframework.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: coreuicomponents.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: coremessaging.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: coremessaging.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: dwmapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: textshaping.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: sqlite3.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: pywintypes312.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: vcruntime140_1.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: pdh.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: wtsapi32.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: rasadhlp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeSection loaded: fwpuclnt.dllJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: u08NgsGNym.exeStatic file information: File size 36780891 > 1048576
    Source: u08NgsGNym.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
    Source: u08NgsGNym.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
    Source: u08NgsGNym.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
    Source: u08NgsGNym.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: u08NgsGNym.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
    Source: u08NgsGNym.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
    Source: u08NgsGNym.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
    Source: u08NgsGNym.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1363777844.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1365511367.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356526532.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1357769709.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: hotmailpulse.exe, 00000004.00000002.1865868212.00007FF8217D9000.00000002.00000001.01000000.00000026.sdmp
    Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356093028.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1362720803.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1363505875.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: hotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmp
    Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1365669633.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: hotmailpulse.exe, 00000004.00000002.1862825006.00007FF820799000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: hotmailpulse.exe, 00000002.00000003.1355406823.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1869412323.00007FF830408000.00000002.00000001.01000000.0000001C.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: hotmailpulse.exe, 00000002.00000003.1352840557.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb** source: hotmailpulse.exe, 00000004.00000002.1858081978.00007FF81F780000.00000002.00000001.01000000.0000002D.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: hotmailpulse.exe, 00000002.00000003.1354644629.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356875585.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1363021068.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: hotmailpulse.exe, 00000002.00000003.1353052794.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1868447060.00007FF82D8A5000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1362430797.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1363392688.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb source: hotmailpulse.exe, 00000004.00000002.1858081978.00007FF81F780000.00000002.00000001.01000000.0000002D.sdmp
    Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356219933.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: hotmailpulse.exe, 00000002.00000003.1354364624.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1868856056.00007FF82F417000.00000002.00000001.01000000.00000020.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: hotmailpulse.exe, 00000004.00000002.1865868212.00007FF8217D9000.00000002.00000001.01000000.00000026.sdmp
    Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1358133902.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1355701641.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: hotmailpulse.exe, 00000002.00000003.1353185923.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1870441456.00007FF8328B8000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356347166.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1363269279.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: hotmailpulse.exe, 00000002.00000003.1353380754.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
    Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1359104041.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: hotmailpulse.exe, 00000002.00000003.1354913268.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: hotmailpulse.exe, 00000002.00000003.1353052794.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1868447060.00007FF82D8A5000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: X509_SIGPKCS8_encrypt_excrypto\pkcs12\p12_p8e.cPKCS8_set0_pbe_excompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: hotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmp
    Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1365950297.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: u08NgsGNym.exe, 00000000.00000000.1308101156.00000000005E6000.00000002.00000001.01000000.00000003.sdmp, u08NgsGNym.exe, 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: hotmailpulse.exe, 00000004.00000002.1863841719.00007FF820CF4000.00000002.00000001.01000000.0000000B.sdmp
    Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356799707.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: hotmailpulse.exe, 00000004.00000002.1859222363.00007FF81FC9F000.00000002.00000001.01000000.00000023.sdmp
    Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: hotmailpulse.exe, 00000004.00000002.1862825006.00007FF820831000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: hotmailpulse.exe, 00000004.00000002.1867396530.00007FF821D34000.00000002.00000001.01000000.00000018.sdmp
    Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: hotmailpulse.exe, 00000002.00000003.1362613004.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1358050990.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1355936904.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: hotmailpulse.exe, 00000002.00000003.1354726180.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1363138714.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: hotmailpulse.exe, 00000002.00000003.1352840557.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: hotmailpulse.exe, 00000004.00000002.1858377544.00007FF81F8CC000.00000002.00000001.01000000.0000002A.sdmp
    Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1364132565.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: hotmailpulse.exe, 00000002.00000003.1357328633.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: hotmailpulse.exe, 00000004.00000002.1862825006.00007FF820831000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: hotmailpulse.exe, 00000002.00000003.1358260975.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1357960221.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1366068641.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1362116641.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1362902586.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1362292219.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356646528.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: hotmailpulse.exe, 00000002.00000003.1354512545.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1365384076.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1357057935.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: crypto\stack\stack.cOPENSSL_sk_dupOPENSSL_sk_deep_copysk_reserveOPENSSL_sk_new_reserveOPENSSL_sk_reserveOPENSSL_sk_insertOPENSSL_sk_seti=%dcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC3.1.4built on: Fri Nov 24 00:12:45 2023 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptoOPENSSL_atexitcrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: hotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: hotmailpulse.exe, 00000002.00000003.1354826966.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-7t032bmh\src\rust\target\release\deps\cryptography_rust.pdbcQ source: hotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmp
    Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-7t032bmh\src\rust\target\release\deps\cryptography_rust.pdb source: hotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmp
    Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1356944715.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: hotmailpulse.exe, 00000002.00000003.1355565526.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: hotmailpulse.exe, 00000004.00000002.1868075535.00007FF82C45F000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: hotmailpulse.exe, 00000004.00000002.1831263020.0000015D5BEA0000.00000002.00000001.01000000.0000000D.sdmp
    Source: Binary string: D:\a\1\b\libssl-3.pdb source: hotmailpulse.exe, 00000004.00000002.1867396530.00007FF821D34000.00000002.00000001.01000000.00000018.sdmp
    Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1363678248.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: hotmailpulse.exe, 00000002.00000003.1365830372.00000267ACC65000.00000004.00000020.00020000.00000000.sdmp
    Source: u08NgsGNym.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
    Source: u08NgsGNym.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
    Source: u08NgsGNym.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
    Source: u08NgsGNym.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
    Source: u08NgsGNym.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
    Source: VCRUNTIME140_1.dll.2.drStatic PE information: 0xFB76EAA0 [Mon Sep 10 13:35:28 2103 UTC]
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F77DB00 GetModuleHandleW,LoadLibraryW,GetProcAddress,AddAccessAllowedAce,GetProcAddress,AddAccessDeniedAce,GetProcAddress,AddAccessAllowedAceEx,GetProcAddress,AddMandatoryAce,GetProcAddress,AddAccessAllowedObjectAce,GetProcAddress,AddAccessDeniedAceEx,GetProcAddress,AddAccessDeniedObjectAce,GetProcAddress,AddAuditAccessAceEx,GetProcAddress,AddAuditAccessObjectAce,GetProcAddress,SetSecurityDescriptorControl,InitializeCriticalSection,TlsAlloc,DeleteCriticalSection,TlsFree,4_2_00007FF81F77DB00
    Source: C:\Users\user\Desktop\u08NgsGNym.exeFile created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5416265Jump to behavior
    Source: u08NgsGNym.exeStatic PE information: section name: .didat
    Source: hotmailpulse.exe.0.drStatic PE information: section name: _RDATA
    Source: VCRUNTIME140.dll.2.drStatic PE information: section name: fothk
    Source: VCRUNTIME140.dll.2.drStatic PE information: section name: _RDATA
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005D125A push ecx; ret 0_2_005D126D
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005D1DB0 push ecx; ret 0_2_005D1DC3
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F985004 push rsp; retf 2_2_00007FF72F985005
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F914AEE push 6FFDC5D5h; iretd 4_2_00007FF81F914AF4
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F9176D3 push 6FFDC5D5h; iretd 4_2_00007FF81F9176D9
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F917425 push 60F5C5F1h; iretd 4_2_00007FF81F91742D
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F914640 push 60F5C5F1h; iretd 4_2_00007FF81F914648
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F914F9E push 6FFDC5CAh; ret 4_2_00007FF81F914FA4
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F917983 push 6FFDC5CAh; ret 4_2_00007FF81F917989
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F914FEA push 6FFDC5C3h; iretd 4_2_00007FF81F914FF0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F9179CF push 6FFDC5C3h; iretd 4_2_00007FF81F9179D5

    Persistence and Installation Behavior

    barindex
    Contains functionality to infect the boot sector
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, \\.\PhysicalDrive%d4_2_00007FF81F012B00
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, PhysicalDrive%i4_2_00007FF81F012B00
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i4_2_00007FF81F012B00
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i4_2_00007FF81F012B00
    Found pyInstaller with non standard icon
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeProcess created: "C:\Users\user\AppData\Local\Temp\hotmailpulse.exe"
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_chacha20.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_tkinter.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_decimal.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\VCRUNTIME140_1.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Math\_modexp.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_bz2.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_ctypes.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-private-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_poly1305.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\VCRUNTIME140.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imagingmath.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_des.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ctr.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_sqlite3.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_aes.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_cfb.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_cffi_backend.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_ghash_portable.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-file-l2-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_x25519.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_lzma.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-util-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_queue.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ofb.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_ed25519.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA512.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_hashlib.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA384.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_arc2.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_MD2.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA256.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Util\_strxor.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_ghash_clmul.pydJump to dropped file
    Source: C:\Users\user\Desktop\u08NgsGNym.exeFile created: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_des3.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_MD4.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Protocol\_scrypt.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-string-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_Salsa20.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_aesni.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-console-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_socket.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_BLAKE2b.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imagingtk.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_cast.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-file-l1-2-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA224.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_ec_ws.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_ed448.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imaging.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_overlapped.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_asyncio.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ocb.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_MD5.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_ARC4.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_keccak.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_webp.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_RIPEMD160.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_wmi.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_BLAKE2s.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ecb.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA1.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imagingcms.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_ssl.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_cbc.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Util\_cpuid_c.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-file-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\_multiprocessing.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file

    Boot Survival

    barindex
    Contains functionality to infect the boot sector
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, \\.\PhysicalDrive%d4_2_00007FF81F012B00
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, PhysicalDrive%i4_2_00007FF81F012B00
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i4_2_00007FF81F012B00
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i4_2_00007FF81F012B00
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F018AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct,4_2_00007FF81F018AA0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF341F0 IsIconic,IsZoomed,AdjustWindowRectEx,SendMessageW,SendMessageW,GetSystemMetrics,MoveWindow,GetWindowRect,GetClientRect,MoveWindow,GetWindowRect,MoveWindow,DrawMenuBar,4_2_00007FF81FF341F0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F946EF0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,2_2_00007FF72F946EF0
    Source: C:\Users\user\Desktop\u08NgsGNym.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: PyList_New,OpenSCManagerA,GetLastError,PyErr_SetFromWindowsErrWithFilename,EnumServicesStatusExW,GetLastError,free,malloc,EnumServicesStatusExW,PyUnicode_FromWideChar,PyUnicode_FromWideChar,Py_BuildValue,PyList_Append,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,CloseServiceHandle,free,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,CloseServiceHandle,free,4_2_00007FF81F018170
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_chacha20.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_aesni.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-console-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_tkinter.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_decimal.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_socket.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_BLAKE2b.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Math\_modexp.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_bz2.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_ctypes.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-private-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imagingtk.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_poly1305.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_cast.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-file-l1-2-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA224.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_ec_ws.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imagingmath.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_ed448.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_des.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imaging.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ctr.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_overlapped.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_asyncio.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_sqlite3.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ocb.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_aes.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_cfb.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_cffi_backend.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_ghash_portable.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-file-l2-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_x25519.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_lzma.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_MD5.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_ARC4.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-util-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_keccak.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_webp.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_RIPEMD160.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_wmi.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_BLAKE2s.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_queue.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ofb.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_ed25519.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ecb.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA512.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_hashlib.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA384.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA1.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_arc2.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_MD2.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_ssl.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imagingcms.cp312-win_amd64.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Util\_strxor.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_cbc.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA256.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Util\_cpuid_c.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-file-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_ghash_clmul.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\_multiprocessing.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Protocol\_scrypt.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_des3.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_MD4.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-string-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_Salsa20.pydJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_2-16430
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeAPI coverage: 3.6 %
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005BC4A8 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,0_2_005BC4A8
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005CE560 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,0_2_005CE560
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005DD998 FindFirstFileExA,0_2_005DD998
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F9488D0 FindFirstFileExW,FindClose,2_2_00007FF72F9488D0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F957E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,2_2_00007FF72F957E4C
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F957E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,2_2_00007FF72F957E4C
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F961EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF72F961EE4
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F012E70 memset,PyList_New,SetErrorMode,PyArg_ParseTuple,PyObject_IsTrue,PyEval_SaveThread,GetLogicalDriveStringsA,PyEval_RestoreThread,PyErr_SetFromWindowsErr,SetErrorMode,PyEval_SaveThread,GetDriveTypeA,PyEval_RestoreThread,GetVolumeInformationA,strcat_s,SetLastError,strcat_s,strcat_s,strcat_s,FindFirstVolumeMountPointA,strcpy_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,FindNextVolumeMountPointA,FindVolumeMountPointClose,strcat_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,strchr,SetErrorMode,FindVolumeMountPointClose,SetErrorMode,_Py_Dealloc,_Py_Dealloc,4_2_00007FF81F012E70
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005D0B80 VirtualQuery,GetSystemInfo,0_2_005D0B80
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile opened: C:\Users\user\AppData\Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile opened: C:\Users\user\Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI79882\Jump to behavior
    Source: hotmailpulse.exe, 00000002.00000003.1366651327.00000267ACC65000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
    Source: u08NgsGNym.exe, 00000000.00000003.1345288158.0000000002E34000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
    Source: hotmailpulse.exe, 00000004.00000002.1832484171.0000015D5C230000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
    Source: C:\Users\user\Desktop\u08NgsGNym.exeAPI call chain: ExitProcess graph end nodegraph_0-25023
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005D647F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_005D647F
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F77DB00 GetModuleHandleW,LoadLibraryW,GetProcAddress,AddAccessAllowedAce,GetProcAddress,AddAccessDeniedAce,GetProcAddress,AddAccessAllowedAceEx,GetProcAddress,AddMandatoryAce,GetProcAddress,AddAccessAllowedObjectAce,GetProcAddress,AddAccessDeniedAceEx,GetProcAddress,AddAccessDeniedObjectAce,GetProcAddress,AddAuditAccessAceEx,GetProcAddress,AddAuditAccessObjectAce,GetProcAddress,SetSecurityDescriptorControl,InitializeCriticalSection,TlsAlloc,DeleteCriticalSection,TlsFree,4_2_00007FF81F77DB00
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005DA640 mov eax, dword ptr fs:[00000030h]0_2_005DA640
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005DE680 GetProcessHeap,0_2_005DE680
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005D215D SetUnhandledExceptionFilter,0_2_005D215D
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005D12D7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_005D12D7
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005D647F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_005D647F
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005D1FCA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_005D1FCA
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F94C760 SetUnhandledExceptionFilter,2_2_00007FF72F94C760
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F94C57C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF72F94C57C
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F94BCE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FF72F94BCE0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F95ABD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF72F95ABD8
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F01A050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF81F01A050
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F01A978 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81F01A978
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F031390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF81F031390
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F031960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81F031960
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F041390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF81F041390
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F041960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81F041960
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F051390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF81F051390
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F051960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81F051960
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F061390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF81F061390
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F061960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81F061960
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F071390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF81F071390
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F071960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81F071960
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F081390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF81F081390
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F081960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81F081960
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F091390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF81F091390
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F091960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81F091960
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0A1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF81F0A1390
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0A1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81F0A1960
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0B1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF81F0B1390
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0B1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81F0B1960
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0DBCC8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81F0DBCC8
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F0DB360 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF81F0DB360
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F77F85C SetUnhandledExceptionFilter,4_2_00007FF81F77F85C
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F77F674 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81F77F674
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FB92AA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF81FB92AA0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FB93068 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81FB93068
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FEF1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81FEF1960
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FEF1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF81FEF1390
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF01960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF81FF01960
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81FF01390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF81FF01390
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF82000DEDC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF82000DEDC
    Source: C:\Users\user\Desktop\u08NgsGNym.exeProcess created: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe "C:\Users\user\AppData\Local\Temp\hotmailpulse.exe" Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeProcess created: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe "C:\Users\user\AppData\Local\Temp\hotmailpulse.exe" Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F777CD0 PyArg_ParseTuple,PyExc_TypeError,PyErr_SetString,GetSecurityDescriptorDacl,free,SetSecurityDescriptorDacl,GetSecurityDescriptorOwner,free,GetSecurityDescriptorGroup,free,free,free,4_2_00007FF81F777CD0
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 4_2_00007FF81F778B50 _PyArg_ParseTuple_SizeT,PyErr_Clear,_PyArg_ParseTuple_SizeT,PyErr_Clear,_PyArg_ParseTuple_SizeT,PySequence_Check,PyExc_TypeError,PyErr_SetString,PySequence_Size,PySequence_Tuple,_PyArg_ParseTuple_SizeT,_Py_Dealloc,AllocateAndInitializeSid,PyExc_ValueError,PyErr_SetString,_Py_NewReference,malloc,memset,memcpy,4_2_00007FF81F778B50
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005C27A9 cpuid 0_2_005C27A9
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: GetLocaleInfoW,GetNumberFormatW,0_2_005CD0AB
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Util VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\PIL VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\PIL VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\PIL VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\PIL VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\certifi VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\charset_normalizer VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\customtkinter VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\customtkinter\assets VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\customtkinter VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\customtkinter\assets VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\customtkinter\assets\fonts VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\customtkinter VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\customtkinter\assets\icons VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\customtkinter\assets\themes VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\customtkinter VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\customtkinter\assets VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\customtkinter\assets\themes VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy\core VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy\random VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy\random VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy\random VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy\random VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\numpy\random VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl8 VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl8\8.4 VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl8 VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl8\8.5 VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\http1.0 VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\tcl VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\ucrtbase.dll VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882 VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882 VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882 VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882 VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882 VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\_bz2.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882 VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\_lzma.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882 VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79882\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005D037C GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,0_2_005D037C
    Source: C:\Users\user\AppData\Local\Temp\hotmailpulse.exeCode function: 2_2_00007FF72F966370 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,2_2_00007FF72F966370
    Source: C:\Users\user\Desktop\u08NgsGNym.exeCode function: 0_2_005BD076 GetVersionExW,0_2_005BD076

    Stealing of Sensitive Information

    barindex
    Yara detected Generic Python Stealer
    Source: Yara matchFile source: Process Memory Space: hotmailpulse.exe PID: 7400, type: MEMORYSTR

    Remote Access Functionality

    barindex
    Yara detected Generic Python Stealer
    Source: Yara matchFile source: Process Memory Space: hotmailpulse.exe PID: 7400, type: MEMORYSTR

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
    Windows Management Instrumentation    		1
    Windows Service    		1
    Access Token Manipulation    		1
    Virtualization/Sandbox Evasion    		OS Credential Dumping2
    System Time Discovery    		Remote Services1
    Archive Collected Data    		12
    Encrypted Channel    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault Accounts3
    Command and Scripting Interpreter    		1
    Bootkit    		1
    Windows Service    		1
    Access Token Manipulation    		LSASS Memory31
    Security Software Discovery    		Remote Desktop ProtocolData from Removable Media1
    Non-Application Layer Protocol    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain Accounts2
    Service Execution    		1
    DLL Side-Loading    		11
    Process Injection    		11
    Process Injection    		Security Account Manager1
    Virtualization/Sandbox Evasion    		SMB/Windows Admin SharesData from Network Shared Drive2
    Application Layer Protocol    		Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal Accounts2
    Native API    		Login Hook1
    DLL Side-Loading    		1
    Deobfuscate/Decode Files or Information    		NTDS1
    Process Discovery    		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
    Obfuscated Files or Information    		LSA Secrets1
    Application Window Discovery    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
    Bootkit    		Cached Domain Credentials1
    System Service Discovery    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
    Software Packing    		DCSync4
    File and Directory Discovery    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
    Timestomp    		Proc Filesystem36
    System Information Discovery    		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
    DLL Side-Loading    		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    u08NgsGNym.exe18%ReversingLabs

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_chacha20.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ofb.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_BLAKE2b.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_BLAKE2s.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_MD2.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_MD4.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_MD5.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_RIPEMD160.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA1.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA224.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA256.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA384.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA512.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_ghash_clmul.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_ghash_portable.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_keccak.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_poly1305.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Math\_modexp.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Protocol\_scrypt.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_ec_ws.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_ed25519.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_ed448.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_x25519.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Util\_cpuid_c.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Util\_strxor.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imaging.cp312-win_amd64.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imagingcms.cp312-win_amd64.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imagingmath.cp312-win_amd64.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imagingtk.cp312-win_amd64.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_webp.cp312-win_amd64.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\VCRUNTIME140.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\VCRUNTIME140_1.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_asyncio.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_bz2.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_cffi_backend.cp312-win_amd64.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_ctypes.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_decimal.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_hashlib.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_lzma.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_multiprocessing.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_overlapped.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_queue.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_socket.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_sqlite3.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_ssl.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_tkinter.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\_wmi.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-console-l1-1-0.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-datetime-l1-1-0.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-debug-l1-1-0.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-errorhandling-l1-1-0.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-file-l1-1-0.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-file-l1-2-0.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-file-l2-1-0.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-handle-l1-1-0.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-heap-l1-1-0.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-interlocked-l1-1-0.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-libraryloader-l1-1-0.dll0%ReversingLabs

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    http://repository.swisssign.com/00%Avira URL Cloudsafe
    https://busquedasxurl.com/login/conexion/bloqueadoreslogs.php?ip=0%Avira URL Cloudsafe
    http://ocsp.accv.esex0%Avira URL Cloudsafe
    http://web.cs.ucdavis.edu/~rogaway/ocb/ll0%Avira URL Cloudsafe
    https://wwww.certigna.fr/autorites/R0%Avira URL Cloudsafe
    https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html0%Avira URL Cloudsafe
    https://busquedasxurl.com/login/conexion/0%Avira URL Cloudsafe
    https://upload.pypi.org/legacy/y0%Avira URL Cloudsafe
    https://www.mia.uni-saarland.de/Publications/gwosdek-ssvm11.pdf0%Avira URL Cloudsafe
    https://exiv2.org/tags.html)0%Avira URL Cloudsafe
    https://busquedasxurl.com/login/conexion/d.0%Avira URL Cloudsafe
    http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html0%Avira URL Cloudsafe
    https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html0%Avira URL Cloudsafe
    https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyP0%Avira URL Cloudsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    httpbin.org
    		34.224.200.202
    		truefalse
      		high

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      https://t.me/DarkSenderSMTPrG)hotmailpulse.exe, 00000004.00000003.1687899921.0000015D5CA26000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814143725.0000015D5CA7F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1836545713.0000015D5CA83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1688189580.0000015D5CA50000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        https://github.com/urllib3/urllib3/issues/29200hotmailpulse.exe, 00000004.00000002.1842425846.0000015D5E1C0000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdfhotmailpulse.exe, 00000004.00000003.1808997373.0000015D5FD35000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809526912.0000015D5FD3B000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.htmlhotmailpulse.exe, 00000004.00000002.1836589322.0000015D5CA90000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1839578501.0000015D5D4D3000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814143725.0000015D5CA7F000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/pyca/cryptography/issues/8996hotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmpfalse
              		high
              https://api.telegram.org/bothotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E840000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://github.com/giampaolo/psutil/issues/875.hotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E840000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  http://web.cs.ucdavis.edu/~rogaway/ocb/llhotmailpulse.exe, 00000004.00000003.1805940101.0000015D5FD9C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805508150.0000015D5FD97000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packageshotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    http://aka.ms/vcpython27hotmailpulse.exe, 00000004.00000002.1837281861.0000015D5CE80000.00000004.00001000.00020000.00000000.sdmpfalse
                      		high
                      https://github.com/mhammond/pywin32hotmailpulse.exe, hotmailpulse.exe, 00000004.00000002.1861370032.00007FF82018E000.00000002.00000001.01000000.0000002B.sdmpfalse
                        		high
                        http://crl.dhimyotis.com/certignarootca.crl0hotmailpulse.exe, 00000004.00000003.1822750915.0000015D5C9B1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1825561117.0000015D5C9BC000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          http://repository.swisssign.com/0hotmailpulse.exe, 00000004.00000002.1847093411.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808118699.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://docs.python.org/library/unittest.htmlhotmailpulse.exe, 00000004.00000003.1816214011.0000015D5C81C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809358729.0000015D5C811000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810215523.0000015D5C81A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1825064823.0000015D5C81C000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://setuptools.pypa.io/en/latest/hotmailpulse.exe, 00000004.00000002.1837281861.0000015D5CE80000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#hotmailpulse.exe, 00000004.00000003.1821324422.0000015D5BF24000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1831679621.0000015D5BF58000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812786585.0000015D5BF50000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824565515.0000015D5BF58000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1663682360.0000015D5BF5B000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://wwww.certigna.fr/autorites/Rhotmailpulse.exe, 00000004.00000003.1805821144.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807542339.0000015D5FE8A000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://t.me/DarkSenderSMTPhotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  http://goo.gl/zeJZl.hotmailpulse.exe, 00000004.00000002.1843237328.0000015D5EA28000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806201524.0000015D5D390000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://tools.ietf.org/html/rfc2388#section-4.4hotmailpulse.exe, 00000004.00000002.1833668316.0000015D5C3C1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810252926.0000015D5C395000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1827580652.0000015D5C3C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://packaging.python.org/en/latest/specifications/core-metadata/hotmailpulse.exe, 00000004.00000002.1837281861.0000015D5CE80000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		high
                                        http://ocsp.accv.esexhotmailpulse.exe, 00000004.00000003.1814667533.0000015D5C2EB000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816370187.0000015D5C330000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812535464.0000015D5C2E1000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64hotmailpulse.exe, 00000004.00000003.1825471481.0000015D5C7A4000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.com/pypa/packaginghotmailpulse.exe, 00000004.00000002.1842197328.0000015D5DB90000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		high
                                            https://upload.pypi.org/legacy/yhotmailpulse.exe, 00000004.00000002.1836879587.0000015D5CB40000.00000004.00001000.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://refspecs.linuxfoundation.org/elf/gabi4hotmailpulse.exe, 00000004.00000002.1837018610.0000015D5CC50000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842197328.0000015D5DB90000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages0hotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963hotmailpulse.exe, 00000004.00000002.1842299685.0000015D5DC90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://docs.python.org/3/library/subprocess#subprocess.Popen.killhotmailpulse.exe, 00000004.00000002.1837539996.0000015D5D090000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://tools.ietf.org/html/rfc3610hotmailpulse.exe, 00000004.00000003.1809079831.0000015D5D29C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814226149.0000015D5D2B3000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816691992.0000015D5CA33000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1827327667.0000015D5CA36000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1837978760.0000015D5D2B6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://github.com/platformdirs/platformdirshotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://peps.python.org/pep-0205/hotmailpulse.exe, 00000004.00000002.1834402844.0000015D5C640000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://crl.dhimyotis.com/certignarootca.crlhotmailpulse.exe, 00000004.00000003.1805411783.0000015D5FEA8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://curl.haxx.se/rfc/cookie_spec.htmlhotmailpulse.exe, 00000004.00000002.1842425846.0000015D5E1C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://ocsp.accv.eshotmailpulse.exe, 00000004.00000003.1814667533.0000015D5C2EB000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816370187.0000015D5C330000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812535464.0000015D5C2E1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://docs.python.org/3/library/subprocess#subprocess.Popen.returncodehotmailpulse.exe, 00000004.00000002.1837539996.0000015D5D090000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://aka.ms/vcpython270hotmailpulse.exe, 00000004.00000002.1837281861.0000015D5CE80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyhotmailpulse.exe, 00000004.00000002.1842299685.0000015D5DC90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688hotmailpulse.exe, 00000004.00000002.1831136950.0000015D5BE0C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://httpbin.org/gethotmailpulse.exe, 00000004.00000002.1842551421.0000015D5E2D0000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1825561117.0000015D5C9BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://crl.securetrust.com/STCA.crlqXhotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE3F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810439184.0000015D5FE47000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1853035964.0000015D5FE48000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://exiv2.org/tags.html)hotmailpulse.exe, 00000004.00000003.1823289898.0000015D5DA6A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://packaging.python.org/en/latest/specifications/entry-points/hotmailpulse.exe, 00000004.00000002.1837147512.0000015D5CD70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://github.com/python-pillow/Pillow/hotmailpulse.exe, 00000004.00000003.1690235667.0000015D5D457000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842551421.0000015D5E2D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-accesshotmailpulse.exe, 00000004.00000002.1838122137.0000015D5D302000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://pypi.org/project/build/).hotmailpulse.exe, 00000004.00000002.1837018610.0000015D5CC50000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1837147512.0000015D5CD70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://wwww.certigna.fr/autorites/0mhotmailpulse.exe, 00000004.00000003.1805940101.0000015D5FD9C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE1A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805508150.0000015D5FD97000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806080819.0000015D5FDF1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1822750915.0000015D5C9B1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1825561117.0000015D5C9BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerhotmailpulse.exe, 00000004.00000003.1821324422.0000015D5BF24000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1831679621.0000015D5BF58000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812786585.0000015D5BF50000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824565515.0000015D5BF58000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1663682360.0000015D5BF5B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://foo/bar.tgzhotmailpulse.exe, 00000004.00000002.1837018610.0000015D5CC50000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://github.com/python/cpython/issues/86361.hotmailpulse.exe, 00000004.00000003.1673607996.0000015D5C38E000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816497855.0000015D5C407000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1672286295.0000015D5C780000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1817217141.0000015D5C40A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1680948776.0000015D5C3EE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1672976565.0000015D5C38E000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1675233940.0000015D5C3EE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809979782.0000015D5C3CD000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810161382.0000015D5C3CF000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1683521684.0000015D5C3BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://busquedasxurl.com/login/conexion/hotmailpulse.exe, 00000004.00000002.1842299685.0000015D5DC90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://mail.python.org/pipermail/python-dev/2012-June/120787.html.hotmailpulse.exe, 00000004.00000003.1806690104.0000015D5F9C2000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E8B8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://httpbin.org/hotmailpulse.exe, 00000004.00000003.1690354586.0000015D5D3D3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://wwww.certigna.fr/autorites/hotmailpulse.exe, 00000004.00000003.1805821144.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807542339.0000015D5FE8A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-filehotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmpfalse
                                                                                                    		high
                                                                                                    https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gzhotmailpulse.exe, 00000004.00000003.1809358729.0000015D5C865000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824679689.0000015D5C865000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1688324215.0000015D5D295000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1821509298.0000015D5C865000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1826597392.0000015D5C86F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1835374937.0000015D5C872000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://busquedasxurl.com/login/conexion/bloqueadoreslogs.php?ip=hotmailpulse.exe, 00000004.00000002.1843094159.0000015D5E840000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.hotmailpulse.exe, 00000004.00000002.1837147512.0000015D5CD70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535hotmailpulse.exe, 00000004.00000003.1690354586.0000015D5D3A0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1813002199.0000015D5C835000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809603916.0000015D5C82E000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1811856247.0000015D5D3A0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809358729.0000015D5C811000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1815309398.0000015D5D3A6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syhotmailpulse.exe, 00000004.00000003.1821324422.0000015D5BF24000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1831679621.0000015D5BF58000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812786585.0000015D5BF50000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824565515.0000015D5BF58000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1663682360.0000015D5BF5B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://www.python.org/psf/license/hotmailpulse.exe, 00000004.00000002.1864570695.00007FF820EAE000.00000008.00000001.01000000.0000000B.sdmpfalse
                                                                                                              		high
                                                                                                              http://crl.xrampsecurity.com/XGCA.crlUXhotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE3F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810439184.0000015D5FE47000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1853035964.0000015D5FE48000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://docs.python.org/3/library/multiprocessing.htmlhotmailpulse.exe, 00000004.00000003.1825064823.0000015D5C814000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809358729.0000015D5C811000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816214011.0000015D5C813000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://www.mia.uni-saarland.de/Publications/gwosdek-ssvm11.pdfhotmailpulse.exe, 00000004.00000003.1828944183.0000015D5D51B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  • Avira URL Cloud: safe
                                                                                                                  		unknown
                                                                                                                  http://crl.securetrust.com/STCA.crlhotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE3F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810439184.0000015D5FE47000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1853035964.0000015D5FE48000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyPhotmailpulse.exe, 00000004.00000002.1842299685.0000015D5DC90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    http://wwwsearch.sf.net/):hotmailpulse.exe, 00000004.00000002.1838167948.0000015D5D329000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0hotmailpulse.exe, 00000004.00000002.1847093411.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814667533.0000015D5C2EB000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808118699.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816370187.0000015D5C330000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812535464.0000015D5C2E1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://www.accv.es/legislacion_c.htmhotmailpulse.exe, 00000004.00000003.1805821144.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807914722.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808779409.0000015D5FE85000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://tools.ietf.org/html/rfc6125#section-6.4.3hotmailpulse.exe, 00000004.00000002.1842425846.0000015D5E1C0000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1832832790.0000015D5C2ED000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814667533.0000015D5C2EB000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812535464.0000015D5C2E1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://www.zlib.net/Dhotmailpulse.exe, 00000002.00000003.1875910024.00000267ACC20000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000002.00000002.1876798382.00000267ACC5F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1866847291.00007FF821C68000.00000008.00000001.01000000.0000001F.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://cffi.readthedocs.io/en/latest/using.html#callbackshotmailpulse.exe, hotmailpulse.exe, 00000004.00000002.1857016622.00007FF81F0DD000.00000002.00000001.01000000.0000002F.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://crl.xrampsecurity.com/XGCA.crl0hotmailpulse.exe, 00000004.00000002.1847093411.0000015D5FA2E000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805940101.0000015D5FD9C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE1A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805508150.0000015D5FD97000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806690104.0000015D5FA11000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806080819.0000015D5FDF1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://bugs.python.org/issue44497.hotmailpulse.exe, 00000004.00000002.1836879587.0000015D5CB40000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1834402844.0000015D5C640000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://www.cert.fnmt.es/dpcs/hotmailpulse.exe, 00000004.00000003.1805821144.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814431216.0000015D5CA77000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1812463774.0000015D5FEA0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1853632211.0000015D5FEA0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807542339.0000015D5FE8A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807997377.0000015D5FE9B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://google.com/mailhotmailpulse.exe, 00000004.00000003.1815765971.0000015D5D3C9000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1822750915.0000015D5C9B1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1838455900.0000015D5D3C9000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690354586.0000015D5D3D3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://packaging.python.org/specifications/entry-points/hotmailpulse.exe, 00000004.00000002.1836879587.0000015D5CB40000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1834402844.0000015D5C640000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://github.com/jaraco/jaraco.functools/issues/5hotmailpulse.exe, 00000004.00000002.1837018610.0000015D5CC50000.00000004.00001000.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1842096757.0000015D5DA90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://www.accv.es00hotmailpulse.exe, 00000004.00000002.1847093411.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805821144.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1807914722.0000015D5FE83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808118699.0000015D5FA55000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808779409.0000015D5FE85000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://www.python.org/psf/license/)hotmailpulse.exe, 00000004.00000002.1863841719.00007FF820CF4000.00000002.00000001.01000000.0000000B.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyhotmailpulse.exe, 00000004.00000003.1663682360.0000015D5BF5B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://www.rfc-editor.org/info/rfc7253hotmailpulse.exe, 00000004.00000003.1805940101.0000015D5FD9C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1805508150.0000015D5FD97000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1851917416.0000015D5FCD1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://busquedasxurl.com/login/conexion/d.hotmailpulse.exe, 00000004.00000002.1842299685.0000015D5DC90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                    		unknown
                                                                                                                                                    https://github.com/pyca/cryptography/issueshotmailpulse.exe, 00000004.00000002.1857624055.00007FF81F5D3000.00000002.00000001.01000000.0000002E.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdfhotmailpulse.exe, 00000004.00000003.1809079831.0000015D5D29C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814226149.0000015D5D2B3000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816691992.0000015D5CA33000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1827327667.0000015D5CA36000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1837978760.0000015D5D2B6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://foss.heptapod.net/pypy/pypy/-/issues/3539hotmailpulse.exe, 00000004.00000002.1842299685.0000015D5DC90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.hotmailpulse.exe, 00000004.00000003.1826789749.0000015D5CA4C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1836424289.0000015D5CA5C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816691992.0000015D5CA33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://google.com/hotmailpulse.exe, 00000004.00000003.1816214011.0000015D5C7FD000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809833651.0000015D5C7D0000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1834944330.0000015D5C800000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824184745.0000015D5C7FF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://mahler:8092/site-updates.pyhotmailpulse.exe, 00000004.00000003.1815680328.0000015D5D416000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1811856247.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690040135.0000015D5D473000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814466985.0000015D5D412000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690708475.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806201524.0000015D5D405000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://crl.securetrust.com/SGCA.crlhotmailpulse.exe, 00000004.00000003.1807622103.0000015D5FE3F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810439184.0000015D5FE47000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1853035964.0000015D5FE48000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://.../back.jpeghotmailpulse.exe, 00000004.00000002.1842425846.0000015D5E1C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://tools.ietf.org/html/rfc7231#section-4.3.6)hotmailpulse.exe, 00000004.00000003.1807743858.0000015D5CB1B000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1810332074.0000015D5CB27000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1836765915.0000015D5CB28000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://tools.ietf.org/html/rfc5869hotmailpulse.exe, 00000004.00000003.1805508150.0000015D5FD97000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.htmlhotmailpulse.exe, 00000004.00000003.1815309398.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1811856247.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1838236074.0000015D5D36C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1838455900.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690708475.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806201524.0000015D5D405000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                                        		unknown
                                                                                                                                                                        https://github.com/python/importlib_metadata/issues/396Photmailpulse.exe, 00000004.00000002.1836879587.0000015D5CB40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://www.python.org/download/releases/2.3/mro/.hotmailpulse.exe, 00000004.00000003.1664692652.0000015D5BFD9000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1664591123.0000015D5BFCC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.htmlhotmailpulse.exe, 00000004.00000003.1810853271.0000015D5C8F8000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1821251727.0000015D5C8FE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1837903084.0000015D5D29E000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1808997373.0000015D5FD35000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809079831.0000015D5D29C000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814226149.0000015D5D2B3000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814037412.0000015D5C8F9000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1809358729.0000015D5C8AE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1829519430.0000015D5FD3A000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1824019656.0000015D5C8FF000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1827016414.0000015D5C8B2000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1816691992.0000015D5CA33000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1811492092.0000015D5C8AE000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1827327667.0000015D5CA36000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1837978760.0000015D5D2B6000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1851917416.0000015D5FCD1000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1835469962.0000015D5C8B4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://httpbin.org/posthotmailpulse.exe, 00000004.00000003.1814431216.0000015D5CA77000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://t.me/DarkSenderSMTPrGhotmailpulse.exe, 00000004.00000003.1687899921.0000015D5CA26000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814143725.0000015D5CA7F000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000002.1836545713.0000015D5CA83000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1688189580.0000015D5CA50000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://github.com/Ousret/charset_normalizerhotmailpulse.exe, 00000004.00000003.1815680328.0000015D5D416000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1811856247.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1814466985.0000015D5D412000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1690708475.0000015D5D405000.00000004.00000020.00020000.00000000.sdmp, hotmailpulse.exe, 00000004.00000003.1806201524.0000015D5D405000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high

                                                                                                                                                                                  World Map of Contacted IPs

                                                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                                                  • 75% < No. of IPs

                                                                                                                                                                                  Public IPs

                                                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                  34.224.200.202
                                                                                                                                                                                  		httpbin.orgUnited States
                                                                                                                                                                                  		14618AMAZON-AESUSfalse

                                                                                                                                                                                  General Information

                                                                                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                  Analysis ID:1571339
                                                                                                                                                                                  Start date and time:2024-12-09 09:56:10 +01:00
                                                                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                                                                  Overall analysis duration:0h 8m 53s
                                                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                                                  Report type:full
                                                                                                                                                                                  Cookbook file name:default.jbs
                                                                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                  Number of analysed new started processes analysed:7
                                                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                                                  Technologies:
                                                                                                                                                                                  • HCA enabled
                                                                                                                                                                                  • EGA enabled
                                                                                                                                                                                  • AMSI enabled
                                                                                                                                                                                  Analysis Mode:default
                                                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                                                  Sample name:u08NgsGNym.exe
                                                                                                                                                                                  renamed because original name is a hash value
                                                                                                                                                                                  Original Sample Name:23e0d0f06f84e215822d36bc160a0afd6a7e55263ca788e69a69eecb5b48f5b4.exe
                                                                                                                                                                                  Detection:MAL
                                                                                                                                                                                  Classification:mal64.troj.evad.winEXE@5/1029@1/1
                                                                                                                                                                                  EGA Information:
                                                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                                                  HCA Information:
                                                                                                                                                                                  • Successful, ratio: 97%
                                                                                                                                                                                  • Number of executed functions: 226
                                                                                                                                                                                  • Number of non-executed functions: 142
                                                                                                                                                                                  Cookbook Comments:
                                                                                                                                                                                  • Found application associated with file extension: .exe
                                                                                                                                                                                  • Stop behavior analysis, all processes terminated

                                                                                                                                                                                  Warnings

                                                                                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
                                                                                                                                                                                  • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                  • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtReadFile calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtWriteFile calls found.
                                                                                                                                                                                  • VT rate limit hit for: u08NgsGNym.exe

                                                                                                                                                                                  Simulations

                                                                                                                                                                                  Behavior and APIs

                                                                                                                                                                                  ⊘No simulations

                                                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                                                  IPs

                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                  34.224.200.202okG6LaM2yP.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                    11lbKZLNnQ.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                      r2PcRF79Mo.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                        eEiHdLSfum.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          eEiHdLSfum.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            nsh99t9Dox.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                                                                                                                                                              file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                file.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                                                                                                                                                                  file.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                                                                                                                                                                    file.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                      Domains

                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                      httpbin.orgokG6LaM2yP.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      • 34.224.200.202
                                                                                                                                                                                                      I6H1RkEHlX.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      • 44.196.3.45
                                                                                                                                                                                                      hKgrI6tqYx.exeGet hashmaliciousPython Stealer, BabadedaBrowse
                                                                                                                                                                                                      • 44.196.3.45
                                                                                                                                                                                                      L5cZ63IH4a.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      • 44.196.3.45
                                                                                                                                                                                                      478y7Ve1JG.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      • 44.196.3.45
                                                                                                                                                                                                      11lbKZLNnQ.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      • 34.224.200.202
                                                                                                                                                                                                      r2PcRF79Mo.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      • 34.224.200.202
                                                                                                                                                                                                      eEiHdLSfum.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 34.224.200.202
                                                                                                                                                                                                      eEiHdLSfum.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 44.196.3.45
                                                                                                                                                                                                      maniatelo.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      • 44.196.3.45

                                                                                                                                                                                                      ASNs

                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                      AMAZON-AESUSokG6LaM2yP.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      • 34.224.200.202
                                                                                                                                                                                                      I6H1RkEHlX.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      • 44.196.3.45
                                                                                                                                                                                                      hKgrI6tqYx.exeGet hashmaliciousPython Stealer, BabadedaBrowse
                                                                                                                                                                                                      • 44.196.3.45
                                                                                                                                                                                                      L5cZ63IH4a.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      • 44.196.3.45
                                                                                                                                                                                                      478y7Ve1JG.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      • 44.196.3.45
                                                                                                                                                                                                      11lbKZLNnQ.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      • 34.224.200.202
                                                                                                                                                                                                      r2PcRF79Mo.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      • 34.224.200.202
                                                                                                                                                                                                      eEiHdLSfum.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 44.196.3.45
                                                                                                                                                                                                      eEiHdLSfum.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 44.196.3.45
                                                                                                                                                                                                      maniatelo.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                      • 44.196.3.45

                                                                                                                                                                                                      JA3 Fingerprints

                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                      Dropped Files

                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_ARC4.pydokG6LaM2yP.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                        I6H1RkEHlX.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                          hKgrI6tqYx.exeGet hashmaliciousPython Stealer, BabadedaBrowse
                                                                                                                                                                                                            33sKdwH6im.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                              r2PcRF79Mo.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                KkgQY27Qqn.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  back.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    ChromeComboPack.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                      speedymaqing.exeGet hashmaliciousPython Stealer, Discord Token StealerBrowse
                                                                                                                                                                                                                        file.exeGet hashmaliciousCStealerBrowse

                                                                                                                                                                                                                          Created / dropped Files

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11264
                                                                                                                                                                                                                          Entropy (8bit):4.703513333396807
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:nDzb9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDV90OcX6gY/7ECFV:Dzz9damqTrpYTst0E5DVPcqgY/79X
                                                                                                                                                                                                                          MD5:6176101B7C377A32C01AE3EDB7FD4DE6
                                                                                                                                                                                                                          SHA1:5F1CB443F9D677F313BEC07C5241AEAB57502F5E
                                                                                                                                                                                                                          SHA-256:EFEA361311923189ECBE3240111EFBA329752D30457E0DBE9628A82905CD4BDB
                                                                                                                                                                                                                          SHA-512:3E7373B71AE0834E96A99595CFEF2E96C0F5230429ADC0B5512F4089D1ED0D7F7F0E32A40584DFB13C41D257712A9C4E9722366F0A21B907798AE79D8CEDCF30
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Joe Sandbox View:
                                                                                                                                                                                                                          • Filename: okG6LaM2yP.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: I6H1RkEHlX.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: hKgrI6tqYx.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: 33sKdwH6im.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: r2PcRF79Mo.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: KkgQY27Qqn.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: back.ps1, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: ChromeComboPack.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: speedymaqing.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          Reputation:moderate, very likely benign file
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d....e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13312
                                                                                                                                                                                                                          Entropy (8bit):4.968452734961967
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:JF3TgNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDqbwYH/kcX6gT:WF/1nb2mhQtkXHTeZ87VDqrMcqgYvEp
                                                                                                                                                                                                                          MD5:371776A7E26BAEB3F75C93A8364C9AE0
                                                                                                                                                                                                                          SHA1:BF60B2177171BA1C6B4351E6178529D4B082BDA9
                                                                                                                                                                                                                          SHA-256:15257E96D1CA8480B8CB98F4C79B6E365FE38A1BA9638FC8C9AB7FFEA79C4762
                                                                                                                                                                                                                          SHA-512:C23548FBCD1713C4D8348917FF2AB623C404FB0E9566AB93D147C62E06F51E63BDAA347F2D203FE4F046CE49943B38E3E9FA1433F6455C97379F2BC641AE7CE9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:moderate, very likely benign file
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):5.061461040216793
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:ldF/1nb2mhQtkXn0t/WS60YYDEiqvdvGyv9lkVcqgYvEMo:v2f6XSZ6XYD6vdvGyv9MgYvEMo
                                                                                                                                                                                                                          MD5:CB5238E2D4149636377F9A1E2AF6DC57
                                                                                                                                                                                                                          SHA1:038253BABC9E652BA4A20116886209E2BCCF35AC
                                                                                                                                                                                                                          SHA-256:A8D3BB9CD6A78EBDB4F18693E68B659080D08CB537F9630D279EC9F26772EFC7
                                                                                                                                                                                                                          SHA-512:B1E6AB509CF1E5ECC6A60455D6900A76514F8DF43F3ABC3B8D36AF59A3DF8A868B489ED0B145D0D799AAC8672CBF5827C503F383D3F38069ABF6056ECCD87B21
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:moderate, very likely benign file
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):5.236167046748013
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:/siHXqpoUol3xZhRyQX5lDnRDFYav+tcqgRvE:h6D+XBDgDgRvE
                                                                                                                                                                                                                          MD5:D9E7218460AEE693BEA07DA7C2B40177
                                                                                                                                                                                                                          SHA1:9264D749748D8C98D35B27BEFE6247DA23FF103D
                                                                                                                                                                                                                          SHA-256:38E423D3BCC32EE6730941B19B7D5D8872C0D30D3DD8F9AAE1442CB052C599AD
                                                                                                                                                                                                                          SHA-512:DDB579E2DEA9D266254C0D9E23038274D9AE33F0756419FD53EC6DC1A27D1540828EE8F4AD421A5CFFD9B805F1A68F26E70BDC1BAB69834E8ACD6D7BB7BDB0DB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:moderate, very likely benign file
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K..*...*...*...R...*...U...*..R...*...*...*...U...*...U...*...U...*.....*.....*...}..*.....*..Rich.*..........................PE..d....e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):36352
                                                                                                                                                                                                                          Entropy (8bit):6.558176937399355
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:Dz2P+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuCLg46:DzeqWB7YJlmLJ3oD/S4j990th9VCsC
                                                                                                                                                                                                                          MD5:F751792DF10CDEED391D361E82DAF596
                                                                                                                                                                                                                          SHA1:3440738AF3C88A4255506B55A673398838B4CEAC
                                                                                                                                                                                                                          SHA-256:9524D1DADCD2F2B0190C1B8EDE8E5199706F3D6C19D3FB005809ED4FEBF3E8B5
                                                                                                                                                                                                                          SHA-512:6159F245418AB7AD897B02F1AADF1079608E533B9C75006EFAF24717917EAA159846EE5DFC0E85C6CFF8810319EFECBA80C1D51D1F115F00EC1AFF253E312C00
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d....e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15872
                                                                                                                                                                                                                          Entropy (8bit):5.285191078037458
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:wJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD4jqccqgwYUMvEW:ikRwi3wO26Ef+yuIm9PfD7wgwYUMvE
                                                                                                                                                                                                                          MD5:BBEA5FFAE18BF0B5679D5C5BCD762D5A
                                                                                                                                                                                                                          SHA1:D7C2721795113370377A1C60E5CEF393473F0CC5
                                                                                                                                                                                                                          SHA-256:1F4288A098DA3AAC2ADD54E83C8C9F2041EC895263F20576417A92E1E5B421C1
                                                                                                                                                                                                                          SHA-512:0932EC5E69696D6DD559C30C19FC5A481BEFA38539013B9541D84499F2B6834A2FFE64A1008A1724E456FF15DDA6268B7B0AD8BA14918E2333567277B3716CC4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d....e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16384
                                                                                                                                                                                                                          Entropy (8bit):5.505471888568532
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:vd9VkyQ5f8vjVaCHpKpTTjaNe7oca2DW3Q2dhmdcqgwNeecBih:JkP5cjIGpKlqD2D4kzgwNeE
                                                                                                                                                                                                                          MD5:D2175300E065347D13211F5BF7581602
                                                                                                                                                                                                                          SHA1:3AE92C0B0ECDA1F6B240096A4E68D16D3DB1FFB0
                                                                                                                                                                                                                          SHA-256:94556934E3F9EE73C77552D2F3FC369C02D62A4C9E7143E472F8E3EE8C00AEE1
                                                                                                                                                                                                                          SHA-512:6156D744800206A431DEE418A1C561FFB45D726DC75467A91D26EE98503B280C6595CDEA02BDA6A023235BD010835EA1FC9CB843E9FEC3501980B47B6B490AF7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20992
                                                                                                                                                                                                                          Entropy (8bit):6.06124024160806
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:bUv5cJMOZA0nmwBD+XpJgLa0Mp8Qpg4P2llyM:0K1XBD+DgLa1yTi
                                                                                                                                                                                                                          MD5:45616B10ABE82D5BB18B9C3AB446E113
                                                                                                                                                                                                                          SHA1:91B2C0B0F690AE3ABFD9B0B92A9EA6167049B818
                                                                                                                                                                                                                          SHA-256:F348DB1843B8F38A23AEE09DD52FB50D3771361C0D529C9C9E142A251CC1D1EC
                                                                                                                                                                                                                          SHA-512:ACEA8C1A3A1FA19034FD913C8BE93D5E273B7719D76CB71C36F510042918EA1D9B44AC84D849570F9508D635B4829D3E10C36A461EC63825BA178F5AC1DE85FB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25088
                                                                                                                                                                                                                          Entropy (8bit):6.475467273446457
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:oc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy4IYgLWi:B6H1TZXX5XmrXA+NNxWiFdLWi
                                                                                                                                                                                                                          MD5:CF3C2F35C37AA066FA06113839C8A857
                                                                                                                                                                                                                          SHA1:39F3B0AEFB771D871A93681B780DA3BD85A6EDD0
                                                                                                                                                                                                                          SHA-256:1261783F8881642C3466B96FA5879A492EA9E0DAB41284ED9E4A82E8BCF00C80
                                                                                                                                                                                                                          SHA-512:1C36B80AAE49FD5E826E95D83297AE153FDB2BC652A47D853DF31449E99D5C29F42ED82671E2996AF60DCFB862EC5536BB0A68635D4E33D33F8901711C0C8BE6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                          Entropy (8bit):4.838534302892255
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:0F/1nb2mhQtkr+juOxKbDbnHcqgYvEkrK:u2f6iuOsbDtgYvEmK
                                                                                                                                                                                                                          MD5:20708935FDD89B3EDDEEA27D4D0EA52A
                                                                                                                                                                                                                          SHA1:85A9FE2C7C5D97FD02B47327E431D88A1DC865F7
                                                                                                                                                                                                                          SHA-256:11DD1B49F70DB23617E84E08E709D4A9C86759D911A24EBDDFB91C414CC7F375
                                                                                                                                                                                                                          SHA-512:F28C31B425DC38B5E9AD87B95E8071997E4A6F444608E57867016178CD0CA3E9F73A4B7F2A0A704E45F75B7DCFF54490510C6BF8461F3261F676E9294506D09B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):4.9047185025862925
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:NRgPX8lvI+KnwSDTPUDEhKWPXcqgzQkvEd:2og9rUD9mpgzQkvE
                                                                                                                                                                                                                          MD5:43BBE5D04460BD5847000804234321A6
                                                                                                                                                                                                                          SHA1:3CAE8C4982BBD73AF26EB8C6413671425828DBB7
                                                                                                                                                                                                                          SHA-256:FAA41385D0DB8D4EE2EE74EE540BC879CF2E884BEE87655FF3C89C8C517EED45
                                                                                                                                                                                                                          SHA-512:DBC60F1D11D63BEBBAB3C742FB827EFBDE6DFF3C563AE1703892D5643D5906751DB3815B97CBFB7DA5FCD306017E4A1CDCC0CDD0E61ADF20E0816F9C88FE2C9B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d....e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14848
                                                                                                                                                                                                                          Entropy (8bit):5.300163691206422
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:j0J1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDrdkrRcqgUF6+6vEX:jM01si8XSi3SACqe7tDeDgUUjvE
                                                                                                                                                                                                                          MD5:C6B20332B4814799E643BADFFD8DF2CD
                                                                                                                                                                                                                          SHA1:E7DA1C1F09F6EC9A84AF0AB0616AFEA55A58E984
                                                                                                                                                                                                                          SHA-256:61C7A532E108F67874EF2E17244358DF19158F6142680F5B21032BA4889AC5D8
                                                                                                                                                                                                                          SHA-512:D50C7F67D2DFB268AD4CF18E16159604B6E8A50EA4F0C9137E26619FD7835FAAD323B5F6A2B8E3EC1C023E0678BCBE5D0F867CD711C5CD405BD207212228B2B4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..*B..*B..*B..R...*B..UC..*B.RC..*B..*C..*B..UG..*B..UF..*B..UA..*B..J..*B..B..*B....*B..@..*B.Rich.*B.........................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):57856
                                                                                                                                                                                                                          Entropy (8bit):4.260220483695234
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:9XUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZNZY0JAIg+v:99HGHfJidSK
                                                                                                                                                                                                                          MD5:0B538205388FDD99A043EE3AFAA074E4
                                                                                                                                                                                                                          SHA1:E0DD9306F1DBE78F7F45A94834783E7E886EB70F
                                                                                                                                                                                                                          SHA-256:C4769D3E6EB2A2FECB5DEC602D45D3E785C63BB96297268E3ED069CC4A019B1A
                                                                                                                                                                                                                          SHA-512:2F4109E42DB7BC72EB50BCCC21EB200095312EA00763A255A38A4E35A77C04607E1DB7BB69A11E1D80532767B20BAA4860C05F52F32BF1C81FE61A7ECCEB35ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):58368
                                                                                                                                                                                                                          Entropy (8bit):4.276870967324261
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:9jUqho9weF5/eHkRnYcZiGKdZHDL7idErZjZYXGg:9RCneH//id42
                                                                                                                                                                                                                          MD5:6C3E976AB9F47825A5BD9F73E8DBA74E
                                                                                                                                                                                                                          SHA1:4C6EB447FE8F195CF7F4B594CE7EAF928F52B23A
                                                                                                                                                                                                                          SHA-256:238CDB6B8FB611DB4626E6D202E125E2C174C8F73AE8A3273B45A0FC18DEA70C
                                                                                                                                                                                                                          SHA-512:B19516F00CC0484D9CDA82A482BBFE41635CDBBE19C13F1E63F033C9A68DD36798C44F04D6BD8BAE6523A845E852D81ACADD0D5DD86AF62CC9D081B803F8DF7B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10752
                                                                                                                                                                                                                          Entropy (8bit):4.578113904149635
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:R0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwo2Pj15XkcX6gbW6z:DVddiT7pgTctEEI4qXDo11kcqgbW6
                                                                                                                                                                                                                          MD5:FEE13D4FB947835DBB62ACA7EAFF44EF
                                                                                                                                                                                                                          SHA1:7CC088AB68F90C563D1FE22D5E3C3F9E414EFC04
                                                                                                                                                                                                                          SHA-256:3E0D07BBF93E0748B42B1C2550F48F0D81597486038C22548224584AE178A543
                                                                                                                                                                                                                          SHA-512:DEA92F935BC710DF6866E89CC6EB5B53FC7ADF0F14F3D381B89D7869590A1B0B1F98F347664F7A19C6078E7AA3EB0F773FFCB711CC4275D0ECD54030D6CF5CB2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):6.143719741413071
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:IUv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Q90gYP2lXCM:BKR8I+K0lDFQgLa17zU
                                                                                                                                                                                                                          MD5:76F88D89643B0E622263AF676A65A8B4
                                                                                                                                                                                                                          SHA1:93A365060E98890E06D5C2D61EFBAD12F5D02E06
                                                                                                                                                                                                                          SHA-256:605C86145B3018A5E751C6D61FD0F85CF4A9EBF2AD1F3009A4E68CF9F1A63E49
                                                                                                                                                                                                                          SHA-512:979B97AAC01633C46C048010FA886EBB09CFDB5520E415F698616987AE850FD342A4210A8DC0FAC1E059599F253565862892171403F5E4F83754D02D2EF3F366
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17920
                                                                                                                                                                                                                          Entropy (8bit):5.353267174592179
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7PHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8bg6Vf4A:hPcnB8KSsB34cb+bcOYpMCBDX
                                                                                                                                                                                                                          MD5:D48BFFA1AF800F6969CFB356D3F75AA6
                                                                                                                                                                                                                          SHA1:2A0D8968D74EBC879A17045EFE86C7FB5C54AEE6
                                                                                                                                                                                                                          SHA-256:4AA5E9CE7A76B301766D3ECBB06D2E42C2F09D0743605A91BF83069FEFE3A4DE
                                                                                                                                                                                                                          SHA-512:30D14AD8C68B043CC49EAFB460B69E83A15900CB68B4E0CBB379FF5BA260194965EF300EB715308E7211A743FF07FA7F8779E174368DCAA7F704E43068CC4858
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                          Entropy (8bit):4.741247880746506
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:0F/1nb2mhQtkgU7L9D037tfcqgYvEJPb:u2f6L9DSJxgYvEJj
                                                                                                                                                                                                                          MD5:4D9182783EF19411EBD9F1F864A2EF2F
                                                                                                                                                                                                                          SHA1:DDC9F878B88E7B51B5F68A3F99A0857E362B0361
                                                                                                                                                                                                                          SHA-256:C9F4C5FFCDD4F8814F8C07CE532A164AB699AE8CDE737DF02D6ECD7B5DD52DBD
                                                                                                                                                                                                                          SHA-512:8F983984F0594C2CAC447E9D75B86D6EC08ED1C789958AFA835B0D1239FD4D7EBE16408D080E7FCE17C379954609A93FC730B11BE6F4A024E7D13D042B27F185
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14848
                                                                                                                                                                                                                          Entropy (8bit):5.212941287344097
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:2F/1nb2mhQtkRySMfJ2ycxFzShJD9bAal2QDeJKcqgQx2QY:M2fKRQB2j8JD2fJagQx2QY
                                                                                                                                                                                                                          MD5:F4EDB3207E27D5F1ACBBB45AAFCB6D02
                                                                                                                                                                                                                          SHA1:8EAB478CA441B8AD7130881B16E5FAD0B119D3F0
                                                                                                                                                                                                                          SHA-256:3274F49BE39A996C5E5D27376F46A1039B6333665BB88AF1CA6D37550FA27B29
                                                                                                                                                                                                                          SHA-512:7BDEBF9829CB26C010FCE1C69E7580191084BCDA3E2847581D0238AF1CAA87E68D44B052424FDC447434D971BB481047F8F2DA1B1DEF6B18684E79E63C6FBDC5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`..........................................9......|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14336
                                                                                                                                                                                                                          Entropy (8bit):5.181291194389683
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:hF/1nb2mhQt7fSOp/CJPvADQHKtxSOvbcqgEvcM+:N2fNKOZWPIDnxVlgEvL
                                                                                                                                                                                                                          MD5:9D28433EA8FFBFE0C2870FEDA025F519
                                                                                                                                                                                                                          SHA1:4CC5CF74114D67934D346BB39CA76F01F7ACC3E2
                                                                                                                                                                                                                          SHA-256:FC296145AE46A11C472F99C5BE317E77C840C2430FBB955CE3F913408A046284
                                                                                                                                                                                                                          SHA-512:66B4D00100D4143EA72A3F603FB193AFA6FD4EFB5A74D0D17A206B5EF825E4CC5AF175F5FB5C40C022BDE676BA7A83087CB95C9F57E701CA4E7F0A2FCE76E599
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14336
                                                                                                                                                                                                                          Entropy (8bit):5.140195114409974
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:RsiHXqpo0cUp8XnUp8XjEQnlDtJI6rcqgcx2:f6DcUp8XUp8AclDA69gcx2
                                                                                                                                                                                                                          MD5:8A92EE2B0D15FFDCBEB7F275154E9286
                                                                                                                                                                                                                          SHA1:FA9214C8BBF76A00777DFE177398B5F52C3D972D
                                                                                                                                                                                                                          SHA-256:8326AE6AD197B5586222AFA581DF5FE0220A86A875A5E116CB3828E785FBF5C2
                                                                                                                                                                                                                          SHA-512:7BA71C37AAF6CB10FC5C595D957EB2846032543626DE740B50D7CB954FF910DCF7CEAA56EB161BAB9CC1F663BADA6CA71973E6570BAC7D6DA4D4CC9ED7C6C3DA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):5.203867759982304
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:WsiHXqpwUiv6wPf+4WVrd1DFrCqwWwcqgfvE:s6biio2Pd1DFmlgfvE
                                                                                                                                                                                                                          MD5:FE16E1D12CF400448E1BE3FCF2D7BB46
                                                                                                                                                                                                                          SHA1:81D9F7A2C6540F17E11EFE3920481919965461BA
                                                                                                                                                                                                                          SHA-256:ADE1735800D9E82B787482CCDB0FBFBA949E1751C2005DCAE43B0C9046FE096F
                                                                                                                                                                                                                          SHA-512:A0463FF822796A6C6FF3ACEBC4C5F7BA28E7A81E06A3C3E46A0882F536D656D3F8BAF6FB748008E27F255FE0F61E85257626010543FC8A45A1E380206E48F07C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15360
                                                                                                                                                                                                                          Entropy (8bit):5.478301937972917
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:hZ9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZkRsP0rcqgjPrvE:8Q0gH7zSccA5J6ECTGmDua89gjPrvE
                                                                                                                                                                                                                          MD5:34EBB5D4A90B5A39C5E1D87F61AE96CB
                                                                                                                                                                                                                          SHA1:25EE80CC1E647209F658AEBA5841F11F86F23C4E
                                                                                                                                                                                                                          SHA-256:4FC70CB9280E414855DA2C7E0573096404031987C24CF60822854EAA3757C593
                                                                                                                                                                                                                          SHA-512:82E27044FD53A7309ABAECA06C077A43EB075ADF1EF0898609F3D9F42396E0A1FA4FFD5A64D944705BBC1B1EBB8C2055D8A420807693CC5B70E88AB292DF81B7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):18432
                                                                                                                                                                                                                          Entropy (8bit):5.69608744353984
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:nkP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+DSngkov:onx7RI26LuuHKz8+DbN
                                                                                                                                                                                                                          MD5:42C2F4F520BA48779BD9D4B33CD586B9
                                                                                                                                                                                                                          SHA1:9A1D6FFA30DCA5CE6D70EAC5014739E21A99F6D8
                                                                                                                                                                                                                          SHA-256:2C6867E88C5D3A83D62692D24F29624063FCE57F600483BAD6A84684FF22F035
                                                                                                                                                                                                                          SHA-512:1F0C18E1829A5BAE4A40C92BA7F8422D5FE8DBE582F7193ACEC4556B4E0593C898956065F398ACB34014542FCB3365DC6D4DA9CE15CB7C292C8A2F55FB48BB2B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.*... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19456
                                                                                                                                                                                                                          Entropy (8bit):5.7981108922569735
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:qPHNP3MjevhSY/8EBbVxcJ0ihTLdFDuPHgj+kf4D:sPcKvr/jUJ0sbDGAj+t
                                                                                                                                                                                                                          MD5:AB0BCB36419EA87D827E770A080364F6
                                                                                                                                                                                                                          SHA1:6D398F48338FB017AACD00AE188606EB9E99E830
                                                                                                                                                                                                                          SHA-256:A927548ABEA335E6BCB4A9EE0A949749C9E4AA8F8AAD481CF63E3AC99B25A725
                                                                                                                                                                                                                          SHA-512:3580FB949ACEE709836C36688457908C43860E68A36D3410F3FA9E17C6A66C1CDD7C081102468E4E92E5F42A0A802470E8F4D376DAA4ED7126818538E0BD0BC4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):5.865452719694432
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:y1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOcwgjxo:QjwyJUYToZwOLuzDNB1j
                                                                                                                                                                                                                          MD5:C8FE3FF9C116DB211361FBB3EA092D33
                                                                                                                                                                                                                          SHA1:180253462DD59C5132FBCCC8428DEA1980720D26
                                                                                                                                                                                                                          SHA-256:25771E53CFECB5462C0D4F05F7CAE6A513A6843DB2D798D6937E39BA4B260765
                                                                                                                                                                                                                          SHA-512:16826BF93C8FA33E0B5A2B088FB8852A2460E0A02D699922A39D8EB2A086E981B5ACA2B085F7A7DA21906017C81F4D196B425978A10F44402C5DB44B2BF4D00A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):5.867732744112887
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:51jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNIegjxo:rjwyJOYToZwOLuzDNI7j
                                                                                                                                                                                                                          MD5:A442EA85E6F9627501D947BE3C48A9DD
                                                                                                                                                                                                                          SHA1:D2DEC6E1BE3B221E8D4910546AD84FE7C88A524D
                                                                                                                                                                                                                          SHA-256:3DBCB4D0070BE355E0406E6B6C3E4CE58647F06E8650E1AB056E1D538B52B3D3
                                                                                                                                                                                                                          SHA-512:850A00C7069FFDBA1EFE1324405DA747D7BD3BA5D4E724D08A2450B5A5F15A69A0D3EAF67CEF943F624D52A4E2159A9F7BDAEAFDC6C689EACEA9987414250F3B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):27136
                                                                                                                                                                                                                          Entropy (8bit):5.860044313282322
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:xFDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDXfgjVx2:jDLh98jjRe+1WT1aAeIfMzxH2mDDIj
                                                                                                                                                                                                                          MD5:59BA0E05BE85F48688316EE4936421EA
                                                                                                                                                                                                                          SHA1:1198893F5916E42143C0B0F85872338E4BE2DA06
                                                                                                                                                                                                                          SHA-256:C181F30332F87FEECBF930538E5BDBCA09089A2833E8A088C3B9F3304B864968
                                                                                                                                                                                                                          SHA-512:D772042D35248D25DB70324476021FB4303EF8A0F61C66E7DED490735A1CC367C2A05D7A4B11A2A68D7C34427971F96FF7658D880E946C31C17008B769E3B12F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):27136
                                                                                                                                                                                                                          Entropy (8bit):5.917025846093607
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:tFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXwElrgjhig:PYLB9Mgj0e+1WT1aAeIfMzx320DXD+j
                                                                                                                                                                                                                          MD5:8194D160FB215498A59F850DC5C9964C
                                                                                                                                                                                                                          SHA1:D255E8CCBCE663EE5CFD3E1C35548D93BFBBFCC0
                                                                                                                                                                                                                          SHA-256:55DEFCD528207D4006D54B656FD4798977BD1AAE6103D4D082A11E0EB6900B08
                                                                                                                                                                                                                          SHA-512:969EEAA754519A58C352C24841852CF0E66C8A1ADBA9A50F6F659DC48C3000627503DDFB7522DA2DA48C301E439892DE9188BF94EEAF1AE211742E48204C5E42
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12800
                                                                                                                                                                                                                          Entropy (8bit):4.999870226643325
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:DzFRF/1nb2mhQtk4axusjfkgZhoYDQgRjcqgQvEty:DzFd2f64axnTTz5D1gQvEty
                                                                                                                                                                                                                          MD5:C89BECC2BECD40934FE78FCC0D74D941
                                                                                                                                                                                                                          SHA1:D04680DF546E2D8A86F60F022544DB181F409C50
                                                                                                                                                                                                                          SHA-256:E5B6E58D6DA8DB36B0673539F0C65C80B071A925D2246C42C54E9FCDD8CA08E3
                                                                                                                                                                                                                          SHA-512:715B3F69933841BAADC1C30D616DB34E6959FD9257D65E31C39CD08C53AFA5653B0E87B41DCC3C5E73E57387A1E7E72C0A668578BD42D5561F4105055F02993C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d....e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13312
                                                                                                                                                                                                                          Entropy (8bit):5.025153056783597
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:AF/1nb2mhQtks0iiNqdF4mtPjD02A5APYcqgYvEL2x:62f6fFA/4GjDFcgYvEL2x
                                                                                                                                                                                                                          MD5:C4CC05D3132FDFB05089F42364FC74D2
                                                                                                                                                                                                                          SHA1:DA7A1AE5D93839577BBD25952A1672C831BC4F29
                                                                                                                                                                                                                          SHA-256:8F3D92DE840ABB5A46015A8FF618FF411C73009CBAA448AC268A5C619CF84721
                                                                                                                                                                                                                          SHA-512:C597C70B7AF8E77BEEEBF10C32B34C37F25C741991581D67CF22E0778F262E463C0F64AA37F92FBC4415FE675673F3F92544E109E5032E488F185F1CFBC839FE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16384
                                                                                                                                                                                                                          Entropy (8bit):5.235115741550938
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:XTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gDhgvrjcqgCieT3WQ:XafgNpj9cHW3jqXeBRamDOZgCieT
                                                                                                                                                                                                                          MD5:1E201DF4B4C8A8CD9DA1514C6C21D1C4
                                                                                                                                                                                                                          SHA1:3DC8A9C20313AF189A3FFA51A2EAA1599586E1B2
                                                                                                                                                                                                                          SHA-256:A428372185B72C90BE61AC45224133C4AF6AE6682C590B9A3968A757C0ABD6B4
                                                                                                                                                                                                                          SHA-512:19232771D4EE3011938BA2A52FA8C32E00402055038B5EDF3DDB4C8691FA7AE751A1DC16766D777A41981B7C27B14E9C1AD6EBDA7FFE1B390205D0110546EE29
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15360
                                                                                                                                                                                                                          Entropy (8bit):5.133714807569085
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:JZNGXEgvUh43G6coX2SSwmPL4V7wTdDlpaY2cqgWjvE:EVMhuGGF2L4STdDyYWgWjvE
                                                                                                                                                                                                                          MD5:76C84B62982843367C5F5D41B550825F
                                                                                                                                                                                                                          SHA1:B6DE9B9BD0E2C84398EA89365E9F6D744836E03A
                                                                                                                                                                                                                          SHA-256:EBCD946F1C432F93F396498A05BF07CC77EE8A74CE9C1A283BF9E23CA8618A4C
                                                                                                                                                                                                                          SHA-512:03F8BB1D0D63BF26D8A6FFF62E94B85FFB4EA1857EB216A4DEB71C806CDE107BA0F9CC7017E3779489C5CEF5F0838EDB1D70F710BCDEB629364FC288794E6AFE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):35840
                                                                                                                                                                                                                          Entropy (8bit):5.928082706906375
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:8bEkzS7+k9rMUb8cOe9rs9ja+V/Mhjh56GS:8bEP779rMtcOCs0I/Mhf
                                                                                                                                                                                                                          MD5:B41160CF884B9E846B890E0645730834
                                                                                                                                                                                                                          SHA1:A0F35613839A0F8F4A87506CD59200CCC3C09237
                                                                                                                                                                                                                          SHA-256:48F296CCACE3878DE1148074510BD8D554A120CAFEF2D52C847E05EF7664FFC6
                                                                                                                                                                                                                          SHA-512:F4D57351A627DD379D56C80DA035195292264F49DC94E597AA6638DF5F4CF69601F72CC64FC3C29C5CBE95D72326395C5C6F4938B7895C69A8D839654CFC8F26
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.^...0......`.....................................................`..........................................~..|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                          Entropy (8bit):4.799063285091512
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:nkCfXASTMeAk4OepIXcADp/X6RcqgO5vE:ZJMcPepIXcAD563gO5vE
                                                                                                                                                                                                                          MD5:BA46602B59FCF8B01ABB135F1534D618
                                                                                                                                                                                                                          SHA1:EFF5608E05639A17B08DCA5F9317E138BEF347B5
                                                                                                                                                                                                                          SHA-256:B1BAB0E04AC60D1E7917621B03A8C72D1ED1F0251334E9FA12A8A1AC1F516529
                                                                                                                                                                                                                          SHA-512:A5E2771623DA697D8EA2E3212FBDDE4E19B4A12982A689D42B351B244EFBA7EFA158E2ED1A2B5BC426A6F143E7DB810BA5542017AB09B5912B3ECC091F705C6E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d....e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):754688
                                                                                                                                                                                                                          Entropy (8bit):7.624959985050181
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:I1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h9:gYmzHoxJFf1p34hcrn5Go9yQO6L
                                                                                                                                                                                                                          MD5:3F20627FDED2CF90E366B48EDF031178
                                                                                                                                                                                                                          SHA1:00CED7CD274EFB217975457906625B1B1DA9EBDF
                                                                                                                                                                                                                          SHA-256:E36242855879D71AC57FBD42BB4AE29C6D80B056F57B18CEE0B6B1C0E8D2CF57
                                                                                                                                                                                                                          SHA-512:05DE7C74592B925BB6D37528FC59452C152E0DCFC1D390EA1C48C057403A419E5BE40330B2C5D5657FEA91E05F6B96470DDDF9D84FF05B9FD4192F73D460093C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d....e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):27648
                                                                                                                                                                                                                          Entropy (8bit):5.792654050660321
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:hBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsia15gkbQ0e1:/L/g28Ufsxg9GmvPauYLxtX1D/kf
                                                                                                                                                                                                                          MD5:290D936C1E0544B6EC98F031C8C2E9A3
                                                                                                                                                                                                                          SHA1:CAEEA607F2D9352DD605B6A5B13A0C0CB1EA26EC
                                                                                                                                                                                                                          SHA-256:8B00C859E36CBCE3EC19F18FA35E3A29B79DE54DA6030AAAD220AD766EDCDF0A
                                                                                                                                                                                                                          SHA-512:F08B67B633D3A3F57F1183950390A35BF73B384855EAAB3AE895101FBC07BCC4990886F8DE657635AD528D6C861BC2793999857472A5307FFAA963AA6685D7E8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d....e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67072
                                                                                                                                                                                                                          Entropy (8bit):6.060461288575063
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:nqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxRLpq:nqctkGACFI5t35q2JbgrwwOoqLTM9rMh
                                                                                                                                                                                                                          MD5:5782081B2A6F0A3C6B200869B89C7F7D
                                                                                                                                                                                                                          SHA1:0D4E113FB52FE1923FE05CDF2AB9A4A9ABEFC42E
                                                                                                                                                                                                                          SHA-256:E72E06C721DD617140EDEBADD866A91CF97F7215CBB732ECBEEA42C208931F49
                                                                                                                                                                                                                          SHA-512:F7FD695E093EDE26FCFD0EE45ADB49D841538EB9DAAE5B0812F29F0C942FB13762E352C2255F5DB8911F10FA1B6749755B51AAE1C43D8DF06F1D10DE5E603706
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\PublicKey\_x25519.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10752
                                                                                                                                                                                                                          Entropy (8bit):4.488437566846231
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:tpVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADwhDTAbcX6gn/7EC:5VddiT7pgTctdErDwDTicqgn/7
                                                                                                                                                                                                                          MD5:289EBF8B1A4F3A12614CFA1399250D3A
                                                                                                                                                                                                                          SHA1:66C05F77D814424B9509DD828111D93BC9FA9811
                                                                                                                                                                                                                          SHA-256:79AC6F73C71CA8FDA442A42A116A34C62802F0F7E17729182899327971CFEB23
                                                                                                                                                                                                                          SHA-512:4B95A210C9A4539332E2FB894D7DE4E1B34894876CCD06EEC5B0FC6F6E47DE75C0E298CF2F3B5832C9E028861A53B8C8E8A172A3BE3EC29A2C9E346642412138
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d....e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10240
                                                                                                                                                                                                                          Entropy (8bit):4.730605326965181
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:MJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGrbMZYJWJcX6gbW6s:CVddiT7pgTctEEaEDKDlMCWJcqgbW6
                                                                                                                                                                                                                          MD5:4D9C33AE53B38A9494B6FBFA3491149E
                                                                                                                                                                                                                          SHA1:1A069E277B7E90A3AB0DCDEE1FE244632C9C3BE4
                                                                                                                                                                                                                          SHA-256:0828CAD4D742D97888D3DFCE59E82369317847651BBA0F166023CB8ACA790B2B
                                                                                                                                                                                                                          SHA-512:BDFBF29198A0C7ED69204BF9E9B6174EBB9E3BEE297DD1EB8EB9EA6D7CAF1CC5E076F7B44893E58CCF3D0958F5E3BDEE12BD090714BEB5889836EE6F12F0F49E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`..........................................'..|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10240
                                                                                                                                                                                                                          Entropy (8bit):4.685843290341897
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:6ZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DHWMoG4BcX6gbW6O:IVddiT7pgTctEEO3DLoHcqgbW6
                                                                                                                                                                                                                          MD5:8F4313755F65509357E281744941BD36
                                                                                                                                                                                                                          SHA1:2AAF3F89E56EC6731B2A5FA40A2FE69B751EAFC0
                                                                                                                                                                                                                          SHA-256:70D90DDF87A9608699BE6BBEDF89AD469632FD0ADC20A69DA07618596D443639
                                                                                                                                                                                                                          SHA-512:FED2B1007E31D73F18605FB164FEE5B46034155AB5BB7FE9B255241CFA75FF0E39749200EB47A9AB1380D9F36F51AFBA45490979AB7D112F4D673A0C67899EF4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imaging.cp312-win_amd64.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2582528
                                                                                                                                                                                                                          Entropy (8bit):6.457978211619077
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:ahLabo89HhLGC4BmK7y9VnuEILrLrLrL6mV6i:XJlK7yg
                                                                                                                                                                                                                          MD5:0376776F076CD4F4AC15EC4D813C5470
                                                                                                                                                                                                                          SHA1:381F84735A11ACE4673D8BE53138E652D4415413
                                                                                                                                                                                                                          SHA-256:A7DDF4D7CAB08676BB88A42059353C5374600901B3AB880E17EE1A0D0150C380
                                                                                                                                                                                                                          SHA-512:06D68B9E5DAF90D05855BF2C57B6110BFC2F20F4731B023B5AAA39145FD3AB66525D39988B8516731045AD16A89EB0457487DD080AEB347BA24A2E47ECE98BBD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........%.}.v.}.v.}.v..)v.}.v...w.}.v..Gv.}.v...w.}.v...w.}.v...w.}.vw..w.}.v...w.}.v.}.v.|.v.}.v.}.v...w.|.v...w.}.v...w.}.v..Ev.}.v...w.}.vRich.}.v........................PE..d.....e.........." ...%.............X........................................'...........`......................................... .%.`.....%.......'.......&...............'.....P{$......................{$.(....z$.@............................................text...X........................... ..`.rdata...).......*..................@..@.data........&..`....%.............@....pdata........&......D&.............@..@.rsrc.........'......P'.............@..@.reloc........'......R'.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imagingcms.cp312-win_amd64.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):262144
                                                                                                                                                                                                                          Entropy (8bit):6.291831001741347
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:gQG8+hL4/nOYRI7O0hdlnLg9uP1+74/LgHmPr9qvZqhLaHLTLrLfqeqwL1dQ5hz0:gQG8z/shdlnLg9uP1+74/LgHmPr9qvZr
                                                                                                                                                                                                                          MD5:48F7F14636DA0BC081A34ACBFE30D77D
                                                                                                                                                                                                                          SHA1:E38B1F4E6F42219CC2D31D7EAF4FD49A8AD36D69
                                                                                                                                                                                                                          SHA-256:3C2CEDEBABB5748F78FBA56634FD49CDAAD02C18D808D7E2B4F50E2800C7930F
                                                                                                                                                                                                                          SHA-512:7C077CB4727E5879598D0DDACF4507806C66980C8E312F2A3861BC6448D5802F99F01535E9C2ECDF78F700DB78B3F03BC3989E81F28A57398F4AD8E9E1FDA7F3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V[jw8.jw8.jw8.c...dw8...9.hw8...=.gw8...<.bw8...;.nw8...9.hw8.!.9.mw8.jw9..w8.P.0.|w8.P.8.kw8.P...kw8.P.:.kw8.Richjw8.........PE..d.....e.........." ...%..... ...............................................@............`......................................... ...h............ ..........4/...........0.......`..............................p_..@...............p............................text...h........................... ..`.rdata..............................@..@.data....?.......:..................@....pdata..4/.......0..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imagingmath.cp312-win_amd64.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24576
                                                                                                                                                                                                                          Entropy (8bit):5.547840685902378
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:WuwU58R4Pp/4TsXlCr8AN+I6iYLz9IKVxgyJ+X9:Hp8Rs4TWCr8vHH97V6P9
                                                                                                                                                                                                                          MD5:8F67156CE61C7DE23E19F9445C8BA504
                                                                                                                                                                                                                          SHA1:B9E344FE41B3FC77CE0012930B7ED9AF47EB500C
                                                                                                                                                                                                                          SHA-256:8287A2A551BD99B5D55E18E461FEDB3704B74B0FB60F1E0881C792F90A18CE46
                                                                                                                                                                                                                          SHA-512:F70F24CEF7475547F5B29D1AE6DB7BD1DE6D1AA906E21705E40ED5C18F4F059CE9BB14DFD353776EFC08B985881A102DEA1948632EDCCACF76CC72D126651EB0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@......@...A...@..A...@...E...@...D...@...C...@.[.A...@...A...@..`H...@..`@...@..`....@..`B...@.Rich..@.........PE..d.....e.........." ...%.6...,......P9....................................................`.........................................``..h....`..x...............P...............@....U...............................S..@............P..`............................text...(4.......6.................. ..`.rdata.. ....P.......:..............@..@.data........p.......R..............@....pdata..P............T..............@..@.rsrc................\..............@..@.reloc..@............^..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_imagingtk.cp312-win_amd64.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14848
                                                                                                                                                                                                                          Entropy (8bit):4.947735133076573
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Eq/Ztwurp+xOkpDds0KpbQoSM8WEumw/vE9FWckgTJ5:NZLaDFKpcoSIk9OgT
                                                                                                                                                                                                                          MD5:7E912D07A39E16BB25CF32B7153515C8
                                                                                                                                                                                                                          SHA1:60B2020DA661C6526FB09BCBCA6456520480BCAD
                                                                                                                                                                                                                          SHA-256:D1E5D023821A9C38967FFAA9BDBF4DDE998A3A6BC37942CA334A13E55A1FC711
                                                                                                                                                                                                                          SHA-512:EB47383DF193573AE5788023ACE576199F8BB0506406A95A26CD3CA688D0AF66E3E24EB13A9811B08932B81603848E70660BBD6806222C09749BFC0858A668E9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s>H..mH..mH..mA.mB..m]..lJ..m]..lD..m]..l@..m]..lK..m...lJ..m...lM..mH..m|..mr5.lJ..mr5.lI..mr5.mI..mr5.lI..mRichH..m................PE..d.....e.........." ...%.....$......@.....................................................`..........................................;..d....;.......p.......`..................<...`5.............................. 4..@............0...............................text...h........................... ..`.rdata.......0......................@..@.data........P.......0..............@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc..<............8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\PIL\_webp.cp312-win_amd64.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):534528
                                                                                                                                                                                                                          Entropy (8bit):6.582425403943618
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:HsQIgnVCZh4nbXy8mAC1tQzLrLrLrLWmE5Gx0Hs/JJY:Hs4wwnbXBzLrLrLrLWmE60Hs/J+
                                                                                                                                                                                                                          MD5:12D05951F8004E24EEAA0E45D587FE8E
                                                                                                                                                                                                                          SHA1:CB42E43B3E55A18F765657BD436A566BA73747A3
                                                                                                                                                                                                                          SHA-256:D96B196126A033F1D7832E29CEE44928683FAB00242E812815FF95FFFED1AF54
                                                                                                                                                                                                                          SHA-512:3622C6E537096CCA34A6097E2BF8DE7477DC8B1333360B57F1DC0665147746A837F0B82EBAD06A8304B363F85E140FEFBDA2353D74B024208FF4124844029C47
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l....w...w...w..u....w..rv...w..uv...w..rr...w..rs...w..rt...w..pv...w...v...w..s...w......w..w...w.....w..u...w.Rich..w.........................PE..d.....e.........." ...%..................................................................`.........................................P...\............p....... ...N..................`W.............................. V..@............................................text............................... ..`.rdata..............................@..@.data....2..........................@....pdata...N... ...P..................@..@.rsrc........p.......$..............@..@.reloc...............&..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\VCRUNTIME140.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):119192
                                                                                                                                                                                                                          Entropy (8bit):6.6016214745004635
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
                                                                                                                                                                                                                          MD5:BE8DBE2DC77EBE7F88F910C61AEC691A
                                                                                                                                                                                                                          SHA1:A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
                                                                                                                                                                                                                          SHA-256:4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
                                                                                                                                                                                                                          SHA-512:0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\VCRUNTIME140_1.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49528
                                                                                                                                                                                                                          Entropy (8bit):6.662491747506177
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
                                                                                                                                                                                                                          MD5:F8DFA78045620CF8A732E67D1B1EB53D
                                                                                                                                                                                                                          SHA1:FF9A604D8C99405BFDBBF4295825D3FCBC792704
                                                                                                                                                                                                                          SHA-256:A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
                                                                                                                                                                                                                          SHA-512:BA7F8B7AB0DEB7A7113124C28092B543E216CA08D1CF158D9F40A326FB69F4A2511A41A59EA8482A10C9EC4EC8AC69B70DFE9CA65E525097D93B819D498DA371
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...|!..{.&.|!..{...|!..Rich}!..................PE..d.....v..........." ...&.<...8.......B...................................................`A........................................Pm.......m..x....................r..xO......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_asyncio.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):71448
                                                                                                                                                                                                                          Entropy (8bit):6.247581706260346
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:rRaPPkDN3nkiP6djtX5IkTIL1yUvGJtIAOnT7SyqWx5:9anmN3nkikjV5IkTIL1yUuJtIAOnTgi
                                                                                                                                                                                                                          MD5:209CBCB4E1A16AA39466A6119322343C
                                                                                                                                                                                                                          SHA1:CDCCE6B64EBF11FECFF739CBC57E7A98D6620801
                                                                                                                                                                                                                          SHA-256:F7069734D5174F54E89B88D717133BFF6A41B01E57F79957AB3F02DAA583F9E2
                                                                                                                                                                                                                          SHA-512:5BBC4EDE01729E628260CF39DF5809624EAE795FD7D51A1ED770ED54663955674593A97B78F66DBF6AE268186273840806ED06D6F7877444D32FDCA031A9F0DA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.T.S...S...S...+r..S...,...S...,...S...,...S...,...S..$....S..U+...S...S...S..$....S..$....S..$....S..$....S..Rich.S..........PE..d......e.........." ...%.f................................................... ......')....`.............................................P......d......................../..............T...........................@...@............................................text...=d.......f.................. ..`.rdata..pO.......P...j..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_bz2.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):84760
                                                                                                                                                                                                                          Entropy (8bit):6.5874715807724025
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:RS7z7Sj2u5in5IVfC83zYxzbdK87kW1IACVw7SyrxX:I7z+jum3MJdN7kW1IACVwX
                                                                                                                                                                                                                          MD5:59D60A559C23202BEB622021AF29E8A9
                                                                                                                                                                                                                          SHA1:A405F23916833F1B882F37BDBBA2DD799F93EA32
                                                                                                                                                                                                                          SHA-256:706D4A0C26DD454538926CBB2FF6C64257C3D9BD48C956F7CABD6DEF36FFD13E
                                                                                                                                                                                                                          SHA-512:2F60E79603CF456B2A14B8254CEC75CE8BE0A28D55A874D4FB23D92D63BBE781ED823AB0F4D13A23DC60C4DF505CBF1DBE1A0A2049B02E4BDEC8D374898002B1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R...S..R.....R...W..R...V..R...Q..R...S..R..S..R..S..R..._..R...R..R......R...P..R.Rich.R.........................PE..d......e.........." ...%.....^......|........................................P......-B....`.............................................H............0....... ..,......../...@..........T...........................p...@............................................text...k........................... ..`.rdata..p>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_cffi_backend.cp312-win_amd64.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):182784
                                                                                                                                                                                                                          Entropy (8bit):6.193615170968096
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:YRAMUp3K6YoDssyudy4VcRG+nR3hnW3mjwwOdkS9S7iSSTLkK/jftw3buz:Y6MyK65ssy+MG+LnSUwjD9zSSTLL/jl8
                                                                                                                                                                                                                          MD5:0572B13646141D0B1A5718E35549577C
                                                                                                                                                                                                                          SHA1:EEB40363C1F456C1C612D3C7E4923210EAE4CDF7
                                                                                                                                                                                                                          SHA-256:D8A76D1E31BBD62A482DEA9115FC1A109CB39AF4CF6D1323409175F3C93113A7
                                                                                                                                                                                                                          SHA-512:67C28432CA8B389ACC26E47EB8C4977FDDD4AF9214819F89DF07FECBC8ED750D5F35807A1B195508DD1D77E2A7A9D7265049DCFBFE7665A7FD1BA45DA1E4E842
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...I.C.I.C.I.C.1MC.I.C.<.B.I.C.&#C.I.C.<.B.I.C.<.B.I.C.<.B.I.C.1.B.I.C.4.B.I.C.I.C I.C.<.B.I.C.1KC.I.C.<.B.I.C.<!C.I.C.<.B.I.CRich.I.C................PE..d...g..e.........." .........@......`........................................@............`..........................................w..l....w....... ..........l............0.......]...............................]..8............................................text............................... ..`.rdata..............................@..@.data...h].......0...|..............@....pdata..l...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_ctypes.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):125208
                                                                                                                                                                                                                          Entropy (8bit):6.128664719423826
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:DGR936Xz4mHFK0K+bRFOoP+Szlf/EZZBKYyucV6rOoZIALPEA:qQHLK+bvvPNhf/Ei6CoX
                                                                                                                                                                                                                          MD5:2A834C3738742D45C0A06D40221CC588
                                                                                                                                                                                                                          SHA1:606705A593631D6767467FB38F9300D7CD04AB3E
                                                                                                                                                                                                                          SHA-256:F20DFA748B878751EA1C4FE77A230D65212720652B99C4E5577BCE461BBD9089
                                                                                                                                                                                                                          SHA-512:924235A506CE4D635FA7C2B34E5D8E77EFF73F963E58E29C6EF89DB157BF7BAB587678BB2120D09DA70594926D82D87DBAA5D247E861E331CF591D45EA19A117
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......x...<...<...<...5.*.:...)...>...)...0...)...4...)...8.......>...w...=...w...:.......?...<..........:.......=.....F.=.......=...Rich<...........................PE..d......e.........." ...%............p_..............................................]R....`.........................................``.......`.........................../......p.......T...............................@............................................text............................... ..`.rdata..Xl.......n..................@..@.data....4.......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_decimal.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):252696
                                                                                                                                                                                                                          Entropy (8bit):6.564448148079112
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:Agvd9YyMipyD41q8xDiw9qWM53pLW1AQRRRrBoZtcr3:AQ8yryD47hix4orcr3
                                                                                                                                                                                                                          MD5:F930B7550574446A015BC602D59B0948
                                                                                                                                                                                                                          SHA1:4EE6FF8019C6C540525BDD2790FC76385CDD6186
                                                                                                                                                                                                                          SHA-256:3B9AD1D2BC9EC03D37DA86135853DAC73B3FE851B164FE52265564A81EB8C544
                                                                                                                                                                                                                          SHA-512:10B864975945D6504433554F9FF11B47218CAA00F809C6BCE00F9E4089B862190A4219F659697A4BA5E5C21EDBE1D8D325950921E09371ACC4410469BD9189EE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mBP\.,.\.,.\.,.Ut..R.,.Is-.^.,.Is).Q.,.Is(.T.,.Is/.X.,.f.-._.,..t-.^.,.\.-...,.f./.].,.f.!.S.,.f.,.].,.f...].,.f...].,.Rich\.,.........PE..d......e.........." ...%.t...<......................................................6.....`.........................................@T..P....T..................0'......./......P...@...T...............................@............................................text....r.......t.................. ..`.rdata...............x..............@..@.data....*...p...$...P..............@....pdata..0'.......(...t..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_hashlib.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):65816
                                                                                                                                                                                                                          Entropy (8bit):6.242741772115205
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:MElYij3wz91lBafLEmIRhtIAOIW7SybpxC:hYZBaTEmghtIAOIWE
                                                                                                                                                                                                                          MD5:B0262BD89A59A3699BFA75C4DCC3EE06
                                                                                                                                                                                                                          SHA1:EB658849C646A26572DEA7F6BFC042CB62FB49DC
                                                                                                                                                                                                                          SHA-256:4ADFBBD6366D9B55D902FC54D2B42E7C8C989A83016ED707BD7A302FC3FC7B67
                                                                                                                                                                                                                          SHA-512:2E4B214DE3B306E3A16124AF434FF8F5AB832AA3EEB1AA0AA9B49B0ADA0928DCBB05C57909292FBE3B01126F4CD3FE0DAC9CC15EAEA5F3844D6E267865B9F7B1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........u...&...&...&.}&...&..'...&..'...&..'...&..'...&...'...&.x.'...&...&}..&.x.'...&.x.'...&.x.&...&.x.'...&Rich...&........................PE..d.....e.........." ...%.T..........P@....................................................`.............................................P.............................../......X...@}..T............................|..@............p..(............................text....S.......T.................. ..`.rdata..&O...p...P...X..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_lzma.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):159512
                                                                                                                                                                                                                          Entropy (8bit):6.846323229710623
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:Fik7me1FFD+znfF9mNo+Mu6tmxzE41IAZ1Ak:FikSiUNYO+J1E4b
                                                                                                                                                                                                                          MD5:B71DBE0F137FFBDA6C3A89D5BCBF1017
                                                                                                                                                                                                                          SHA1:A2E2BDC40FDB83CC625C5B5E8A336CA3F0C29C5F
                                                                                                                                                                                                                          SHA-256:6216173194B29875E84963CD4DC4752F7CA9493F5B1FD7E4130CA0E411C8AC6A
                                                                                                                                                                                                                          SHA-512:9A5C7B1E25D8E1B5738F01AEDFD468C1837F1AC8DD4A5B1D24CE86DCAE0DB1C5B20F2FF4280960BC523AEE70B71DB54FD515047CDAF10D21A8BEC3EBD6663358
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RH:..)T..)T..)T..Q...)T..VU..)T..VQ..)T..VP..)T..VW..)T.,.U..)T.]QU..)T..)U.s)T.,.Y.,)T.,.T..)T.,....)T.,.V..)T.Rich.)T.........PE..d.....e.........." ...%.d...........6....................................................`......................................... %..L...l%..x....p.......P.......@.../......4.......T...............................@............................................text....b.......d.................. ..`.rdata..............h..............@..@.data...(....@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_multiprocessing.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):35096
                                                                                                                                                                                                                          Entropy (8bit):6.461229529356597
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:OgYvrenSE0PXxxQ0zi+mdIAWtd5YiSyviCAMxkEj:vYTQShxQ0zlmdIAWtD7SyKAxv
                                                                                                                                                                                                                          MD5:4CCBD87D76AF221F24221530F5F035D1
                                                                                                                                                                                                                          SHA1:D02B989AAAC7657E8B3A70A6EE7758A0B258851B
                                                                                                                                                                                                                          SHA-256:C7BBCFE2511FD1B71B916A22AD6537D60948FFA7BDE207FEFABEE84EF53CAFB5
                                                                                                                                                                                                                          SHA-512:34D808ADAC96A66CA434D209F2F151A9640B359B8419DC51BA24477E485685AF10C4596A398A85269E8F03F0FC533645907D7D854733750A35BF6C691DE37799
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........*..y..y..y..y..y...x..y...x..y...x..y...x..y.J.x..y..y..y...x..y.J.x..y.J.x..y.Jky..y.J.x..yRich..y................PE..d......e.........." ...%.....>......P...............................................^.....`.........................................0E..`....E..x............p.......Z.../...........4..T............................3..@............0...............................text............................... ..`.rdata..r ...0..."..."..............@..@.data........`.......D..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_overlapped.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):55576
                                                                                                                                                                                                                          Entropy (8bit):6.342203411267264
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:wXRnts3McbN6w/xzWssXZdR1r3RIAXtI7SyNxQ:IRvcsXZdR1rRIAXtI6
                                                                                                                                                                                                                          MD5:61193E813A61A545E2D366439C1EE22A
                                                                                                                                                                                                                          SHA1:F404447B0D9BFF49A7431C41653633C501986D60
                                                                                                                                                                                                                          SHA-256:C21B50A7BF9DBE1A0768F5030CAC378D58705A9FE1F08D953129332BEB0FBEFC
                                                                                                                                                                                                                          SHA-512:747E4D5EA1BDF8C1E808579498834E1C24641D434546BFFDFCF326E0DE8D5814504623A3D3729168B0098824C2B8929AFC339674B0D923388B9DAC66F5D9D996
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.{..w(..w(..w(.s.(..w(.tv)..w(.tr)..w(.ts)..w(.tt)..w(.v)..w(..v(..w(.sv)..w(.ss)..w(.z)..w(.w)..w(..(..w(.u)..w(Rich..w(........................PE..d......e.........." ...%.L...`............................................................`.............................................X...X............................/......(....f..T............................e..@............`...............................text....J.......L.................. ..`.rdata..D8...`...:...P..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_queue.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32536
                                                                                                                                                                                                                          Entropy (8bit):6.4674944702653665
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:0k+cae6rjp5MoNOfZIAQUM5YiSyvjAMxkEKu:5vSjgoNOfZIAQU27SyLxv
                                                                                                                                                                                                                          MD5:F3ECA4F0B2C6C17ACE348E06042981A4
                                                                                                                                                                                                                          SHA1:EB694DDA8FF2FE4CCAE876DC0515A8EFEC40E20E
                                                                                                                                                                                                                          SHA-256:FB57EE6ADF6E7B11451B6920DDD2FB943DCD9561C9EAE64FDDA27C7ED0BC1B04
                                                                                                                                                                                                                          SHA-512:604593460666045CA48F63D4B14FA250F9C4B9E5C7E228CC9202E7692C125AACB0018B89FAA562A4197692A9BC3D2382F9E085B305272EE0A39264A2A0F53B75
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.\.Sa..Sa..Sa..+...Sa..,`..Sa..,d..Sa..,e..Sa..,b..Sa.$.`..Sa.U+`..Sa..S`.USa.$.l..Sa.$.a..Sa.$...Sa.$.c..Sa.Rich.Sa.........PE..d......e.........." ...%.....8.......................................................I....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..8............................text...(........................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_socket.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):83224
                                                                                                                                                                                                                          Entropy (8bit):6.338326324626716
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:MUuhDLiJfz76Xl+1ly+uCt9/s+S+pzcHS58/n1IsJHfsZIALwqw7Syraxi:MU6DL4fHdy+uCt9/sT+pzuSQ1IwHfsZS
                                                                                                                                                                                                                          MD5:9C6283CC17F9D86106B706EC4EA77356
                                                                                                                                                                                                                          SHA1:AF4F2F52CE6122F340E5EA1F021F98B1FFD6D5B6
                                                                                                                                                                                                                          SHA-256:5CC62AAC52EDF87916DEB4EBBAD9ABB58A6A3565B32E7544F672ACA305C38027
                                                                                                                                                                                                                          SHA-512:11FD6F570DD78F8FF00BE645E47472A96DAFFA3253E8BD29183BCCDE3F0746F7E436A106E9A68C57CC05B80A112365441D06CC719D51C906703B428A32C93124
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|../8z.|8z.|8z.|1.T|>z.|-..}:z.|-..}5z.|-..}0z.|-..};z.|...}:z.|8z.|.z.|s..}1z.|...}9z.|...}9z.|..8|9z.|...}9z.|Rich8z.|........PE..d......e.........." ...%.v...........-.......................................`............`.............................................P............@.......0.........../...P..........T...............................@............................................text....u.......v.................. ..`.rdata...x.......z...z..............@..@.data...H...........................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_sqlite3.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):124696
                                                                                                                                                                                                                          Entropy (8bit):6.266006891462829
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:9PfqZRAWgyjwzCO4w5y3DUfUK8PtIAOQMo:oAWgKw2C5iSUv1
                                                                                                                                                                                                                          MD5:506B13DD3D5892B16857E3E3B8A95AFB
                                                                                                                                                                                                                          SHA1:42E654B36F1C79000084599D49B862E4E23D75FF
                                                                                                                                                                                                                          SHA-256:04F645A32B0C58760CC6C71D09224FE90E50409EF5C81D69C85D151DFE65AFF9
                                                                                                                                                                                                                          SHA-512:A94F0E9F2212E0B89EB0B5C64598B18AF71B59E1297F0F6475FA4674AE56780B1E586B5EB952C8C9FEBAD38C28AFD784273BBF56645DB2C405AFAE6F472FB65C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................}........................:...................:......:......:......:.....Rich...................PE..d.....e.........." ...%.............................................................d....`.........................................`o..P....o..................8......../.......... ...T...............................@............................................text............................... ..`.rdata..............................@..@.data...8............|..............@....pdata..8...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_ssl.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):177432
                                                                                                                                                                                                                          Entropy (8bit):5.976892131161338
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:1CRW4ljuyKK8vZktW5No6XfJN54eNWXvM4VRJNI7IM/cbP7RHs3FJZ1IAC7+y:1mfEyKKaZo6XfJ2MSV+JZW
                                                                                                                                                                                                                          MD5:DDB21BD1ACDE4264754C49842DE7EBC9
                                                                                                                                                                                                                          SHA1:80252D0E35568E68DED68242D76F2A5D7E00001E
                                                                                                                                                                                                                          SHA-256:72BB15CD8C14BA008A52D23CDCFC851A9A4BDE13DEEE302A5667C8AD60F94A57
                                                                                                                                                                                                                          SHA-512:464520ECD1587F5CEDE6219FAAC2C903EE41D0E920BF3C9C270A544B040169DCD17A4E27F6826F480D4021077AB39A6CBBD35EBB3D71672EBB412023BC9E182A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........wfj...9...9...9.n.9...9.i.8...9.i.8...9.i.8...9.i.8...9...8...9...9U..9.n.8...9...8...9...8...9...9...9...8...9Rich...9........PE..d.....e.........." ...%............\,..............................................t.....`......................................... ...d.......................8......../......x...@...T...............................@............................................text.............................. ..`.rdata...!......."..................@..@.data...(...........................@....pdata..8............^..............@..@.rsrc................j..............@..@.reloc..x............t..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_tkinter.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):64280
                                                                                                                                                                                                                          Entropy (8bit):6.2885383565761135
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:hK0cTtcpXCoch2AFwOsrK5xfiVZopaFWT81LGXKQeoBP8u9O4tIAOS25YiSyvFfF:cbmERwOsrhA81CanoB7tIAOSM7Sy1xHH
                                                                                                                                                                                                                          MD5:A7929FD434E8803DDE0951E6AA306D6A
                                                                                                                                                                                                                          SHA1:B0CB108BE0616678D68EB8328C065AA1FD38E563
                                                                                                                                                                                                                          SHA-256:5C400B4BC0367E1EFF93955973EFB3F85CE5970080BB1953F4E80BDF6F23C5C7
                                                                                                                                                                                                                          SHA-512:B8A83FD831AE393AE7BC23D86AF79D224142AF41837002883296D62B3FDC059A3794F1BB2ECD7714CA75003BD07CB3FC0617D99FFA3867068BFB3A44BF5CF215
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........WI.6'..6'..6'..N...6'..I&..6'..I"..6'..I#..6'..I$..6'...&..6'..N&..6'..M&..6'..6&.G6'...*..6'...'..6'.....6'...%..6'.Rich.6'.........PE..d.....e.........." ...%.h...f.......................................................)....`............................................P... ............................/......$.......T...............................@...............p............................text...;f.......h.................. ..`.rdata...@.......B...l..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\_wmi.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):36632
                                                                                                                                                                                                                          Entropy (8bit):6.357254511176439
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:6cxnHG7MYGQd0hHdzA77yeu1IACis5YiSyvoAMxkE9:6cxnm7M6dAHdzA77yeu1IACiW7Sy+xx
                                                                                                                                                                                                                          MD5:C1654EBEBFEEDA425EADE8B77CA96DE5
                                                                                                                                                                                                                          SHA1:A4A150F1C810077B6E762F689C657227CC4FD257
                                                                                                                                                                                                                          SHA-256:AA1443A715FBF84A84F39BD89707271FC11A77B597D7324CE86FC5CFA56A63A9
                                                                                                                                                                                                                          SHA-512:21705B991E75EFD5E59B8431A3B19AE5FCC38A3E7F137A9D52ACD24E7F67D61758E48ABC1C9C0D4314FA02010A1886C15EAD5BCA8DCA1B1D4CCBFC3C589D342E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S..............l..............................z.......................................z.......z.......z.......z......Rich....................PE..d......e.........." ...%.(...:.......&..............................................!n....`..........................................T..H....T...............p..`....`.../......t...DG..T............................C..@............@.......S..@....................text....&.......(.................. ..`.rdata..D....@... ...,..............@..@.data........`.......L..............@....pdata..`....p.......P..............@..@.rsrc................T..............@..@.reloc..t............^..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-console-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.608323768366966
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:KFOWWthWzWf9BvVVWQ4mWqyVT/gqnajKsrCS81:uZWthWeN01IlGsrCt
                                                                                                                                                                                                                          MD5:07EBE4D5CEF3301CCF07430F4C3E32D8
                                                                                                                                                                                                                          SHA1:3B878B2B2720915773F16DBA6D493DAB0680AC5F
                                                                                                                                                                                                                          SHA-256:8F8B79150E850ACC92FD6AAB614F6E3759BEA875134A62087D5DD65581E3001F
                                                                                                                                                                                                                          SHA-512:6C7E4DF62EBAE9934B698F231CF51F54743CF3303CD758573D00F872B8ECC2AF1F556B094503AAE91100189C0D0A93EAF1B7CAFEC677F384A1D7B4FDA2EEE598
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0............`A........................................p...,............ ...................!..............p............................................................................rdata..d...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-datetime-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11736
                                                                                                                                                                                                                          Entropy (8bit):6.6074868843808785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:PUWthW6Wf9BvVVWQ4SWZifvXqnajJ6HNbLet:MWthW3NhXll6HZm
                                                                                                                                                                                                                          MD5:557405C47613DE66B111D0E2B01F2FDB
                                                                                                                                                                                                                          SHA1:DE116ED5DE1FFAA900732709E5E4EEF921EAD63C
                                                                                                                                                                                                                          SHA-256:913EAAA7997A6AEE53574CFFB83F9C9C1700B1D8B46744A5E12D76A1E53376FD
                                                                                                                                                                                                                          SHA-512:C2B326F555B2B7ACB7849402AC85922880105857C616EF98F7FB4BBBDC2CD7F2AF010F4A747875646FCC272AB8AA4CE290B6E09A9896CE1587E638502BD4BEFB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...p.~..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..H...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-debug-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.622854484071805
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:tlWthWFWf9BvVVWQ4mWIzWLiP+CjAWqnajKsNb7:/WthWANnWLiP+CcWlGsNb7
                                                                                                                                                                                                                          MD5:624401F31A706B1AE2245EB19264DC7F
                                                                                                                                                                                                                          SHA1:8D9DEF3750C18DDFC044D5568E3406D5D0FB9285
                                                                                                                                                                                                                          SHA-256:58A8D69DF60ECBEE776CD9A74B2A32B14BF2B0BD92D527EC5F19502A0D3EB8E9
                                                                                                                                                                                                                          SHA-512:3353734B556D6EEBC57734827450CE3B34D010E0C033E95A6E60800C0FDA79A1958EBF9053F12054026525D95D24EEC541633186F00F162475CEC19F07A0D817
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...YJ..........." .........................................................0.......s....`A........................................p................ ...................!..............p............................................................................rdata..T...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-errorhandling-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.670771733256744
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:1mxD3+HWthWiWf9BvVVWQ4WWuhD7DiqnajKswz3:19HWthWfN/GlGswz3
                                                                                                                                                                                                                          MD5:2DB5666D3600A4ABCE86BE0099C6B881
                                                                                                                                                                                                                          SHA1:63D5DDA4CEC0076884BC678C691BDD2A4FA1D906
                                                                                                                                                                                                                          SHA-256:46079C0A1B660FC187AAFD760707F369D0B60D424D878C57685545A3FCE95819
                                                                                                                                                                                                                          SHA-512:7C6E1E022DB4217A85A4012C8E4DAEE0A0F987E4FBA8A4C952424EF28E250BAC38B088C242D72B4641157B7CC882161AEFA177765A2E23AFCDC627188A084345
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....^[..........." .........................................................0......@^....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-file-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15328
                                                                                                                                                                                                                          Entropy (8bit):6.561472518225768
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:RaNYPvVX8rFTsoWthWgWf9BvVVWQ4SWfMaPOoI80Hy5qnajslBE87QyX:HPvVXqWthWlN2WlslEE87Qw
                                                                                                                                                                                                                          MD5:0F7D418C05128246AFA335A1FB400CB9
                                                                                                                                                                                                                          SHA1:F6313E371ED5A1DFFE35815CC5D25981184D0368
                                                                                                                                                                                                                          SHA-256:5C9BC70586AD538B0DF1FCF5D6F1F3527450AE16935AA34BD7EB494B4F1B2DB9
                                                                                                                                                                                                                          SHA-512:7555D9D3311C8622DF6782748C2186A3738C4807FC58DF2F75E539729FC4069DB23739F391950303F12E0D25DF9F065B4C52E13B2EBB6D417CA4C12CFDECA631
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...*.;A.........." .........................................................@.......m....`A........................................p................0...................!..............p............................................................................rdata..<...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-file-l1-2-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.638884356866373
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:jlWaWthWAWf9BvVVWQ4WWloprVP+CjAWqnajKsNWqL:jIaWthWFNxtVP+CcWlGsNxL
                                                                                                                                                                                                                          MD5:5A72A803DF2B425D5AAFF21F0F064011
                                                                                                                                                                                                                          SHA1:4B31963D981C07A7AB2A0D1A706067C539C55EC5
                                                                                                                                                                                                                          SHA-256:629E52BA4E2DCA91B10EF7729A1722888E01284EED7DDA6030D0A1EC46C94086
                                                                                                                                                                                                                          SHA-512:BF44997C405C2BA80100EB0F2FF7304938FC69E4D7AE3EAC52B3C236C3188E80C9F18BDA226B5F4FDE0112320E74C198AD985F9FFD7CEA99ACA22980C39C7F69
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...=+vj.........." .........................................................0.......N....`A........................................p...L............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-file-l2-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11744
                                                                                                                                                                                                                          Entropy (8bit):6.744400973311854
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:imdzvQzEWthWwMVDEs3f0DHDsVBIwgmqvrnDD0ADEs3TDL2L4m2grMWaLN5DEs3r:v3WthWyWf9BvVVWQ4SWVVFJqqnajW2y
                                                                                                                                                                                                                          MD5:721B60B85094851C06D572F0BD5D88CD
                                                                                                                                                                                                                          SHA1:4D0EE4D717AEB9C35DA8621A545D3E2B9F19B4E7
                                                                                                                                                                                                                          SHA-256:DAC867476CAA42FF8DF8F5DFE869FFD56A18DADEE17D47889AFB69ED6519AFBF
                                                                                                                                                                                                                          SHA-512:430A91FCECDE4C8CC4AC7EB9B4C6619243AB244EE88C34C9E93CA918E54BD42B08ACA8EA4475D4C0F5FA95241E4AACB3206CBAE863E92D15528C8E7C9F45601B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......T`....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-handle-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11736
                                                                                                                                                                                                                          Entropy (8bit):6.638488013343178
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:frWthWFWf9BvVVWQ4SWNOfvXqnajJ6H4WJ:frWthWANRXll6H4WJ
                                                                                                                                                                                                                          MD5:D1DF480505F2D23C0B5C53DF2E0E2A1A
                                                                                                                                                                                                                          SHA1:207DB9568AFD273E864B05C87282987E7E81D0BA
                                                                                                                                                                                                                          SHA-256:0B3DFB8554EAD94D5DA7859A12DB353942406F9D1DFE3FAC3D48663C233EA99D
                                                                                                                                                                                                                          SHA-512:F14239420F5DD84A15FF5FCA2FAD81D0AA9280C566FA581122A018E10EBDF308AC0BF1D3FCFC08634C1058C395C767130C5ABCA55540295C68DF24FFD931CA0A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....(..........." .........................................................0......;.....`A........................................p...`............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-heap-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12256
                                                                                                                                                                                                                          Entropy (8bit):6.588267640761022
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:txlkWthW2Wf9BvVVWQ4SWBBBuUgxfzfqnaj0OTWv:txlkWthW7NkIrloFv
                                                                                                                                                                                                                          MD5:73433EBFC9A47ED16EA544DDD308EAF8
                                                                                                                                                                                                                          SHA1:AC1DA1378DD79762C6619C9A63FD1EBE4D360C6F
                                                                                                                                                                                                                          SHA-256:C43075B1D2386A8A262DE628C93A65350E52EAE82582B27F879708364B978E29
                                                                                                                                                                                                                          SHA-512:1C28CC0D3D02D4C308A86E9D0BC2DA88333DFA8C92305EC706F3E389F7BB6D15053040AFD1C4F0AA3383F3549495343A537D09FE882DB6ED12B7507115E5A263
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....pi..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..<...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-interlocked-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.678828474114903
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:4TWthWckWf9BvVVWQ4mWQAyUD7DiqnajKswzjdg:4TWthWcRNqGlGswzji
                                                                                                                                                                                                                          MD5:7C7B61FFA29209B13D2506418746780B
                                                                                                                                                                                                                          SHA1:08F3A819B5229734D98D58291BE4BFA0BEC8F761
                                                                                                                                                                                                                          SHA-256:C23FE8D5C3CA89189D11EC8DF983CC144D168CB54D9EAB5D9532767BCB2F1FA3
                                                                                                                                                                                                                          SHA-512:6E5E3485D980E7E2824665CBFE4F1619B3E61CE3BCBF103979532E2B1C3D22C89F65BCFBDDBB5FE88CDDD096F8FD72D498E8EE35C3C2307BACECC6DEBBC1C97F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....|............" .........................................................0.......3....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-libraryloader-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12752
                                                                                                                                                                                                                          Entropy (8bit):6.602852377056617
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Us13vuBL3B5LoWthW7Wf9BvVVWQ4mWgB7OQP+CjAWqnajKsN9arO:Us13vuBL3B2WthWmNVXP+CcWlGsN9P
                                                                                                                                                                                                                          MD5:6D0550D3A64BD3FD1D1B739133EFB133
                                                                                                                                                                                                                          SHA1:C7596FDE7EA1C676F0CC679CED8BA810D15A4AFE
                                                                                                                                                                                                                          SHA-256:F320F9C0463DE641B396CE7561AF995DE32211E144407828B117088CF289DF91
                                                                                                                                                                                                                          SHA-512:5DA9D490EF54A1129C94CE51349399B9012FC0D4B575AE6C9F1BAFCFCF7F65266F797C539489F882D4AD924C94428B72F5137009A851ECB541FE7FB9DE12FEB2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...]. ,.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..X...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-localization-l1-2-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14800
                                                                                                                                                                                                                          Entropy (8bit):6.528059454770997
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:On2OMw3zdp3bwjGfue9/0jCRrndbZWWthWdNHhfVlGsSH:/OMwBprwjGfue9/0jCRrndbLEKv
                                                                                                                                                                                                                          MD5:1ED0B196AB58EDB58FCF84E1739C63CE
                                                                                                                                                                                                                          SHA1:AC7D6C77629BDEE1DF7E380CC9559E09D51D75B7
                                                                                                                                                                                                                          SHA-256:8664222823E122FCA724620FD8B72187FC5336C737D891D3CEF85F4F533B8DE2
                                                                                                                                                                                                                          SHA-512:E1FA7F14F39C97AAA3104F3E13098626B5F7CFD665BA52DCB2312A329639AAF5083A9177E4686D11C4213E28ACC40E2C027988074B6CC13C5016D5C5E9EF897B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...w............" .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-memory-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.659218747104705
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:2E+tWthWvWf9BvVVWQ4mWxHD7DiqnajKswzGIAf:T+tWthWiNcGlGswzLAf
                                                                                                                                                                                                                          MD5:721BAEA26A27134792C5CCC613F212B2
                                                                                                                                                                                                                          SHA1:2A27DCD2436DF656A8264A949D9CE00EAB4E35E8
                                                                                                                                                                                                                          SHA-256:5D9767D8CCA0FBFD5801BFF2E0C2ADDDD1BAAAA8175543625609ABCE1A9257BD
                                                                                                                                                                                                                          SHA-512:9FD6058407AA95058ED2FDA9D391B7A35FA99395EC719B83C5116E91C9B448A6D853ECC731D0BDF448D1436382EECC1FA9101F73FA242D826CC13C4FD881D9BD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...,OT..........." .........................................................0...........`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-namedpipe-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.739082809754283
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:vdWthW8Wf9BvVVWQ4mWG2P+CjAWqnajKsNt:lWthWJNUP+CcWlGsNt
                                                                                                                                                                                                                          MD5:B3F887142F40CB176B59E58458F8C46D
                                                                                                                                                                                                                          SHA1:A05948ABA6F58EB99BBAC54FA3ED0338D40CBFAD
                                                                                                                                                                                                                          SHA-256:8E015CDF2561450ED9A0773BE1159463163C19EAB2B6976155117D16C36519DA
                                                                                                                                                                                                                          SHA-512:7B762319EC58E3FCB84B215AE142699B766FA9D5A26E1A727572EE6ED4F5D19C859EFB568C0268846B4AA5506422D6DD9B4854DA2C9B419BFEC754F547203F7E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...X.j..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-processenvironment-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12752
                                                                                                                                                                                                                          Entropy (8bit):6.601112204637961
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:GFPWthW5Wf9BvVVWQ4mWc0ZD7DiqnajKswzczr:GFPWthWsNiGlGswzq
                                                                                                                                                                                                                          MD5:89F35CB1212A1FD8FBE960795C92D6E8
                                                                                                                                                                                                                          SHA1:061AE273A75324885DD098EE1FF4246A97E1E60C
                                                                                                                                                                                                                          SHA-256:058EB7CE88C22D2FF7D3E61E6593CA4E3D6DF449F984BF251D9432665E1517D1
                                                                                                                                                                                                                          SHA-512:F9E81F1FEAB1535128B16E9FF389BD3DAAAB8D1DABF64270F9E563BE9D370C023DE5D5306DD0DE6D27A5A099E7C073D17499442F058EC1D20B9D37F56BCFE6D2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...ig............" .........................................................0......H.....`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-processthreads-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14288
                                                                                                                                                                                                                          Entropy (8bit):6.521808801015781
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:/uUk1Jzb9cKcIzWthWzaWf9BvVVWQ4mWmrcLUVT/gqnajKsrCOV:/bk1JzBcKcIzWthWzXNz1IlGsrCOV
                                                                                                                                                                                                                          MD5:0C933A4B3C2FCF1F805EDD849428C732
                                                                                                                                                                                                                          SHA1:B8B19318DBB1D2B7D262527ABD1468D099DE3FB6
                                                                                                                                                                                                                          SHA-256:A5B733E3DCE21AB62BD4010F151B3578C6F1246DA4A96D51AC60817865648DD3
                                                                                                                                                                                                                          SHA-512:B25ED54345A5B14E06AA9DADD07B465C14C23225023D7225E04FBD8A439E184A7D43AB40DF80E3F8A3C0F2D5C7A79B402DDC6B9093D0D798E612F4406284E39D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....U..........." .........................................................0......Y.....`A........................................p................ ...................!..............p............................................................................rdata..4...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-processthreads-l1-1-1.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.671157737548847
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7oDfIeVWthWZWf9BvVVWQ4mWaHvP+CjAWqnajKsNZ:7oDfIeVWthWMNVP+CcWlGsNZ
                                                                                                                                                                                                                          MD5:7E8B61D27A9D04E28D4DAE0BFA0902ED
                                                                                                                                                                                                                          SHA1:861A7B31022915F26FB49C79AC357C65782C9F4B
                                                                                                                                                                                                                          SHA-256:1EF06C600C451E66E744B2CA356B7F4B7B88BA2F52EC7795858D21525848AC8C
                                                                                                                                                                                                                          SHA-512:1C5B35026937B45BEB76CB8D79334A306342C57A8E36CC15D633458582FC8F7D9AB70ACE7A92144288C6C017F33ECFC20477A04432619B40A21C9CDA8D249F6D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......N.....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-profile-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.599056003106114
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:gR7WthWTVWf9BvVVWQ4mWg2a5P+CjAWqnajKsNQbWl:gVWthWkN/P+CcWlGsNMg
                                                                                                                                                                                                                          MD5:8D12FFD920314B71F2C32614CC124FEC
                                                                                                                                                                                                                          SHA1:251A98F2C75C2E25FFD0580F90657A3EA7895F30
                                                                                                                                                                                                                          SHA-256:E63550608DD58040304EA85367E9E0722038BA8E7DC7BF9D91C4D84F0EC65887
                                                                                                                                                                                                                          SHA-512:5084C739D7DE465A9A78BCDBB8A3BD063B84A68DCFD3C9EF1BFA224C1CC06580E2A2523FD4696CFC48E9FD068A2C44DBC794DD9BDB43DC74B4E854C82ECD3EA5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....X4.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-rtlsupport-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.602527553095181
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:zGeVfcWthW+Wf9BvVVWQ4mWMiSID7DiqnajKswz5g:zGeVfcWthWjN6SIGlGswza
                                                                                                                                                                                                                          MD5:9FA3FC24186D912B0694A572847D6D74
                                                                                                                                                                                                                          SHA1:93184E00CBDDACAB7F2AD78447D0EAC1B764114D
                                                                                                                                                                                                                          SHA-256:91508AB353B90B30FF2551020E9755D7AB0E860308F16C2F6417DFB2E9A75014
                                                                                                                                                                                                                          SHA-512:95AD31C9082F57EA57F5B4C605331FCAD62735A1862AFB01EF8A67FEA4E450154C1AE0C411CF3AC5B9CD35741F8100409CC1910F69C1B2D807D252389812F594
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....P..........." .........................................................0.......`....`A........................................p................ ...................!..............p............................................................................rdata..P...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-string-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.6806369134652055
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:qyMv0WthWPWf9BvVVWQ4mWIv/r+YVqnajKsSF:qyMv0WthWCNBfVlGsSF
                                                                                                                                                                                                                          MD5:C9CBAD5632D4D42A1BC25CCFA8833601
                                                                                                                                                                                                                          SHA1:09F37353A89F1BFE49F7508559DA2922B8EFEB05
                                                                                                                                                                                                                          SHA-256:F3A7A9C98EBE915B1B57C16E27FFFD4DDF31A82F0F21C06FE292878E48F5883E
                                                                                                                                                                                                                          SHA-512:2412E0AFFDC6DB069DE7BD9666B7BAA1CD76AA8D976C9649A4C2F1FFCE27F8269C9B02DA5FD486EC86B54231B1A5EBF6A1C72790815B7C253FEE1F211086892F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....E.=.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..,...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-synch-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13776
                                                                                                                                                                                                                          Entropy (8bit):6.573983778839785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:miwidv3V0dfpkXc0vVauzIWthWLN3fVlGsStY:nHdv3VqpkXc0vVaKbiYlY
                                                                                                                                                                                                                          MD5:4CCDE2D1681217E282996E27F3D9ED2E
                                                                                                                                                                                                                          SHA1:8EDA134B0294ED35E4BBAC4911DA620301A3F34D
                                                                                                                                                                                                                          SHA-256:D6708D1254ED88A948871771D6D1296945E1AA3AEB7E33E16CC378F396C61045
                                                                                                                                                                                                                          SHA-512:93FE6AE9A947AC88CC5ED78996E555700340E110D12B2651F11956DB7CEE66322C269717D31FCCB31744F4C572A455B156B368F08B70EDA9EFFEC6DE01DBAB23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....k,..........." .........................................................0......3.....`A........................................p...X............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-synch-l1-2-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.7137872023984055
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:TtZ3KjWthWzWf9BvVVWQ4mWXU0P+CjAWqnajKsN2v:TtZ3KjWthWeNwP+CcWlGsNa
                                                                                                                                                                                                                          MD5:E86CFC5E1147C25972A5EEFED7BE989F
                                                                                                                                                                                                                          SHA1:0075091C0B1F2809393C5B8B5921586BDD389B29
                                                                                                                                                                                                                          SHA-256:72C639D1AFDA32A65143BCBE016FE5D8B46D17924F5F5190EB04EFE954C1199A
                                                                                                                                                                                                                          SHA-512:EA58A8D5AA587B7F5BDE74B4D394921902412617100ED161A7E0BEF6B3C91C5DAE657065EA7805A152DD76992997017E070F5415EF120812B0D61A401AA8C110
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...jN/..........." .........................................................0............`A........................................p...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-sysinfo-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12768
                                                                                                                                                                                                                          Entropy (8bit):6.614330511483598
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:vgdKIMFYJWthW2Wf9BvVVWQ4SW2zZ7uUgxfzfqnaj0OGWh:0hJWthW7NBzIrloYh
                                                                                                                                                                                                                          MD5:206ADCB409A1C9A026F7AFDFC2933202
                                                                                                                                                                                                                          SHA1:BB67E1232A536A4D1AE63370BD1A9B5431335E77
                                                                                                                                                                                                                          SHA-256:76D8E4ED946DEEFEEFA0D0012C276F0B61F3D1C84AF00533F4931546CBB2F99E
                                                                                                                                                                                                                          SHA-512:727AA0C4CD1A0B7E2AFFDCED5DA3A0E898E9BAE3C731FF804406AD13864CEE2B27E5BAAC653BAB9A0D2D961489915D4FCAD18557D4383ECB0A066902276955A7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....~y..........." .........................................................0............`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-timezone-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.704366348384627
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Ha2WthWKOWf9BvVVWQ4mWNOrVT/gqnajKsrCkb:Ha2WthWKTNz1IlGsrCo
                                                                                                                                                                                                                          MD5:91A2AE3C4EB79CF748E15A58108409AD
                                                                                                                                                                                                                          SHA1:D402B9DF99723EA26A141BFC640D78EAF0B0111B
                                                                                                                                                                                                                          SHA-256:B0EDA99EABD32FEFECC478FD9FE7439A3F646A864FDAB4EC3C1F18574B5F8B34
                                                                                                                                                                                                                          SHA-512:8527AF610C1E2101B6F336A142B1A85AC9C19BB3AF4AD4A245CFB6FD602DC185DA0F7803358067099475102F3A8F10A834DC75B56D3E6DED2ED833C00AD217ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....%j.........." .........................................................0......|B....`A........................................p...P............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-core-util-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.623077637622405
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:jWthWYWf9BvVVWQ4mWd8l1P+CjAWqnajKsNeCw:jWthW9NnP+CcWlGsNex
                                                                                                                                                                                                                          MD5:1E4C4C8E643DE249401E954488744997
                                                                                                                                                                                                                          SHA1:DB1C4C0FC907100F204B21474E8CD2DB0135BC61
                                                                                                                                                                                                                          SHA-256:F28A8FE2CD7E8E00B6D2EC273C16DB6E6EEA9B6B16F7F69887154B6228AF981E
                                                                                                                                                                                                                          SHA-512:EF8411FD321C0E363C2E5742312CC566E616D4B0A65EFF4FB6F1B22FDBEA3410E1D75B99E889939FF70AD4629C84CEDC88F6794896428C5F0355143443FDC3A3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....R..........." .........................................................0............`A........................................p...<............ ...................!..............p............................................................................rdata..p...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-conio-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12752
                                                                                                                                                                                                                          Entropy (8bit):6.643812426159955
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:fSWthWvWf9BvVVWQ4mWFl5P+CjAWqnajKsNifl:aWthWiN+5P+CcWlGsNiN
                                                                                                                                                                                                                          MD5:FA770BCD70208A479BDE8086D02C22DA
                                                                                                                                                                                                                          SHA1:28EE5F3CE3732A55CA60AEE781212F117C6F3B26
                                                                                                                                                                                                                          SHA-256:E677497C1BAEFFFB33A17D22A99B76B7FA7AE7A0C84E12FDA27D9BE5C3D104CF
                                                                                                                                                                                                                          SHA-512:F8D81E350CEBDBA5AFB579A072BAD7986691E9F3D4C9FEBCA8756B807301782EE6EB5BA16B045CFA29B6E4F4696E0554C718D36D4E64431F46D1E4B1F42DC2B8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................" .........................................................0......l.....`A........................................P................ ...................!..............p............................................................................rdata..@...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-convert-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15824
                                                                                                                                                                                                                          Entropy (8bit):6.438848882089563
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:yjQ/w8u4cyNWthWYWf9BvVVWQ4mWhu1BVT/gqnajKsrC74m:8yNWthW9Np1IlGsrCEm
                                                                                                                                                                                                                          MD5:4EC4790281017E616AF632DA1DC624E1
                                                                                                                                                                                                                          SHA1:342B15C5D3E34AB4AC0B9904B95D0D5B074447B7
                                                                                                                                                                                                                          SHA-256:5CF5BBB861608131B5F560CBF34A3292C80886B7C75357ACC779E0BF98E16639
                                                                                                                                                                                                                          SHA-512:80C4E20D37EFF29C7577B2D0ED67539A9C2C228EDB48AB05D72648A6ED38F5FF537715C130342BEB0E3EF16EB11179B9B484303354A026BDA3A86D5414D24E69
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....P............" .........................................................@............`A........................................P................0...................!..............p............................................................................rdata..>...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-environment-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.6061629057490245
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:vWOPWthWAWf9BvVVWQ4mWWbgftmP+CjAWqnajKsNURPblh:BWthWFN+f8P+CcWlGsNURzv
                                                                                                                                                                                                                          MD5:7A859E91FDCF78A584AC93AA85371BC9
                                                                                                                                                                                                                          SHA1:1FA9D9CAD7CC26808E697373C1F5F32AAF59D6B7
                                                                                                                                                                                                                          SHA-256:B7EE468F5B6C650DADA7DB3AD9E115A0E97135B3DF095C3220DFD22BA277B607
                                                                                                                                                                                                                          SHA-512:A368F21ECA765AFCA86E03D59CF953500770F4A5BFF8B86B2AC53F1B5174C627E061CE9A1F781DC56506774E0D0B09725E9698D4DC2D3A59E93DA7EF3D900887
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...t............." .........................................................0......H.....`A........................................P..."............ ...................!..............p............................................................................rdata..r...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-filesystem-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13776
                                                                                                                                                                                                                          Entropy (8bit):6.65347762698107
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:WxSnWlC0i5ClWthWTWf9BvVVWQ4mW+hkKVT/gqnajKsrCw/:WxSnWm5ClWthW+NkK1IlGsrCY
                                                                                                                                                                                                                          MD5:972544ADE7E32BFDEB28B39BC734CDEE
                                                                                                                                                                                                                          SHA1:87816F4AFABBDEC0EC2CFEB417748398505C5AA9
                                                                                                                                                                                                                          SHA-256:7102F8D9D0F3F689129D7FE071B234077FBA4DD3687071D1E2AEAA137B123F86
                                                                                                                                                                                                                          SHA-512:5E1131B405E0C7A255B1C51073AFF99E2D5C0D28FD3E55CABC04D463758A575A954008EA1BA5B4E2B345B49AF448B93AD21DFC4A01573B3CB6E7256D9ECCEEF1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...1............" .........................................................0......':....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-heap-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12752
                                                                                                                                                                                                                          Entropy (8bit):6.58394079658593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:YFY17aFBRQWthWIWf9BvVVWQ4mWHhOP+CjAWqnajKsNngJ:YQtWthWNNdP+CcWlGsNI
                                                                                                                                                                                                                          MD5:8906279245F7385B189A6B0B67DF2D7C
                                                                                                                                                                                                                          SHA1:FCF03D9043A2DAAFE8E28DEE0B130513677227E4
                                                                                                                                                                                                                          SHA-256:F5183B8D7462C01031992267FE85680AB9C5B279BEDC0B25AB219F7C2184766F
                                                                                                                                                                                                                          SHA-512:67CAC89AE58CC715976107F3BDF279B1E78945AFD07E6F657E076D78E92EE1A98E3E7B8FEAE295AF5CE35E00C804F3F53A890895BADB1EED32377D85C21672B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0.......l....`A........................................P................ ...................!..............p............................................................................rdata..f...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-locale-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.696904963591775
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:m8qWthWLWf9BvVVWQ4WWLXlyBZr+YVqnajKsS1:mlWthWWN0uZfVlGsS1
                                                                                                                                                                                                                          MD5:DD8176E132EEDEA3322443046AC35CA2
                                                                                                                                                                                                                          SHA1:D13587C7CC52B2C6FBCAA548C8ED2C771A260769
                                                                                                                                                                                                                          SHA-256:2EB96422375F1A7B687115B132A4005D2E7D3D5DC091FB0EB22A6471E712848E
                                                                                                                                                                                                                          SHA-512:77CB8C44C8CC8DD29997FBA4424407579AC91176482DB3CF7BC37E1F9F6AA4C4F5BA14862D2F3A9C05D1FDD7CA5A043B5F566BD0E9A9E1ED837DA9C11803B253
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...r..[.........." .........................................................0.......P....`A........................................P...e............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-math-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20944
                                                                                                                                                                                                                          Entropy (8bit):6.216554714002396
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:rQM4Oe59Ckb1hgmLRWthW0N0JBJ1IlGsrC5W:sMq59Bb1jYNABHJc
                                                                                                                                                                                                                          MD5:A6A3D6D11D623E16866F38185853FACD
                                                                                                                                                                                                                          SHA1:FBEADD1E9016908ECCE5753DE1D435D6FCF3D0B5
                                                                                                                                                                                                                          SHA-256:A768339F0B03674735404248A039EC8591FCBA6FF61A3C6812414537BADD23B0
                                                                                                                                                                                                                          SHA-512:ABBF32CEB35E5EC6C1562F9F3B2652B96B7DBD97BFC08D918F987C0EC0503E8390DD697476B2A2389F0172CD8CF16029FD2EC5F32A9BA3688BF2EBEEFB081B2C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........,...............................................P............`A........................................P....%...........@...............0...!..............p............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\api-ms-win-crt-private-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):64464
                                                                                                                                                                                                                          Entropy (8bit):5.537611266681503
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:2PMeDe5c4bFe2JyhcvxXWpD7d3334BkZn+Ppzh:2DDe5c4bFe2JyhcvxXWpD7d3334BkZnU
                                                                                                                                                                                                                          MD5:D76E7AAECB3D1CA9948C31BDAE52EB9D
                                                                                                                                                                                                                          SHA1:142A2BB0084FAA2A25D0028846921545F09D9AE9
                                                                                                                                                                                                                          SHA-256:785C49FD9F99C6EB636D78887AA186233E9304921DD835DEE8F72E2609FF65C4
                                                                                                                                                                                                                          SHA-512:52DA403286659CF201C72FA0AB3C506ADE86C7E2FEF679F35876A5CEC4AEE97AFBC5BB13A259C51EFB8706F6AE7F5A6A3800176B89F424B6A4E9F3D5B8289620
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....{............" ......................................................................`A........................................P....................................!..............p............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\gb2312.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):86971
                                                                                                                                                                                                                          Entropy (8bit):2.3925661740847697
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
                                                                                                                                                                                                                          MD5:C5AA0D11439E0F7682DAE39445F5DAB4
                                                                                                                                                                                                                          SHA1:73A6D55B894E89A7D4CB1CD3CCFF82665C303D5C
                                                                                                                                                                                                                          SHA-256:1700AF47DC012A48CEC89CF1DFAE6D1D0D2F40ED731EFF6CA55296A055A11C00
                                                                                                                                                                                                                          SHA-512:EEE6058BD214C59BCC11E6DE7265DA2721C119CC9261CFD755A98E270FF74D2D73E3E711AA01A0E3414C46D82E291EF0DF2AD6C65CA477C888426D5A1D2A3BC5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: euc-cn, multi-byte..M..003F 0 82..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso2022-jp.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):204
                                                                                                                                                                                                                          Entropy (8bit):4.949409835601965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SOd5MNXVSVLqRIBXS4ovLE9sDXMVyXK9ow1Deq9Ts5dRPMSXcRA0kcR4X9cL+TXI:SVNFS0oyisLMsXK9okTw/BDSVKNw
                                                                                                                                                                                                                          MD5:D3AC33390D31705FA4486D0B455247DF
                                                                                                                                                                                                                          SHA1:2EE8613DC04A6FA84AB38FD5F3A2AA3FE330625B
                                                                                                                                                                                                                          SHA-256:98074C85650A420A095ADA9138DA3A8A0AA4027BE47EA1E97A596F319EB084E9
                                                                                                                                                                                                                          SHA-512:CB265B753C84968E2D1D6E706906DA9A7BB796D08F626290BCCA8F089771AFD176A9DC912773E8BA390D2AEC08592AD535C7D254E1DF92CF04848601481D4EFE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso2022-jp, escape-driven..E..name..iso2022-jp..init..{}..final..{}..ascii..\x1b(B..jis0201..\x1b(J..jis0208..\x1b$B..jis0208..\x1b$@..jis0212..\x1b$(D..gb2312..\x1b$A..ksc5601..\x1b$(C..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso2022-kr.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):122
                                                                                                                                                                                                                          Entropy (8bit):4.978693690727393
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SOd5MNXVTEXIBXS4ovLE9sDXNvdwUHEQwqc6XWxVUNOov:SVNFSoyisL/Zzc6mYNHv
                                                                                                                                                                                                                          MD5:057CB0AA9872AC3910184F67AC6621BC
                                                                                                                                                                                                                          SHA1:BBA47F9D76B6690C282724C3423BD94E2C320A04
                                                                                                                                                                                                                          SHA-256:234811FC8B0F8FF2B847D9CC3982F1699DF1D21A43C74DCE45BA855D22520007
                                                                                                                                                                                                                          SHA-512:019F187D2D16FB51BF627ACB7E67778857E56D4C160E0E5ACA6ABC05EC5FDB624CE2715CB9E0DAD73BFF9D697982BE0D539BC55BCCD368FC7C8EE0FFC04E9F61
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso2022-kr, escape-driven..E..name..iso2022-kr..init..\x1b$)C..final..{}..iso8859-1.\x0f..ksc5601..\x0e..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso2022.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):240
                                                                                                                                                                                                                          Entropy (8bit):4.95909788984399
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SVNFUXoyisLNcs9ozc6W4Twk0sRBDSVKN6tWIHRy:oUYcLNcTzczbwRYRy
                                                                                                                                                                                                                          MD5:BB186D4BE3FA67DD3E2DEE82DD8BD628
                                                                                                                                                                                                                          SHA1:93CE8627038780CFFF8C06E746DD5FB2B041115C
                                                                                                                                                                                                                          SHA-256:741B4C842557EED2952936204D0AE9C35FA3A0F02F826D94C50C46976291797C
                                                                                                                                                                                                                          SHA-512:4921E7AA3DB8E33609603FE129B97275DFF80CFB06648D2068FA7950246C67B9B530B74827638F69F4DFB8F55CDD4AA952EA72EAEB6ABB527D52F20C6B46FB51
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso2022, escape-driven..E..name..iso2022..init..{}..final..{}..iso8859-1.\x1b(B..jis0201..\x1b(J..gb1988..\x1b(T..jis0208..\x1b$B..jis0208..\x1b$@..jis0212..\x1b$(D..gb2312..\x1b$A..ksc5601..\x1b$(C..jis0208..\x1b&@\x1b$B..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-1.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1114
                                                                                                                                                                                                                          Entropy (8bit):3.236046263464657
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:iyHVBUlJvRj7SOVbusZhAMiZyi77qimmvGNNlkL+rSMH+tKv:iyMlBVnrAMiwMmTmokLz0
                                                                                                                                                                                                                          MD5:3538A970CD098BF5CE59005FE87B6626
                                                                                                                                                                                                                          SHA1:285A96CC40D7CCE104FB4B407C7F0C400AA8F9CB
                                                                                                                                                                                                                          SHA-256:A9CB4F4CA111608F882729BC5EB1C2F15530C515EF02DD2CA62F2D8DC5A210CF
                                                                                                                                                                                                                          SHA-512:A6A6F2D8B5C22E240D195D168A604887062508FF3340D24E13BFCBD6C2E687347F2CFE724FA2ED12F36915B55EE2CFD901EC3F08E2B0A2FFD3BC2A98BBD12A50
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-1, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E300

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-10.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1115
                                                                                                                                                                                                                          Entropy (8bit):3.319750415373386
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:jHVBUlJvRj7SOVbusZhAMiZyi77qimXG2yM6q7KytC:jMlBVnrAMiwMmTXG2gytC
                                                                                                                                                                                                                          MD5:CBDE40170FECD2496A9DA3CF770FAB7B
                                                                                                                                                                                                                          SHA1:3E1D74DF6AFEB6CDE8ECBDAC8F81F2F9C64150DE
                                                                                                                                                                                                                          SHA-256:48F4A239C25354F0E9F83A39F15D4632BB18A9C33E60C671C67307159917ECED
                                                                                                                                                                                                                          SHA-512:A26B56A4CFE29E5A0A0B3A55283A7767397693388E2DEEC342C69B6F718FAE2407EB8D5ADE538FAE6947CBB8B052943C3A52F2D046ABAC7A3DAA86D730DC293F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-10, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0010401120122012A0128013600A7013B011001600166017D00AD016A014A..00B0010501130123012B0129013700B7013C011101610167017E2015016B014B..010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE00CF..00D00145014C00D300D400D500D6016800D8017200DA00DB00DC00DD00DE00DF..010100E100E200E30

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-11.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1115
                                                                                                                                                                                                                          Entropy (8bit):3.3206399689840476
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:6HVBUlJvRj7SOVbusZhAMiZyi77qimwHmEU4AyqU+TWwdd:6MlBVnrAMiwMmTf4AyqUSd
                                                                                                                                                                                                                          MD5:E2A0BCB83BFC3F435CDCFC20D5CF2E0C
                                                                                                                                                                                                                          SHA1:CFD18B5B5DB4EE46E63D912B8FD66D513C4C8D39
                                                                                                                                                                                                                          SHA-256:21E769C5A66E4D12D6E7DB24022E92AF1EC0D0331FE3C8C605654F239C0F3640
                                                                                                                                                                                                                          SHA-512:C86F9180F2F4A177F1EA10E26B0903ABEAFDDE0317C332A48F8D1BB586DAC91C68800E2E4FA2CD739C435419B106CBA4BEFC049F2BCD720E9FC2C0AE8436CFAC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-11, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-13.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1115
                                                                                                                                                                                                                          Entropy (8bit):3.338879965076632
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:olHVBUlJvRj7SOVbusZhAMiZyi77qim2w4kBUioGnd2:olMlBVnrAMiwMmT/WNI2
                                                                                                                                                                                                                          MD5:21CEBB723D47B1450A7FB21A82470B97
                                                                                                                                                                                                                          SHA1:A40FD3AFE1ECE89E3F682D527D281BC563DB3892
                                                                                                                                                                                                                          SHA-256:3271D39D7B4DCD841E8E5D5153D1B8837718B88FEFEC73DC37D314816EEFE5E5
                                                                                                                                                                                                                          SHA-512:3A0E033A4D93C679215F672C6C4FE425D63E1DE157AA671E7400639165EC3EB498E4EEB030D6FB8FF8BE2FD8C986D341036A8CED9FA094D092CF2822D5DC065B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-13, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0201D00A200A300A4201E00A600A700D800A9015600AB00AC00AD00AE00C6..00B000B100B200B3201C00B500B600B700F800B9015700BB00BC00BD00BE00E6..0104012E0100010600C400C501180112010C00C90179011601220136012A013B..01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF..0105012F010101070

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-14.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1115
                                                                                                                                                                                                                          Entropy (8bit):3.3670559016263915
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:vHVBUlJvRj7SOVbusZhAMiZyi77qimhw6COlk1fKMH+tiH:vMlBVnrAMiwMmT/tlkQz0
                                                                                                                                                                                                                          MD5:FDAA88946DE4EB4E6D37F2B6AFCF6CAF
                                                                                                                                                                                                                          SHA1:56FC4773941E7457EA04EDA92C883642DE45D100
                                                                                                                                                                                                                          SHA-256:F0A5675027FB1CA34B4E4128D24C2968CD275890569A32A86AFA4994CE4983E0
                                                                                                                                                                                                                          SHA-512:92658A6FEB42A41B3CFFC377C4A9A3F6780A79FC596D3FEDBA6D3B3D75A9F40E859A2CE8DC579A278BAEEDEEFA2408E2B7853D99D5C2D14AACF63C521FE2BB86
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-14, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A01E021E0300A3010A010B1E0A00A71E8000A91E821E0B1EF200AD00AE0178..1E1E1E1F012001211E401E4100B61E561E811E571E831E601EF31E841E851E61..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..017400D100D200D300D400D500D61E6A00D800D900DA00DB00DC00DD017600DF..00E000E100E200E30

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-15.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1115
                                                                                                                                                                                                                          Entropy (8bit):3.260398494526282
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mHVBUlJvRj7SOVbusZhAMiZyi77qimmRf4kL+rSMH+tKv:mMlBVnrAMiwMmTmCkLz0
                                                                                                                                                                                                                          MD5:D779D5E2A0083C616A226B2D82ABF0EB
                                                                                                                                                                                                                          SHA1:D1657DB5E2989EBA80BAB98A1E1217CFFFBB19DB
                                                                                                                                                                                                                          SHA-256:C74E8E23A0FF0D5DEA7C318CA20DC817DA4E57B0DD61B3361FC0D5098A9316FE
                                                                                                                                                                                                                          SHA-512:26E62BE8AE793ED3B725BF0D1BABF4D6ED63A6F3772ABD48955FC4394BDE5A47614D1FF89A21A828676BF1302F3C9361B557B0FBF0DF8561FB7E66542FE94CDC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-15, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A320AC00A5016000A7016100A900AA00AB00AC00AD00AE00AF..00B000B100B200B3017D00B500B600B7017E00B900BA00BB01520153017800BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E30

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-16.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1115
                                                                                                                                                                                                                          Entropy (8bit):3.3065938185320918
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:dHVBUlJvRj7SOVbusZhAMiZyi77qim0SmmPkYTtyL:dMlBVnrAMiwMmTttPkYpyL
                                                                                                                                                                                                                          MD5:74FDEDDAF670023DA7751FB321E345A0
                                                                                                                                                                                                                          SHA1:0677FED67C1333A9A74D50642E5214701A57E2AF
                                                                                                                                                                                                                          SHA-256:640D977EC1D22B555C5075798DA009E3523E8F55F29BE22A3050CD1B4EF7B80E
                                                                                                                                                                                                                          SHA-512:AC02FD95159A856A9DDEF4E6A8216B958DC07311B553FF39403DC5B77E1AFF2A2C4C03F5F26A2BB7AD5DB6800BEE03E895554556DBBFBE89426286796ADE55AC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-16, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A001040105014120AC201E016000A7016100A9021800AB017900AD017A017B..00B000B1010C0142017D201D00B600B7017E010D021900BB015201530178017C..00C000C100C2010200C4010600C600C700C800C900CA00CB00CC00CD00CE00CF..0110014300D200D300D4015000D6015A017000D900DA00DB00DC0118021A00DF..00E000E100E201030

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-2.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1114
                                                                                                                                                                                                                          Entropy (8bit):3.340505173539446
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:UHVBUlJvRj7SOVbusZhAMiZyi77qim/ssm5VO6ys2K:UMlBVnrAMiwMmT/ssYTys2K
                                                                                                                                                                                                                          MD5:9B87850646FFE79F3C8001CBCB5BB3A1
                                                                                                                                                                                                                          SHA1:8F97576F3FB3B5DBEF71DC2C9314AB5E530974D6
                                                                                                                                                                                                                          SHA-256:76949B03F57041B07F41902BD7505AB3594D79AA8F7BDEED5F0481004B10CBC3
                                                                                                                                                                                                                          SHA-512:101A28AF0799E7E0A5723E5DD76D5EF0FEEF584AC479A88F499CB3B7D2AA93767D72F8E51C76F7547F08FF8DD3CBBA7FF444BD07F99A92755526E75C596109EF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-2, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0010402D8014100A4013D015A00A700A80160015E0164017900AD017D017B..00B0010502DB014200B4013E015B02C700B80161015F0165017A02DD017E017C..015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E..01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF..015500E100E2010300

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-3.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1114
                                                                                                                                                                                                                          Entropy (8bit):3.2507537230559977
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:tHVBUlJvRj7SOVbusZhAMiZyi77qimw2g0kgTJMkFtoD:tMlBVnrAMiwMmTo0kgTJDoD
                                                                                                                                                                                                                          MD5:CBD0B9CDCD9BC3D5F2429A760CF98D2F
                                                                                                                                                                                                                          SHA1:6DEF0343E0357E0671002A5D2F0BFC2E00C8BCF9
                                                                                                                                                                                                                          SHA-256:1F51E7BDA64D466C16FEE9A120BBE3353A10CEB9DAB119FFA326779BA78D8C5D
                                                                                                                                                                                                                          SHA-512:88DB6D23B53F4A78133C794ED42FA3F29A4ABAD35DE4B022040FA187AA59B00664CC13F47AFF4507D72F4CB2166F026144213EE760AB0FD67CDD2FA5906F434A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-3, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0012602D800A300A40000012400A700A80130015E011E013400AD0000017B..00B0012700B200B300B400B5012500B700B80131015F011F013500BD0000017C..00C000C100C2000000C4010A010800C700C800C900CA00CB00CC00CD00CE00CF..000000D100D200D300D4012000D600D7011C00D900DA00DB00DC016C015C00DF..00E000E100E2000000

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-4.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1114
                                                                                                                                                                                                                          Entropy (8bit):3.3413832766873073
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:KHVBUlJvRj7SOVbusZhAMiZyi77qimX4AsD/njR7Ky8hA:KMlBVnrAMiwMmTXBs3EyuA
                                                                                                                                                                                                                          MD5:8B620EDECAC2DF15A024C2CE15FB64A5
                                                                                                                                                                                                                          SHA1:65C5EE5D08964E37393E6A78ABA0DB16D51240E2
                                                                                                                                                                                                                          SHA-256:66B3CF994F0B5E0103D13E812958320AFB555C91E3F81B579D4CBF231E6A0805
                                                                                                                                                                                                                          SHA-512:93391325405D3AEA0A913F5EA8EA0391920D10F234C26AB1DA70992702889A3AF7B85E11A1FCA554690942B238CE313DD460798E59C5B1F4069036E7B0F24F44
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-4, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A001040138015600A40128013B00A700A8016001120122016600AD017D00AF..00B0010502DB015700B40129013C02C700B80161011301230167014A017E014B..010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE012A..01100145014C013600D400D500D600D700D8017200DA00DB00DC0168016A00DF..010100E100E200E300

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-5.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1114
                                                                                                                                                                                                                          Entropy (8bit):3.342721205983665
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:zHVBUlJvRj7SOVbusZhAMiZyi77qimq5+SAJlz9aRme3cJbx:zMlBVnrAMiwMmTqeYnsJbx
                                                                                                                                                                                                                          MD5:6FBEFDC3DEC612B7B2CC903D8C53F45B
                                                                                                                                                                                                                          SHA1:14EC3C166DC411149C32C262DBE8E327F6186669
                                                                                                                                                                                                                          SHA-256:3130BF26DA0C840C1E02203A90C3B1C38966FB203130E2FBB3DD7CB3865A3539
                                                                                                                                                                                                                          SHA-512:F3F15AD8B6C9D9B4C9C994FE3235B4463E59BE7DCE79CF3F7AA77905D6F4DC2C4AABB79B440767DB13D357B13F09EA34983FCA7BC92D0AFA15FB6CBEDDD04E38
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-5, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0040104020403040404050406040704080409040A040B040C00AD040E040F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..0430043104320433043404350436043704380439043A043B043C043D043E043F..044004410442044304

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-6.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1114
                                                                                                                                                                                                                          Entropy (8bit):2.992219341429816
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:YHVBUlJvRj7SOVbusZhAMiZyi77qimEZjyG/KE:YMlBVnrAMiwMmTEs6KE
                                                                                                                                                                                                                          MD5:52F025D943A45EE840D9C3DFD06E4D79
                                                                                                                                                                                                                          SHA1:571EA14B49FA6150BFD2ABA79E52799955D9FA10
                                                                                                                                                                                                                          SHA-256:CB71909BF01A3A7A4C7396359DA06D206B58A42AD68192CE37169D6640D46E13
                                                                                                                                                                                                                          SHA-512:77FF9DC785A63CA59A7D58BB25C7D2C16F364E525F9B939177385EF80F7DE37734C8774F1BC829CF0270FD66257A4D31689654C8037DB0A86A0291FFDE637B90
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-6, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000000000000000A40000000000000000000000000000060C00AD00000000..00000000000000000000000000000000000000000000061B000000000000061F..0000062106220623062406250626062706280629062A062B062C062D062E062F..0630063106320633063406350636063706380639063A00000000000000000000..064006410642064306

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-7.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1114
                                                                                                                                                                                                                          Entropy (8bit):3.393893260854861
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:TMyHVBUlJvRj7SOVbusZhAMiZyi77qim2OBHK9QQSqiWeIDDdn:TlMlBVnrAMiwMmT1hKyQSqiWeIVn
                                                                                                                                                                                                                          MD5:4BFB0A35D971A9D4C5EA8D8099E93C37
                                                                                                                                                                                                                          SHA1:8FED2CBB1343E5B4442748242B5F89A76110592D
                                                                                                                                                                                                                          SHA-256:76F6BC85FC9CB89BC3F94D36275AB23C740BA17FD36EC8907479DA3A885415EA
                                                                                                                                                                                                                          SHA-512:C9CE1E9EA57A1DEF62BBC60A115C06325C6EE8F92021695459E1ADAF1193A559BC5F0229191BFC2E344296DC137583ED4A9A61A65890F99F4CF97B3864C7AF0F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-7, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A02018201900A320AC20AF00A600A700A800A9037A00AB00AC00AD00002015..00B000B100B200B303840385038600B703880389038A00BB038C00BD038E038F..0390039103920393039403950396039703980399039A039B039C039D039E039F..03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF..03B003B103B203B303

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-8.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1114
                                                                                                                                                                                                                          Entropy (8bit):3.0494739426493567
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:uHVBUlJvRj7SOVbusZhAMiZyi77qimieGlnvs26Kcv:uMlBVnrAMiwMmTirv87
                                                                                                                                                                                                                          MD5:5F69EAF54E7A1E8AC81C9E734DBE90D8
                                                                                                                                                                                                                          SHA1:BA509C88A4FC03922EF5CDC887FAA7B594A9BC5A
                                                                                                                                                                                                                          SHA-256:865E3665743B5FABA3E1AD6AA55515A666BD05DA6266879D9B66C98905DAFF3C
                                                                                                                                                                                                                          SHA-512:D9924FBE59CB571AF721CA602DBE58CAD0D9310610EDF544F8FC0FBF3D1CE4E99597D0198E4E7C802107012786346FE4C1B9C6C3A76D5F60B9A83981B0EDA24D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-8, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0000000A200A300A400A500A600A700A800A900D700AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE0000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000002017..05D005D105D205D305

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\iso8859-9.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1114
                                                                                                                                                                                                                          Entropy (8bit):3.2591070910715714
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:XHVBUlJvRj7SOVbusZhAMiZyi77qimmvGNNlkBSMH+tA/b:XMlBVnrAMiwMmTmokgzAD
                                                                                                                                                                                                                          MD5:0B99E605E73B7D8DEFD8D643F5729748
                                                                                                                                                                                                                          SHA1:F30E7CCBCD9C539126E8D6CA0886E4B2BD54E05D
                                                                                                                                                                                                                          SHA-256:CF51E867DDE2F19553D98FEEC45A075C4B4F480FB1EDADB3D8DAD1EBEA9299F3
                                                                                                                                                                                                                          SHA-512:DA0487CD7F2143195E80697C17FFDB61AFD464C888DDF84813B2B5D1BAB24D96466DA7A7F77C8E4A9D0D53F34D72928923380AFC1B92A96C0A3BFF46006A4E19
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-9, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF..00E000E100E200E300

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\jis0201.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1112
                                                                                                                                                                                                                          Entropy (8bit):3.2708615484795676
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:zBHVBUlJvRj7SOVbusZhAMiZyi77qN8VmKfkiJt0RMFS:zBMlBVnrAMiwMmNPYPFS
                                                                                                                                                                                                                          MD5:4E21F24F8D9CC5DF16B29CACD997AC69
                                                                                                                                                                                                                          SHA1:064E723EFB82EF1C303E5267496304288821E404
                                                                                                                                                                                                                          SHA-256:61B14A7C312366F79BB45F02C6B7EE362E6F51CBAD5E479E563C7F7E785DB654
                                                                                                                                                                                                                          SHA-512:AF8FAEB47EFB51F2537139F7C4254ABED119E477FD2B5E83B90B7A903B43C4E02DDF43A7DDB044A0A9601E9F9ADE91B02EE7C0EC87FF5DDCF9951B9601A90435
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: jis0201, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D203E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..00000000000000000000

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\jis0208.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):81772
                                                                                                                                                                                                                          Entropy (8bit):2.3571626869060776
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:AigXM6CwL/9pV7Hl6+Yko9gZxErA3/MS/8xqg8:AZ/tp1Hl2KZxUfr8
                                                                                                                                                                                                                          MD5:F0661E22C7455994AA1F6EC1EDA401B4
                                                                                                                                                                                                                          SHA1:928B2AC46A9FDE61A81F56BE225E6138B40C22E5
                                                                                                                                                                                                                          SHA-256:F6B1C6AC5F5FC4E990A7A1AAC16A406012040936431BEFE7D2B6CD1DA9E422C4
                                                                                                                                                                                                                          SHA-512:917CC58678A9E9F5CBE860D30828846ABA4EA8CDFAB7DD1AE6A66C47ECBB85CF67DD97BC3E6F95341DD30F4E757B2CEA571708D5B4CED18A29F19904C3138AE0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: jis0208, double-byte..D..2129 0 77..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000300030013002FF0CFF0E30FBFF1AFF1BFF1FFF01309B309C00B4FF4000A8..FF3EFFE3FF3F30FD30FE309D309E30034EDD30053006300730FC20152010FF0F..FF3C301C2016FF5C2026202520182019201C201DFF08FF0930143015FF3BFF3D..FF5BFF5D30083009300A300B300C300D300E300F30103011FF0B221200B100D7..00F7FF1D2260FF1CFF1E22662267221E22342642264000B0203220332103FFE5..FF0400A200A3FF05FF03FF06FF0AFF2000A72606260525CB25CF25CE25C70000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\jis0212.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):72133
                                                                                                                                                                                                                          Entropy (8bit):2.3455261548208055
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:9F/D7CH2puD5CdzU3nAkP5dHn7s391fmOarFaVQ:H/D7CHbozU3nAk3H7sXm3FgQ
                                                                                                                                                                                                                          MD5:07CE2C135BE17DBAFA558AA5949A53DB
                                                                                                                                                                                                                          SHA1:5D9DBEFCCB44E76C1A4E61360C6FCED8DCC8EF4D
                                                                                                                                                                                                                          SHA-256:785CFC5F5D9CB06DB8061730AB0016A0F70D0B59F6787D2A3CBB8D5779C99706
                                                                                                                                                                                                                          SHA-512:E954D7198D58ACEDEB4C8E5F466107767C3DA43763A5F6CDDFCF567226F9B22B4C2DE27564F28CD125D7F1BA7CB9C6DE6DEC4065EC2676572C793BE458FDDD9D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: jis0212, double-byte..D..2244 0 68..22..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000000000000000000000000000000000000000000000000000000000002D8..02C700B802D902DD00AF02DB02DA007E03840385000000000000000000000000..0000000000A100A600BF00000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000BA00AA00A900AE2122..00A4211600000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\koi8-r.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1111
                                                                                                                                                                                                                          Entropy (8bit):3.531149521168141
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:KcJ5mHVBUlJvRj7SOVbusZhAMiZyi77qpSzIa9qVRS3YcEchJh3MAxSl:KmmMlBVnrAMiwMmAzIxVgBE6cAxQ
                                                                                                                                                                                                                          MD5:96F54CC639ACA8E466FB8058144C9350
                                                                                                                                                                                                                          SHA1:0B9530D6080F2BAACABD5AA0D48BFF316FCCEF64
                                                                                                                                                                                                                          SHA-256:0E43244BFC4F33FACB844B9E00270A1A4C24DC59B8A9B95104E2D788BB2F59FD
                                                                                                                                                                                                                          SHA-512:5B7859325E5E34C9D4558B1198795BB9C6A8EF783EB97193EA80BA76C38AFE9BDD1B526B77401DF5456B7A0E85E942191FFD4B4F2B9F0C8168A7093EE452802E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: koi8-r, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..25002502250C251025142518251C2524252C2534253C258025842588258C2590..259125922593232025A02219221A22482264226500A0232100B000B200B700F7..25502551255204512553255425552556255725582559255A255B255C255D255E..255F25602561040125622563256425652566256725682569256A256B256C00A9..044E0430043104460434043504440433044504380439043A043B043C043D043E..043F044F044004410442044304360432044C044B04370448044D04490447044A..042E04100411042604140

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\koi8-u.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1111
                                                                                                                                                                                                                          Entropy (8bit):3.5076564572101714
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:K+HVBUlJvRj7SOVbusZhAMiZyi77qpSzIaU3dmVRS3YcEchJh3MAxSl:K+MlBVnrAMiwMmAzI/EVgBE6cAxQ
                                                                                                                                                                                                                          MD5:4B755EF2288DFC4009759F8935479D68
                                                                                                                                                                                                                          SHA1:C3BDF0D9DF316DE8919DAA4329275C5AA81D61B4
                                                                                                                                                                                                                          SHA-256:ED04D5B977B8C8944D8760B713FF061292DA5634BCBB67CDFB1C3A6FF5378C81
                                                                                                                                                                                                                          SHA-512:3F1E1CC47327054FB9C54157ED10514230F10BFCD4BD9FDAFA02D7B238137DC7442CA2661B0739D8EEA3181E187D3B639A2C8118A0DE272C96000908121B6CFB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: koi8-u, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..25002502250C251025142518251C2524252C2534253C258025842588258C2590..259125922593232025A02219221A22482264226500A0232100B000B200B700F7..25502551255204510454255404560457255725582559255A255B0491255D255E..255F25602561040104032563040604072566256725682569256A0490256C00A9..044E0430043104460434043504440433044504380439043A043B043C043D043E..043F044F044004410442044304360432044C044B04370448044D04490447044A..042E04100411042604140

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\ksc5601.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):94393
                                                                                                                                                                                                                          Entropy (8bit):2.4104200953565513
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:XbjO7Uw6uKdosXRxps9a+ut/BmZPwkpT9A0T03o:XfO4ZBRxpV+4wPwKloo
                                                                                                                                                                                                                          MD5:366C09E4A4CC10006E593F5B3F3461D7
                                                                                                                                                                                                                          SHA1:A0DABFBEEB66E26FB342844EA41772D7A1D19C24
                                                                                                                                                                                                                          SHA-256:9B27FE7E7054F36E279993F19E52E18AC03360D117AE80C42B4E984A97C590AA
                                                                                                                                                                                                                          SHA-512:670F32D698C7992038E736D3AD40098D8589C0C5A1379E32A0F02A02FAF251B1312CAD131DDADC3F80B23A3821A91689F2E310309028BDDDF227D532EB505A20
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: ksc5601, double-byte..D..233F 0 89..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300200B72025202600A8300300AD20152225FF3C223C20182019..201C201D3014301530083009300A300B300C300D300E300F3010301100B100D7..00F7226022642265221E223400B0203220332103212BFFE0FFE1FFE526422640..222022A52312220222072261225200A7203B2606260525CB25CF25CE25C725C6..25A125A025B325B225BD25BC219221902191219321943013226A226B221A223D..221D2235222B222C2208220B2286228722822283222A222922272228FFE20000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\macCentEuro.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1116
                                                                                                                                                                                                                          Entropy (8bit):3.4295694929963667
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8jHVBUlJvRj7SOVbusZhAMiZyi77qHVPJSf2FcVDu1LEe4qPPMl2J89:8jMlBVnrAMiwMmHEmJ4IMgi9
                                                                                                                                                                                                                          MD5:10850BCFB943318284D6191494EBD7D5
                                                                                                                                                                                                                          SHA1:237D5DDF7969A422991F17021244D13A2BB0DE92
                                                                                                                                                                                                                          SHA-256:81ECA6840B87F2DEF9FCDD171A55C2D71A49386D88401CE927AE57D7DDD7AAAA
                                                                                                                                                                                                                          SHA-512:D797781C228B70D2D83DB8ABA08F840CE49846C9473CC89A2E316900D9E08A63142E68AD9ABBB2EF67BF9F1D392772FAB36CCC09632022A1437AE27C11F2284F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macCentEuro, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C40100010100C9010400D600DC00E10105010C00E4010D0106010700E90179..017A010E00ED010F01120113011600F3011700F400F600F500FA011A011B00FC..202000B0011800A300A7202200B600DF00AE00A92122011900A822600123012E..012F012A22642265012B0136220222110142013B013C013D013E0139013A0145..0146014300AC221A01440147220600AB00BB202600A00148015000D50151014C..20132014201C201D2018201900F725CA014D0154015501582039203A01590156..01570160201A201E

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\macCroatian.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1116
                                                                                                                                                                                                                          Entropy (8bit):3.3992482002374516
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8ULyHVBUlJvRj7SOVbusZhAMiZyi77qsTMdKxOZwwL+KR5D/jlJy6QWky:8ULyMlBVnrAMiwMmOsL+KR5DblE85
                                                                                                                                                                                                                          MD5:A60FBDE33D13C732095713D1AB6713AB
                                                                                                                                                                                                                          SHA1:4B0EB443F2D0E4B8DB7D0435F9311E5F9A625123
                                                                                                                                                                                                                          SHA-256:BBE6F5EBB5EAB08C91DF7D524FAF39B03AA8B9F84C67ABA0553A84EC56668CB9
                                                                                                                                                                                                                          SHA-512:3EEBA6BA3FCD875AFBD5DF41EDC21E872416A48D03343232904CC99CAF913045DAF7B1A1ACD0949EF794AD7B6C9AE8F93808423FFC4B67718E732B2FF5D9B6D7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macCroatian, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE0160212200B400A82260017D00D8..221E00B122642265220600B522022211220F0161222B00AA00BA03A9017E00F8..00BF00A100AC221A01922248010600AB010C202600A000C000C300D501520153..01102014201C201D2018201900F725CAF8FF00A9204420AC2039203A00C600BB..201300B7201A201E

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\macCyrillic.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1116
                                                                                                                                                                                                                          Entropy (8bit):3.4178221849964903
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8dHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9a4piS1yk+5yye3cJY:8dMlBVnrAMiwMm8Y6zUk+UVsJY
                                                                                                                                                                                                                          MD5:C390D66441AC61CCF0A685CA5EE0BC1C
                                                                                                                                                                                                                          SHA1:FCAE825B54400B9D736EF22A613E359E3F0FA6C2
                                                                                                                                                                                                                          SHA-256:76EFE571ADDA7AED467F146CB0BD3A2351F2A720508EA0642C419F5347789CAA
                                                                                                                                                                                                                          SHA-512:C891DB15E0F600965885DE6745EDD2A4E3A6A20CA30A9AAE89CBD8C429F8455C4AF7F2FC053FB3D730D8544AB6A6E78E769DB93DAD7B29868B746FA10373F021
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macCyrillic, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..202000B0049000A300A7202200B6040600AE00A9212204020452226004030453..221E00B122642265045600B504910408040404540407045704090459040A045A..0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455..20132014201C201D2018201900F7201E040E045E040F045F211604010451044F..0430043104320433

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\macDingbats.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1116
                                                                                                                                                                                                                          Entropy (8bit):3.870022681111701
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:87JMHkUlJvRjmf9RCsUBOdXsCbbNviANpkDP1XFAoE4xSF5HrBPkdn:87KvlA9RCs6CXrViANUP1XFA9eSvdPKn
                                                                                                                                                                                                                          MD5:DCE78527E3A7B7CB1DE9EE5FAF12AFC6
                                                                                                                                                                                                                          SHA1:20F4A3F4DB6B3422C04EBB6B21A568E4C173F9C1
                                                                                                                                                                                                                          SHA-256:062E31D48DC33160999074E49205E08C3655DFF91C2C87F254522E6EBCE2DD96
                                                                                                                                                                                                                          SHA-512:627F5FD2F12B341F2D7EE9032946FE057C4AC74D99687178CEA98B3E150307BB6AA2495B0FA46400760D467E2BF589BE31E998E25CE1D1E8465DA61F22047345
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macDingbats, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00202701270227032704260E2706270727082709261B261E270C270D270E270F..2710271127122713271427152716271727182719271A271B271C271D271E271F..2720272127222723272427252726272726052729272A272B272C272D272E272F..2730273127322733273427352736273727382739273A273B273C273D273E273F..2740274127422743274427452746274727482749274A274B25CF274D25A0274F..27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F..F8D7F8D8F8D9F8DAF8DBF8DCF8DDF8DEF8DFF8E0F8E1F8E2F8E3F8E4008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000276127622763276427652766276726632666266526602460246124622463..2464246524662467246824692776277727782779277A277B277C277D277E277F..2780278127822783278427852786278727882789278A278B278C278D278E278F..2790279127922793279421922194219527982799279A279B279C279D279E279F..27A027A127A227A3

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\macGreek.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1113
                                                                                                                                                                                                                          Entropy (8bit):3.4954458011071323
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8dOHVBUlJvRj7SOVbusZhAMiZyi77qJlbaBMD2aSY5us36Ekp1ysOSU2imR:8kMlBVnrAMiwMm7aKPVusqx1ysOJjmR
                                                                                                                                                                                                                          MD5:0CC92F685A4132BE4B030006670D81CE
                                                                                                                                                                                                                          SHA1:13B1074A90055E9EA061A6206A9C004DA29967A9
                                                                                                                                                                                                                          SHA-256:1AABE561B5C944ABD11C293D4ACAC0F3A4A5A9E84A0342D066F4E3E992348895
                                                                                                                                                                                                                          SHA-512:E1AF3D47D681CD68B6063DEC1241631CABE86FE835232FA73D855AC74D0175540D46511282BE7198A67A37970A5D05CDECF55C10424ED9C1413C108F116094D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macGreek, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400B900B200C900B300D600DC038500E000E200E4038400A800E700E900E8..00EA00EB00A3212200EE00EF202200BD203000F400F600A600AD00F900FB00FC..2020039303940398039B039E03A000DF00AE00A903A303AA00A7226000B000B7..039100B12264226500A503920395039603970399039A039C03A603AB03A803A9..03AC039D00AC039F03A1224803A400AB00BB202600A003A503A7038603880153..20132015201C201D2018201900F70389038A038C038E03AD03AE03AF03CC038F..03CD03B103B203C803B

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\macIceland.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1115
                                                                                                                                                                                                                          Entropy (8bit):3.3991839018654573
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8KHVBUlJvRj7SOVbusZhAMiZyi77qscqMVmOZmk/LYRldjY/g4JyMWG:8KMlBVnrAMiwMmzqi/LYRlYBEXG
                                                                                                                                                                                                                          MD5:747ADBE54D6992467415E322326FA1B9
                                                                                                                                                                                                                          SHA1:5E3967B5DDF3A6DBF07E90ED6B9B9C2F3F3F35FE
                                                                                                                                                                                                                          SHA-256:6FD08CE6FBA521D51E8058DE5C2DBD6583B80306A8BE7D015361F76314E70A35
                                                                                                                                                                                                                          SHA-512:A04B946993985BF1F8FBA3A7A9AD3838F43F8F27F69B1FB1015D9DC8612AAFCE24E30CBC1FCABBDFB359FD487D51F70F18DA0CDA4A87749A2C82309CEB054849
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macIceland, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..00DD00B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204420AC00D000F000DE00FE..00FD00B7201A201E2

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\macJapan.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):48813
                                                                                                                                                                                                                          Entropy (8bit):3.3767502114972077
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:K/RPrUHiJrKWkyY/W2wHiwWnwWOORY+gutSJi:KVUidzJCurDGSk
                                                                                                                                                                                                                          MD5:3DCD22325E0194AAD4959C939B1DE24D
                                                                                                                                                                                                                          SHA1:ABEF1372FBDA83714CE29E015D9A198D4B37B21C
                                                                                                                                                                                                                          SHA-256:47007D9EBF4D34C6CE3599E50AFC7C1CF8129B88994DE2C2A857C09003F9CD2B
                                                                                                                                                                                                                          SHA-512:B8ADFD2315EA38E5F7D4DED219759380069AAB539F1B5AAA5626CE32428CBBEB5E8215AD8351E023BCF72FA4DC30AB40CF59D6D45E33B6D1A6B41BEBFD4BD4C2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macJapan, multi-byte..M..003F 0 46..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00A0FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\macRoman.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1113
                                                                                                                                                                                                                          Entropy (8bit):3.4060725247347516
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8THVBUlJvRj7SOVbusZhAMiZyi77qsTMVmOZmk/LYRldjBpmg4JyMWG:8TMlBVnrAMiwMmOi/LYRlTsBEXG
                                                                                                                                                                                                                          MD5:34691FADC788B85D98F63159640C7DD0
                                                                                                                                                                                                                          SHA1:C8B3D084D3E831EFF6ECEF71B2029545F214C3D4
                                                                                                                                                                                                                          SHA-256:C83D971D6BC0284EF323C197896E38C57A5FF44784E451EC2997EDA70C0DD85C
                                                                                                                                                                                                                          SHA-512:77D5676F9B7AF7FD1D612A1C426889D8F2C0191887E180B78C4AA42202928A1B3078B76BD3C5F5ABB2A5CE1AE913E3CA6EFDE0483D2A2B0EFC173EF25EAE1D67
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macRoman, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204420AC2039203AFB01FB02..202100B7201A201E203

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\macRomania.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1115
                                                                                                                                                                                                                          Entropy (8bit):3.412326247178521
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8tHVBUlJvRj7SOVbusZhAMiZyi77qsTMVZ5OZwYRldj/T9g4JyMWG:8tMlBVnrAMiwMmOA7YRlFT9BEXG
                                                                                                                                                                                                                          MD5:04E25073BFB0019D8381B72F7B433F00
                                                                                                                                                                                                                          SHA1:B63B0AD9F10A44B0DDD12A3BDBCDEB2992D6D385
                                                                                                                                                                                                                          SHA-256:0B805DAF21D37D702617A8C72C7345F857695108D905FF378791F291CEA150F0
                                                                                                                                                                                                                          SHA-512:0514EC054676C15C65B01B02747CDBAD79BC89FD1A24A17797A8729752FB748FEDBE920E7BBFF41A6DA4BA99002E3B8DB674D53E30485DC36F6BF737EAF11702
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macRomania, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A822600102015E..221E00B12264226500A500B522022211220F03C0222B00AA00BA21260103015F..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204400A42039203A01620163..202100B7201A201E2

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\macThai.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1112
                                                                                                                                                                                                                          Entropy (8bit):3.6062142626989004
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:88HVBUlJvRj7SOVbusZhAMiZyi77qqJipJwHmEU4AyqU+TpH:88MlBVnrAMiwMmqJ8Jf4AyqUe
                                                                                                                                                                                                                          MD5:06DC6BA6E4A75CD7FF2D7A4248912C61
                                                                                                                                                                                                                          SHA1:23FB16763A8F11EF48E805E4F453C2F812D48FC4
                                                                                                                                                                                                                          SHA-256:A1802A2FEB01B255EC7C17425EEE4525372DF8CE226F4047D149172EB438F913
                                                                                                                                                                                                                          SHA-512:41A487EC5C36C17B2746C5DC770882A836E6E75CF6A14C31595EB211022F0476BD3B953497C447F21554769F127C3A56E5B6EF8FB3C20A8AFF8C67E0CC94359D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macThai, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00AB00BB2026F88CF88FF892F895F898F88BF88EF891F894F897201C201DF899..FFFD2022F884F889F885F886F887F888F88AF88DF890F893F89620182019FFFD..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3AFEFF200B201320140E3F..0E400E410E420E430E44

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\macTurkish.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1115
                                                                                                                                                                                                                          Entropy (8bit):3.422718883614008
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8QjHVBUlJvRj7SOVbusZhAMiZyi77qsTMVmOZmk/LYRldD8g4JyS:88MlBVnrAMiwMmOi/LYRlWBES
                                                                                                                                                                                                                          MD5:4EA94A0DB35BED2081A2CC9D627A8180
                                                                                                                                                                                                                          SHA1:AB2AC3ADA19F3F656780FF876D5B536A8DCE92C6
                                                                                                                                                                                                                          SHA-256:AFB66138EBE9B87D8B070FE3B6E7D1A05ED508571E9E5B166C3314069D59B4E4
                                                                                                                                                                                                                          SHA-512:7888F560D3728732BE1B7DCE49ECB61F3399CEF11191F4116C891E1D147B2A90ED8FB4A5E7B51904A001C47750BD9EB1B15EA5BA5B4EC5D69CDE7704B69529AD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macTurkish, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178011E011F01300131015E015F..202100B7201A201E2

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\macUkraine.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1115
                                                                                                                                                                                                                          Entropy (8bit):3.4157626428238723
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8TzHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9a4piS1yk+5yye3cJd:8PMlBVnrAMiwMm8Y6zUk+UVsJd
                                                                                                                                                                                                                          MD5:A5B48D6F2678579CBE6EA094A4655071
                                                                                                                                                                                                                          SHA1:A13A41D530B21CE8443AFD7E811286537C5BA9C7
                                                                                                                                                                                                                          SHA-256:F7E11736C9FF30102B31EC72272754110193B347433F4B364921E8F131C92BF0
                                                                                                                                                                                                                          SHA-512:612F9D528CE940B5CA9E67CB127013A104655207511F4CF39C8696A127E6A8F4867F5603DCFB78C25A55668C6EE70F2997A8D1626F6F1DD44B19260967F17097
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macUkraine, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..202000B0049000A300A7202200B6040600AE00A9212204020452226004030453..221E00B122642265045600B504910408040404540407045704090459040A045A..0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455..20132014201C201D2018201900F7201E040E045E040F045F211604010451044F..04300431043204330

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\shiftjis.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42552
                                                                                                                                                                                                                          Entropy (8bit):3.5565924983274857
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:w/RPrUHiJrwWkyY/W2wHiwWnwWOORY+gutSX:wVUid5JCurDGSX
                                                                                                                                                                                                                          MD5:EEB45AF9D7104872FE290D1EC18AB169
                                                                                                                                                                                                                          SHA1:A80CF4EA46301F0B8B4F0BC306270D7103753871
                                                                                                                                                                                                                          SHA-256:4A15ED210126BCDAE32543F60EB1A0677F985F32D49FCE923B9FAE8C5BCF3DA4
                                                                                                                                                                                                                          SHA-512:C359042B04441AA50E536B23EEA0C6C7B2C1893DFB9CDB5459D3B46945D3BB50FD7A32A4F4E26A83622E76D3D2BB0DBBC3D1F3FB87AAF40520A243165B82AB34
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: shiftjis, multi-byte..M..003F 0 40..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000850086008700000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\symbol.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1111
                                                                                                                                                                                                                          Entropy (8bit):3.73983895892791
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:SdHkUlJvRjvRV7ZQsoRmSds2AsSemxUs+Jw1Viv6ObTXyn:avlJV7ZQsoRmosGSPxU/JOm6wTXyn
                                                                                                                                                                                                                          MD5:D59E748D863A5FAEF0CEEC2564E041A3
                                                                                                                                                                                                                          SHA1:4FFF3BE37F50C090FFC581F1C7769E20281E90C3
                                                                                                                                                                                                                          SHA-256:9660537A7B62996478555C6F57C1962C78FB3972F19370B2E395C44842818A1F
                                                                                                                                                                                                                          SHA-512:BF8FD0CF1CC55564C46976F53F441B26819ADBA7AB7BB04FF3FF5A313366FC3049DF29A839CCCB05EDEF4A7ECBB49FFCA62518EDA90AF2D7781874A8435073AE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: symbol, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002122000023220300250026220D002800292217002B002C2212002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..22450391039203A70394039503A603930397039903D1039A039B039C039D039F..03A0039803A103A303A403A503C203A9039E03A80396005B2234005D22A5005F..F8E503B103B203C703B403B503C603B303B703B903D503BA03BB03BC03BD03BF..03C003B803C103C303C403C503D603C903BE03C803B6007B007C007D223C007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..000003D2203222642044221E0192266326662665266021942190219121922193..00B000B12033226500D7221D2202202200F72260226122482026F8E6F8E721B5..21352111211C21182297229522052229222A2283228722842282228622082209..2220220700AE00A92122220F221A22C500AC2227222821D421D021D121D221D3..22C42329F8E8F8E9F8EA2

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\encoding\tis-620.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1112
                                                                                                                                                                                                                          Entropy (8bit):3.0553142874336943
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:ZlHVBUlJvRj7SOVbusZhAMiZyi77qsDHmEU4AyqU+TWwdd:PMlBVnrAMiwMmss4AyqUSd
                                                                                                                                                                                                                          MD5:467A67DE6809B796B914F5BFF98EF46D
                                                                                                                                                                                                                          SHA1:C62418071A6C9CB0DCE3F67E130BFD2FB7AB0B58
                                                                                                                                                                                                                          SHA-256:50B62381D6EDD4219F4292BFDC365954491B23360DE7C08033E7218A3D29C970
                                                                                                                                                                                                                          SHA-512:BF98305AA7D759A087B9EABDC404714D8DC6B4F1BEED4ED0E1FFE646641E1AECA307673D64CF95FD09546D977B3409D6C04F56DCCA1D6332B0D9B6DD460B77A9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: tis-620, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E0000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430E44

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\history.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8235
                                                                                                                                                                                                                          Entropy (8bit):4.855903177272536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Hf8PxPu7pUHBpqyzmY5rEk/fvs+AokFlTGHts1H/tsEGZPBtsLIVn++G:H6Pu7ELJTtyli8Ozz+L
                                                                                                                                                                                                                          MD5:8609B624CD3EC63DD02DBF89455C3A9B
                                                                                                                                                                                                                          SHA1:B3E1843E34C38AA668FFDDF435A1A65D55449CA0
                                                                                                                                                                                                                          SHA-256:5123DB837EADF45712EA7D449BC40BFD3E8E16D3D71E7D0CE9A32F164973D767
                                                                                                                                                                                                                          SHA-512:B20B75473F34209888F38EE570B8A96061760E88466DFC2EC55C814968DC7F67D92D255E8635188B60455B88F2D1D517747613AD0F366D60412D2D6ECE231B0E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# history.tcl --..#..# Implementation of the history command...#..# Copyright (c) 1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#.....# The tcl::history array holds the history list and some additional..# bookkeeping variables...#..# nextid.the index used for the next history list item...# keep..the max size of the history list..# oldest.the index of the oldest item in the history.....namespace eval ::tcl {.. variable history.. if {![info exists history]} {...array set history {... nextid.0... keep.20... oldest.-20...}.. }.... namespace ensemble create -command ::tcl::history -map {...add.::tcl::HistAdd...change.::tcl::HistChange...clear.::tcl::HistClear...event.::tcl::HistEvent...info.::tcl::HistInfo...keep.::tcl::HistKeep...nextid.::tcl::HistNextID...redo.::tcl::HistRedo.. }..}.....# history --..#..#.This is the main history command. See the

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\http1.0\http.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10066
                                                                                                                                                                                                                          Entropy (8bit):4.806771544139381
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:kipkqA3KsZMAikGJ4kIWPa95KTBoF7dg/8YNkgQ4id:TkqWKsZ8kGJ4kIWPaDFzTd
                                                                                                                                                                                                                          MD5:C2092F8CA2D761DFA8C461076D956374
                                                                                                                                                                                                                          SHA1:90B4648B3BC81C30465B0BE83A5DB4127A1392FB
                                                                                                                                                                                                                          SHA-256:8C474095A3ABA7DF5B488F3D35240D6DE729E57153980C2A898728B8C407A727
                                                                                                                                                                                                                          SHA-512:09CE408886E2CEADDF70786A15D63AF9A930E70CAC4286AC9DDD2094C8EDCF97A2ADC2D3D2659B123F88719340D3B00D9F96E9BC7C8B55192735C290E7D24683
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# http.tcl..# Client-side HTTP for GET, POST, and HEAD commands...# These routines can be used in untrusted code that uses the Safesock..# security policy...# These procedures use a callback interface to avoid using vwait,..# which is not defined in the safe base...#..# See the http.n man page for documentation....package provide http 1.0....array set http {.. -accept */*.. -proxyhost {}.. -proxyport {}.. -useragent {Tcl http client package 1.0}.. -proxyfilter httpProxyRequired..}..proc http_config {args} {.. global http.. set options [lsort [array names http -*]].. set usage [join $options ", "].. if {[llength $args] == 0} {...set result {}...foreach name $options {... lappend result $name $http($name)...}...return $result.. }.. regsub -all -- - $options {} options.. set pat ^-([join $options |])$.. if {[llength $args] == 1} {...set flag [lindex $args 0]...if {[regexp -- $pat $flag]} {... return $http($flag)...} else {... return -code er

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\http1.0\pkgIndex.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):746
                                                                                                                                                                                                                          Entropy (8bit):4.711041943572035
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:jHx5XRsLzhjJS42wbGlTULuUAZb3KykszLl7+HkuRz20JSv6C3l5kMn:bHRsRJS42wbGlTUcZ+yk2Lli1z2jxXkM
                                                                                                                                                                                                                          MD5:A387908E2FE9D84704C2E47A7F6E9BC5
                                                                                                                                                                                                                          SHA1:F3C08B3540033A54A59CB3B207E351303C9E29C6
                                                                                                                                                                                                                          SHA-256:77265723959C092897C2449C5B7768CA72D0EFCD8C505BDDBB7A84F6AA401339
                                                                                                                                                                                                                          SHA-512:7AC804D23E72E40E7B5532332B4A8D8446C6447BB79B4FE32402B13836079D348998EA0659802AB0065896D4F3C06F5866C6B0D90BF448F53E803D8C243BBC63
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Tcl package index file, version 1.0..# This file is generated by the "pkg_mkIndex" command..# and sourced either when an application starts up or..# by a "package unknown" script. It invokes the..# "package ifneeded" command to set up package-related..# information so that packages will be loaded automatically..# in response to "package require" commands. When this..# script is sourced, the variable $dir must contain the..# full path name of this file's directory.....package ifneeded http 1.0 [list tclPkgSetup $dir http 1.0 {{http.tcl source {httpCopyDone httpCopyStart httpEof httpEvent httpFinish httpMapReply httpProxyRequired http_code http_config http_data http_formatQuery http_get http_reset http_size http_status http_wait}}}]..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\init.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25633
                                                                                                                                                                                                                          Entropy (8bit):4.885492991636381
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:cXugPHudKlExBG+Xg3Qonlm6ofRRECLSQDjr5vkhzx/i:hgGdKli4eonlm6offLzehNi
                                                                                                                                                                                                                          MD5:FE92C81BB4ACDDA00761C695344D5F1E
                                                                                                                                                                                                                          SHA1:A87E1516FBD1F9751EC590273925CBC5284B16BD
                                                                                                                                                                                                                          SHA-256:7A103A85413988456C2AD615C879BBCB4D91435BCFBBE23393E0EB52B56AF6E2
                                                                                                                                                                                                                          SHA-512:C983076E420614D12AB2A7342F6F74DD5DCDAD21C7C547F660E73B74B3BE487A560ABD73213DF3F58BE3D9DBD061A12D2956CA85A58D7B9D9E40D9FA6E6C25EB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# init.tcl --..#..# Default system startup file for Tcl-based applications. Defines..# "unknown" procedure and auto-load facilities...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 1998-1999 Scriptics Corporation...# Copyright (c) 2004 Kevin B. Kenny. All rights reserved...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# This test intentionally written in pre-7.5 Tcl..if {[info commands package] == ""} {.. error "version mismatch: library\nscripts expect Tcl version 7.5b1 or later but the loaded version is\nonly [info patchlevel]"..}..package require -exact Tcl 8.6.13....# Compute the auto path to use in this interpreter...# The values on the path come from several locations:..#..# The environment variable TCLLIBPATH..#..# tcl_library, which is the directory containing this init.tcl script...# [t

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\af.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1038
                                                                                                                                                                                                                          Entropy (8bit):4.10054496357204
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLB383Hcm0hH9BncmtR7tK9dUVxMmALfpKIdzVJLd3xfjTuLM+vzkHWZ6tH9H0:4aR838HH9ekCkMmEfpK2xx2jiWZ0VbY
                                                                                                                                                                                                                          MD5:DA8BA1C3041998F5644382A329C3C867
                                                                                                                                                                                                                          SHA1:CA0BD787A51AD9EDC02EDD679EEEEB3A2932E189
                                                                                                                                                                                                                          SHA-256:A1EACA556BC0CFBD219376287C72D9DBBFAB76ECF9BF204FD02D40D341BAF7DA
                                                                                                                                                                                                                          SHA-512:4F086396405FDFE7FBDA7614D143DE9DB41F75BDBD3DB18B1EE9517C3DCCED238DD240B4B64829FD04E50F602DBF371D42A321D04C4C48E4B8B2A067CA1BAF2E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset af DAYS_OF_WEEK_ABBREV [list \.. "So"\.. "Ma"\.. "Di"\.. "Wo"\.. "Do"\.. "Vr"\.. "Sa"].. ::msgcat::mcset af DAYS_OF_WEEK_FULL [list \.. "Sondag"\.. "Maandag"\.. "Dinsdag"\.. "Woensdag"\.. "Donderdag"\.. "Vrydag"\.. "Saterdag"].. ::msgcat::mcset af MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset af MONTHS_FULL [list \.. "Januarie"\.. "Februarie"\.. "Maart"\.. "April"\.. "Mei"\.. "Junie"\.. "Julie"\.. "Augustus"\.. "September"\.. "Oktober"\.. "November"\.. "Desember"\.. ""].. ::msgcat::mcset af AM "VM

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\af_za.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.925537696653838
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xouFygMouFqF3v6ay/5ouFy9+3vR6HyFvn:4EnLB383RAgeYF3v6ay/RAI3voSVn
                                                                                                                                                                                                                          MD5:1B9DCD1C6FCDDC95AE820EA8DA5E15B8
                                                                                                                                                                                                                          SHA1:E8160353FD415BAB9FD5ACCA14E087C5E6AE836E
                                                                                                                                                                                                                          SHA-256:1548988458BBF0DFCCC23B7487CEC0E9C64E4CC8E045723E50BEC37C454A8C81
                                                                                                                                                                                                                          SHA-512:532AF060B95AED5E381B161BE56BC88D91A8F3DF2ACFD835491991F99FE752ADB4A3F93AB6D4E68F7042C28A3C1DD87A6312DFD9FFFAFD6ECE3F1B76837C5B7F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset af_ZA DATE_FORMAT "%d %B %Y".. ::msgcat::mcset af_ZA TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset af_ZA DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ar.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2018
                                                                                                                                                                                                                          Entropy (8bit):4.477377447232708
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83gr/fsS/Sm8p4M/n1KsPktE30AiJcAxi9CEzdEvSCHvMSV:43UkiSm8p3nX0EzdCSCPV
                                                                                                                                                                                                                          MD5:D264D01B46D96455715114CAEDF9F05E
                                                                                                                                                                                                                          SHA1:A3F68A4C6E69433BD53E52B73041575F3B3AC3F2
                                                                                                                                                                                                                          SHA-256:B69D0061A728D59F89FF8621312789CD9F540BF2E2ED297804D22F6278561D85
                                                                                                                                                                                                                          SHA-512:A4163DAA6821B293EADD5D499E0641A8B7C93180C710D6B364AE8681A8FF6F35EC948C8DDBE960A8466AF1ACABC15B0D465A08B084617E8005D708459F7E74D3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar DAYS_OF_WEEK_ABBREV [list \.. "\u062d"\.. "\u0646"\.. "\u062b"\.. "\u0631"\.. "\u062e"\.. "\u062c"\.. "\u0633"].. ::msgcat::mcset ar DAYS_OF_WEEK_FULL [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar MONTHS_ABBREV [list \.. "\u064a\u0646\u0627"\.. "\u0641\u0628\u0631"\.. "\u0645\u0627\u0631"\.. "\u0623\u0628\u0631"\.. "\u0645\u0627\u064a"\.. "\u064a\u0648\u0646"\.. "\u064a\u0648\u0644"\.. "\u0623\u063a\u0633"\.. "\u0633\u0628\u062a"\..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ar_in.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):265
                                                                                                                                                                                                                          Entropy (8bit):4.872222510420193
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoKNvfcoKU3v6xyFjoKNo+3vfXM68vn:4EnLB3831vfD3v6g9F3vfc6+n
                                                                                                                                                                                                                          MD5:430498B4AB1E77C86BC1311A49747581
                                                                                                                                                                                                                          SHA1:684EAD965D9010C2A6E73DCACB2224FDE585F9FF
                                                                                                                                                                                                                          SHA-256:2E04B96DA002519D28125918A22FF2BB9659A668A7BCAD34D85DDDECEC8DC0B4
                                                                                                                                                                                                                          SHA-512:9F85A88A383DCFC54DAA6253D94C307A14B1CC91D5C97AF817B8122AF98025AB2430D0B2D656EBED09E78FB854D1F9CF99F3B791A6ECB7834112012739140126
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_IN DATE_FORMAT "%A %d %B %Y".. ::msgcat::mcset ar_IN TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset ar_IN DATE_TIME_FORMAT "%A %d %B %Y %I:%M:%S %z %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ar_jo.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1851
                                                                                                                                                                                                                          Entropy (8bit):4.08645484776227
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83sxS/Sm819+es/Ii/R91bpH0+U0c+es/Ii/R91bpH0+UO:43wiSm815MbJbHgMbJbp
                                                                                                                                                                                                                          MD5:5C62D606F4F14BC8994B28F9622D70DD
                                                                                                                                                                                                                          SHA1:E99F8CC5D330085545B05B69213E9D011D436990
                                                                                                                                                                                                                          SHA-256:5ADBB3D37C3369E5FC80D6A462C82598D5A22FAEF0E8DF6B3148231D2C6A7F73
                                                                                                                                                                                                                          SHA-512:81AC9200459B0896E27A028BD089A174F7F921B0367BC8FF1AB33D3E561417B6F8EC23DAB750ECB408AC8A11CDFDBFA4F890F9E723BB8607B017C9FEE00928A0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_JO DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_JO MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ar_lb.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1851
                                                                                                                                                                                                                          Entropy (8bit):4.083347689510237
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83LxS/Sm8S9+es/Ii/R91bpH0+U/c+es/Ii/R91bpH0+UO:431iSm8S5MbJbQgMbJbp
                                                                                                                                                                                                                          MD5:6FC1CC738207E2F8E0871103841BC0D4
                                                                                                                                                                                                                          SHA1:D2C62C7F6DA1EF399FCBE2BA91C9562C87E6152F
                                                                                                                                                                                                                          SHA-256:1FC13070CF661488E90FECE84274C46B1F4CC7E1565EAB8F829CCAA65108DFCA
                                                                                                                                                                                                                          SHA-512:E547D5CBB746654051AFDA21942075BC2224C2FF75D440C6C34C642AD24CF622E520FF919B8BD4AFC0116D9CE69B3ABA4E81EE247C1388F3C5741150201F5C60
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_LB DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_LB MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ar_sy.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1851
                                                                                                                                                                                                                          Entropy (8bit):4.084701680556524
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83lxS/Sm8M9+es/Ii/R91bpH0+UBc+es/Iv/I91bpH0+UO:43LiSm8M5MbJbSgMo0bp
                                                                                                                                                                                                                          MD5:8188C37CA44FEFFF8D895AAD503AD4F6
                                                                                                                                                                                                                          SHA1:C48F2E3B9FC055704D2DAFDC67E9D08EE6897D45
                                                                                                                                                                                                                          SHA-256:294F3E46C55453EDAD44567E1330F9B43E69A07FA0655B24DD2780A4490C1194
                                                                                                                                                                                                                          SHA-512:F86FCFC7C460473D46C472041AB2E1F9388CF34BCA9050295D1DAE454E35A2A0320D0C61D5E8CBB832AF74FFDD1A7511AF32EA2A53B481F39A1CBCF5F086D514
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_SY DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_SY MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\be.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2157
                                                                                                                                                                                                                          Entropy (8bit):4.27810535662921
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:43PI8IKQGQ8mA/XxQJxQnA9QJlPyI/tbCaQICMIcQ8InVI5tNIzQFIQQLtChjsI4:2PItK5BSb9ajfycCW5IzdQNxK
                                                                                                                                                                                                                          MD5:6334BDDFC1E0EAE4DBB2C90F85818FD8
                                                                                                                                                                                                                          SHA1:085EDC3D027D6B5A6A6A2561717EA89C8F8B8B39
                                                                                                                                                                                                                          SHA-256:A636A82C7D00CCDC0AF2496043FFA320F17B0D48A1232708810D3BB1453E881E
                                                                                                                                                                                                                          SHA-512:18ADB77314FCFD534E55B234B3A53A0BC572AB60B80D099D2F3B20E0C5FE66179FDC076AA43200DB3CA123BC6216989EC41448FA624D3BA9633413AD8AD6034C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset be DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0434"\.. "\u043f\u043d"\.. "\u0430\u0442"\.. "\u0441\u0440"\.. "\u0447\u0446"\.. "\u043f\u0442"\.. "\u0441\u0431"].. ::msgcat::mcset be DAYS_OF_WEEK_FULL [list \.. "\u043d\u044f\u0434\u0437\u0435\u043b\u044f"\.. "\u043f\u0430\u043d\u044f\u0434\u0437\u0435\u043b\u0430\u043a"\.. "\u0430\u045e\u0442\u043e\u0440\u0430\u043a"\.. "\u0441\u0435\u0440\u0430\u0434\u0430"\.. "\u0447\u0430\u0446\u0432\u0435\u0440"\.. "\u043f\u044f\u0442\u043d\u0456\u0446\u0430"\.. "\u0441\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset be MONTHS_ABBREV [list \.. "\u0441\u0442\u0434"\.. "\u043b\u044e\u0442"\.. "\u0441\u043a\u0432"\.. "\u043a\u0440\u0441"\.. "\u043c\u0430\u0439"\.. "\u0447\u0440\u0432"\.. "\u043b\u043f\u043d"

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\bg.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1871
                                                                                                                                                                                                                          Entropy (8bit):4.4251657008559935
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:43EUAIlnQf/QVdQ81mnEZqEavWQEQ3QvQrQL0QjQTtQDCQSY4tqP:27xMk+nEZqE3biIYbUi+C9y
                                                                                                                                                                                                                          MD5:E5225D6478C60E2502D18698BB917677
                                                                                                                                                                                                                          SHA1:52D611CB5351FB873D2535246B3A3C1A37094023
                                                                                                                                                                                                                          SHA-256:CFE4E44A3A751F113847667EC9EA741E762BBDE0D4284822CB337DF0F92C1ACA
                                                                                                                                                                                                                          SHA-512:59AB167177101088057BF4EE0F70262987A2177ECB72C613CCAAE2F3E8D8B77F07D15DA5BE3B8728E23C31A1C9736030AA4036A8CD00A24791751A298B3A88B3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bg DAYS_OF_WEEK_ABBREV [list \.. "\u041d\u0434"\.. "\u041f\u043d"\.. "\u0412\u0442"\.. "\u0421\u0440"\.. "\u0427\u0442"\.. "\u041f\u0442"\.. "\u0421\u0431"].. ::msgcat::mcset bg DAYS_OF_WEEK_FULL [list \.. "\u041d\u0435\u0434\u0435\u043b\u044f"\.. "\u041f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\.. "\u0412\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0421\u0440\u044f\u0434\u0430"\.. "\u0427\u0435\u0442\u0432\u044a\u0440\u0442\u044a\u043a"\.. "\u041f\u0435\u0442\u044a\u043a"\.. "\u0421\u044a\u0431\u043e\u0442\u0430"].. ::msgcat::mcset bg MONTHS_ABBREV [list \.. "I"\.. "II"\.. "III"\.. "IV"\.. "V"\.. "VI"\.. "VII"\.. "VIII"\.. "IX"\.. "X"\.. "XI"\.. "XII"\.. ""].. ::msgcat::mcset bg MO

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\bn.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2335
                                                                                                                                                                                                                          Entropy (8bit):4.107102006297273
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR835e/MWrD//6HFEVcVVcCVcTUTVckVEVcT7VcEEVcby/Vcn0VcMr/0VcM8VcQ:43ktX++QalMObalMZ6IE6V
                                                                                                                                                                                                                          MD5:5D25E7FC65824AC987535FEA14A4045C
                                                                                                                                                                                                                          SHA1:85C10F05823CD3263FC7B3EC38796BEC261B3716
                                                                                                                                                                                                                          SHA-256:890EA6521DEB1B3C3913CCD92562F6360E064DAEE2E2B0356A6DD97A46264A1F
                                                                                                                                                                                                                          SHA-512:5D8A88ACAEBBF3CD721F288FA0F1FEE517EE568CA5482E30CFA1E36CD37DF011C449090E2D9041F1D046A191F13D4C5C4B6F9E2F16FD259E63CE46ECC4E4F81F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bn DAYS_OF_WEEK_ABBREV [list \.. "\u09b0\u09ac\u09bf"\.. "\u09b8\u09cb\u09ae"\.. "\u09ae\u0999\u0997\u09b2"\.. "\u09ac\u09c1\u09a7"\.. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf"\.. "\u09b6\u09c1\u0995\u09cd\u09b0"\.. "\u09b6\u09a8\u09bf"].. ::msgcat::mcset bn DAYS_OF_WEEK_FULL [list \.. "\u09b0\u09ac\u09bf\u09ac\u09be\u09b0"\.. "\u09b8\u09cb\u09ae\u09ac\u09be\u09b0"\.. "\u09ae\u0999\u0997\u09b2\u09ac\u09be\u09b0"\.. "\u09ac\u09c1\u09a7\u09ac\u09be\u09b0"\.. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf\u09ac\u09be\u09b0"\.. "\u09b6\u09c1\u0995\u09cd\u09b0\u09ac\u09be\u09b0"\.. "\u09b6\u09a8\u09bf\u09ac\u09be\u09b0"].. ::msgcat::mcset bn MONTHS_ABBREV [list \.. "\u099c\u09be\u09a8\u09c1\u09df\u09be\u09b0\u09c0"\.. "\u09ab\u09c7\u09ac\u09cd\u09b0\u09c1\u09df\u09be

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\bn_in.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):265
                                                                                                                                                                                                                          Entropy (8bit):4.868201122972066
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xovtvfluo/E3v6xyFjovto+3vflm68vn:4EnLB383UtvfltE3v6g8tF3vflm6+n
                                                                                                                                                                                                                          MD5:B91BB2ABC23B90962D2070B9588F2AB5
                                                                                                                                                                                                                          SHA1:CBB4E9CD600773792C6E9F3E6B27E99C1846B44F
                                                                                                                                                                                                                          SHA-256:B3D8A4632290B0F3DA690E47C1FDF06A8B9E171A96E938AFDB0DD52CF806CE54
                                                                                                                                                                                                                          SHA-512:932FC4B8C3CA72731187D56012AD7DD7777C4D447F16EEB17B9D68235C9590DF99992FD22B8D7C85A843A610F93CD36FAFA993C34C441255A1C0A93C73BC5FE4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bn_IN DATE_FORMAT "%A %d %b %Y".. ::msgcat::mcset bn_IN TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset bn_IN DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ca.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1152
                                                                                                                                                                                                                          Entropy (8bit):4.2880653012847985
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83FMVBNfPg+g+RjMu5+C6MB4zdiwvWvn:432g6jh65zd3gn
                                                                                                                                                                                                                          MD5:72DDD60C907DD235BCE4AB0A5AEE902C
                                                                                                                                                                                                                          SHA1:06150F793251687E6FBC3FDA3BC81BCBFC7DE763
                                                                                                                                                                                                                          SHA-256:3BE295DCC8FCDC767FED0C68E3867359C18E7E57D7DB6C07236B5BC572AD328E
                                                                                                                                                                                                                          SHA-512:3B0A85003692F1E46185D5CC09236D2DA5E6D29166C9812D07A7D6BF6AC6C3B0708F91C6899768D4DBA3528081B8B43E09F49622B70F1CF991AFAC5352B6BA37
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ca DAYS_OF_WEEK_ABBREV [list \.. "dg."\.. "dl."\.. "dt."\.. "dc."\.. "dj."\.. "dv."\.. "ds."].. ::msgcat::mcset ca DAYS_OF_WEEK_FULL [list \.. "diumenge"\.. "dilluns"\.. "dimarts"\.. "dimecres"\.. "dijous"\.. "divendres"\.. "dissabte"].. ::msgcat::mcset ca MONTHS_ABBREV [list \.. "gen."\.. "feb."\.. "mar\u00e7"\.. "abr."\.. "maig"\.. "juny"\.. "jul."\.. "ag."\.. "set."\.. "oct."\.. "nov."\.. "des."\.. ""].. ::msgcat::mcset ca MONTHS_FULL [list \.. "gener"\.. "febrer"\.. "mar\u00e7"\.. "abril"\.. "maig"\.. "juny"\.. "juliol"\.. "agost"\.. "setembre"\.. "octubre"\.. "novembre"\.. "desembre"\.. ""].. ::msg

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\cs.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1354
                                                                                                                                                                                                                          Entropy (8bit):4.466447248030554
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83U4nZ4yJTkkG3mYWEZqO1R3DNBEVG+PYhxrU4UF3ecCvt7/v3e6:43TJTGmnEZqE5/EVEDOGtDp
                                                                                                                                                                                                                          MD5:F32EAD82CC26754C5A8E092873A28DB3
                                                                                                                                                                                                                          SHA1:325124660F62242B24623B4B737CB4616F86CFF3
                                                                                                                                                                                                                          SHA-256:AFEA12A16A6FA750EA610245133B90F178BA714848F89AEC37429A3E7B06BE1A
                                                                                                                                                                                                                          SHA-512:04E335AAFBF4D169983635FC87BCFFE86FBA570A3E1820D20240EF7B47E7A3CD94AE3598543DCE92A1F82B5146CAAD982EFE9490EFD9E581D58515CFC3930581
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset cs DAYS_OF_WEEK_ABBREV [list \.. "Ne"\.. "Po"\.. "\u00dat"\.. "St"\.. "\u010ct"\.. "P\u00e1"\.. "So"].. ::msgcat::mcset cs DAYS_OF_WEEK_FULL [list \.. "Ned\u011ble"\.. "Pond\u011bl\u00ed"\.. "\u00dater\u00fd"\.. "St\u0159eda"\.. "\u010ctvrtek"\.. "P\u00e1tek"\.. "Sobota"].. ::msgcat::mcset cs MONTHS_ABBREV [list \.. "I"\.. "II"\.. "III"\.. "IV"\.. "V"\.. "VI"\.. "VII"\.. "VIII"\.. "IX"\.. "X"\.. "XI"\.. "XII"\.. ""].. ::msgcat::mcset cs MONTHS_FULL [list \.. "leden"\.. "\u00fanor"\.. "b\u0159ezen"\.. "duben"\.. "kv\u011bten"\.. "\u010derven"\.. "\u010dervenec"\.. "srpen"\.. "z\u00e1\u0159\u00ed"\.. "\u0159\u00edjen"\..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\da.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1208
                                                                                                                                                                                                                          Entropy (8bit):4.315504392809956
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83wV0tBVYuorIsmZ5meAxyISjTHU92WFVwpwvbvT:43w+DiuorreAY0zw8rT
                                                                                                                                                                                                                          MD5:27A6A8BE8903AEF9D0BE956906A89583
                                                                                                                                                                                                                          SHA1:EE29FDF67CB3AE150DF6BBBE603C1C3F5DA28641
                                                                                                                                                                                                                          SHA-256:0D422A991BCA13FE9033118691CFEDAB0F372222EBB0BC92BAF8E914EE816B84
                                                                                                                                                                                                                          SHA-512:0E702A679AD94BF479226B7DE32077562F3F95210F6453AE564138386DBB179941BA5359AEE9AC532F4A6E5BE745D6962D6B638A21DD48B865716F2FD2A0CB01
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset da DAYS_OF_WEEK_ABBREV [list \.. "s\u00f8"\.. "ma"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f8"].. ::msgcat::mcset da DAYS_OF_WEEK_FULL [list \.. "s\u00f8ndag"\.. "mandag"\.. "tirsdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f8rdag"].. ::msgcat::mcset da MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset da MONTHS_FULL [list \.. "januar"\.. "februar"\.. "marts"\.. "april"\.. "maj"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset da B

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\de.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1276
                                                                                                                                                                                                                          Entropy (8bit):4.349293509679722
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83cFNSsZKKgXum47fpK2OaSIui7dHqWZ0ZIBFJWJvvvWIn:43InZKKgXoOqx1W67W9XWIn
                                                                                                                                                                                                                          MD5:EE3963A5F7E29C05C9617BE3FD897114
                                                                                                                                                                                                                          SHA1:0F978CA174DF596817F872B5EF1B447B9DFE651C
                                                                                                                                                                                                                          SHA-256:4C27733502066E8391654D1D372F92BF0484C5A3821E121AE8AA5B99378C99AE
                                                                                                                                                                                                                          SHA-512:EA933709C68F8199858A1CC1FFDA67EE7458CC57A163E672535EB0B4C37BFDC200604C7506748DAC3158B6CA63C2F076A2C6252B2A596E59F83D3B1D4BC9C901
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de DAYS_OF_WEEK_ABBREV [list \.. "So"\.. "Mo"\.. "Di"\.. "Mi"\.. "Do"\.. "Fr"\.. "Sa"].. ::msgcat::mcset de DAYS_OF_WEEK_FULL [list \.. "Sonntag"\.. "Montag"\.. "Dienstag"\.. "Mittwoch"\.. "Donnerstag"\.. "Freitag"\.. "Samstag"].. ::msgcat::mcset de MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mrz"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::msgcat::mcset de BCE "v.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\de_at.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):847
                                                                                                                                                                                                                          Entropy (8bit):4.412930056658995
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR831sMm47fpK2++SIui7dHqWZ0ZItovGvzvW:431h+mx1Wm+QjW
                                                                                                                                                                                                                          MD5:A6227CD4F7434952D093F1F3C64B4378
                                                                                                                                                                                                                          SHA1:0DDB9A49CB83DDF2396B2ECA85093260710496C2
                                                                                                                                                                                                                          SHA-256:1C02D14140196623297F858E2EEF00B4159E1C6FAFE044EC65A48C9C24D46540
                                                                                                                                                                                                                          SHA-512:D63F34024356F5CE0335D14EA557F4BBF238CCA8265DD27C039C70F7F28FE737F368B030DEE10B2C536512D2815E1F5B19838D08745C6A76A39050D573597EB3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de_AT MONTHS_ABBREV [list \.. "J\u00e4n"\.. "Feb"\.. "M\u00e4r"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de_AT MONTHS_FULL [list \.. "J\u00e4nner"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::msgcat::mcset de_AT DATE_FORMAT "%Y-%m-%d".. ::msgcat::mcset de_AT TIME_FORMAT "%T".. ::msgcat::mcset de_AT TIME_FORMAT_12 "%T".. ::msgcat::mcset de_AT DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\de_be.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1276
                                                                                                                                                                                                                          Entropy (8bit):4.389082225723362
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83B8VSysVB8VsZKKgJ5Mm47fpK26aSIui7dHqWZ0ZIlj5VevjevbDvW:43Bt1VBbZKKgJs6qx1Wc5VojobzW
                                                                                                                                                                                                                          MD5:C351057D8E5328C0790901D1F4DBEC9F
                                                                                                                                                                                                                          SHA1:F73DE8AEF7F8083B0726760AA003E81067A68588
                                                                                                                                                                                                                          SHA-256:532845CD15EC821C1939D000C648694A64E8CA8F0C14BAD5D79682CF991481CE
                                                                                                                                                                                                                          SHA-512:8152AD082D0A6A4EBE7E1CCA9D4A5F2E48ABE3F09F4385A517C523A67CA3B08E0F20C193D0F6850F37E55ED0CD6FBD201FE22CC824AF170976D04DB061212F2D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de_BE DAYS_OF_WEEK_ABBREV [list \.. "Son"\.. "Mon"\.. "Die"\.. "Mit"\.. "Don"\.. "Fre"\.. "Sam"].. ::msgcat::mcset de_BE DAYS_OF_WEEK_FULL [list \.. "Sonntag"\.. "Montag"\.. "Dienstag"\.. "Mittwoch"\.. "Donnerstag"\.. "Freitag"\.. "Samstag"].. ::msgcat::mcset de_BE MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "M\u00e4r"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de_BE MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::m

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\el.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2304
                                                                                                                                                                                                                          Entropy (8bit):4.371322909589862
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR833v+ZYYWtv+nWfFyL1NYOg+EKVJQ19tWQYmYaYRn9sWuSAJIJ6eRa6WrmdlX:43/pZyLjY0uYR9QmdkjC9r
                                                                                                                                                                                                                          MD5:7DD14B1F4FF532DCAF6D4C6F0DF82E9A
                                                                                                                                                                                                                          SHA1:707875FEF4207EBB71D066FDC54C7F68560C6DAD
                                                                                                                                                                                                                          SHA-256:8B23E0E2F0F319BB9A2DFDCCDC565FF79A62FA85094811189B6BC41594232B6B
                                                                                                                                                                                                                          SHA-512:5ECA072DE5DD7890270AE268C7C8D40EE2DB6966643604D16E54194DB0AD74FDA8D04848331E61B387E8B494AF18252E38671D939069EC4C90C672A629563B88
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset el DAYS_OF_WEEK_ABBREV [list \.. "\u039a\u03c5\u03c1"\.. "\u0394\u03b5\u03c5"\.. "\u03a4\u03c1\u03b9"\.. "\u03a4\u03b5\u03c4"\.. "\u03a0\u03b5\u03bc"\.. "\u03a0\u03b1\u03c1"\.. "\u03a3\u03b1\u03b2"].. ::msgcat::mcset el DAYS_OF_WEEK_FULL [list \.. "\u039a\u03c5\u03c1\u03b9\u03b1\u03ba\u03ae"\.. "\u0394\u03b5\u03c5\u03c4\u03ad\u03c1\u03b1"\.. "\u03a4\u03c1\u03af\u03c4\u03b7"\.. "\u03a4\u03b5\u03c4\u03ac\u03c1\u03c4\u03b7"\.. "\u03a0\u03ad\u03bc\u03c0\u03c4\u03b7"\.. "\u03a0\u03b1\u03c1\u03b1\u03c3\u03ba\u03b5\u03c5\u03ae"\.. "\u03a3\u03ac\u03b2\u03b2\u03b1\u03c4\u03bf"].. ::msgcat::mcset el MONTHS_ABBREV [list \.. "\u0399\u03b1\u03bd"\.. "\u03a6\u03b5\u03b2"\.. "\u039c\u03b1\u03c1"\.. "\u0391\u03c0\u03c1"\.. "\u039c\u03b1\u03ca"\.. "\u0399\u03bf\u

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\en_au.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):307
                                                                                                                                                                                                                          Entropy (8bit):4.896073290907262
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoCwmGjbmvFjoCws6W3v1oCws6W3v6p6HyFjoCwmT+3vjbe:4EnLB383QrmdSs6W3vss6W3v6QSoJ3ve
                                                                                                                                                                                                                          MD5:5B31AD8AC0000B01C4BD04BF6FC4784C
                                                                                                                                                                                                                          SHA1:F55145B473DDCAE38A0F7297D58B80B12B2A5271
                                                                                                                                                                                                                          SHA-256:705C66C14B6DE682EC7408EABDBA0800C626629E64458971BC8A4CBD3D5DB111
                                                                                                                                                                                                                          SHA-512:1CCE6BCAE5D1F7D80E10687F0BCA2AE1B2DD53F04A0F443DC9B552804D60E708E64326B62BA4E3787325D89837B4AC8CCCA9AF6F39CBD654BCC8A9C27EA63BB8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_AU DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset en_AU TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_AU TIME_FORMAT_12 "%I:%M:%S %P %z".. ::msgcat::mcset en_AU DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\en_be.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):312
                                                                                                                                                                                                                          Entropy (8bit):4.870560620756039
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoCr3FuoCsX3vtfNrsoCsX3v6YNIdjoCs+3v3FnN9vn:4EnLB383H3Fb3vtNN3v6y43v3FnNNn
                                                                                                                                                                                                                          MD5:DDA87ACED97F9F7771788A1A0A1E4433
                                                                                                                                                                                                                          SHA1:E221653CD659C095098180344654770FF059331B
                                                                                                                                                                                                                          SHA-256:BC87754A253C1036E423FA553DA182DBC56F62A13EDA811D8CD9E8AFA40404A6
                                                                                                                                                                                                                          SHA-512:BB95D9241B05686CA15C413746DD06071635CB070F38847BE9702397A86C01A3D54DEBE1ACAA51834AB74DB8D0F75E353995183864E382721425756EE46B0B1E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_BE DATE_FORMAT "%d %b %Y".. ::msgcat::mcset en_BE TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset en_BE TIME_FORMAT_12 "%k h %M min %S s %z".. ::msgcat::mcset en_BE DATE_TIME_FORMAT "%d %b %Y %k:%M:%S %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\en_bw.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.915769170926952
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xosmGMoss6W3v6ay/5osmT+3vR6HyFvn:4EnLB383hr8s6W3v6ay/hJ3voSVn
                                                                                                                                                                                                                          MD5:4CBF90CE15ECCB6B695AA78D7D659454
                                                                                                                                                                                                                          SHA1:30C26ADB03978C5E7288B964A14B692813D6E0B8
                                                                                                                                                                                                                          SHA-256:EC48F18995D46F82B1CC71EA285174505A50E3BA2017BCCE2D807149B7543FD0
                                                                                                                                                                                                                          SHA-512:CC809EBD1B2B5D9E918C2E2CE4E7075DFB0744C583F17C1C234D8437EF0C34654D2F09FF77544AD3430CEC78ABC70AA5F85F71AD1489A687B8087FCDFE07B088
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_BW DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_BW TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_BW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\en_ca.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):295
                                                                                                                                                                                                                          Entropy (8bit):4.87629705076992
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoAhgqyFjoAZF3vX5oAZF3v6cvBoAh9+3vnFDL8vn:4EnLB383FhgqWDZF3vVZF3v6cvdhI3vM
                                                                                                                                                                                                                          MD5:BFC4A48F5B10D137A4D32B440C47D3C6
                                                                                                                                                                                                                          SHA1:C90EF2A8291DE589BC12D0A5B8AF2F0B00FEB7CD
                                                                                                                                                                                                                          SHA-256:3CF2D0937FD95264549CF5C768B898F01D4875A3EB4A85D457D758BC11DFEC6E
                                                                                                                                                                                                                          SHA-512:A91B81A956A438CA7274491CA107A2647CBDFB8AEB5FD7A58238F315590C74F83F2EBA4AA5C4E9A4A54F1FC1636318E94E5E4BBEA467326E0EACED079741E640
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_CA DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_CA TIME_FORMAT "%r".. ::msgcat::mcset en_CA TIME_FORMAT_12 "%I:%M:%S %p".. ::msgcat::mcset en_CA DATE_TIME_FORMAT "%a %d %b %Y %r %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\en_gb.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):286
                                                                                                                                                                                                                          Entropy (8bit):4.892405843607203
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoEbtvqyFjoELE3vLjoELE3v6mjoEbto+3vnFDoAkvn:4EnLB383BbtvqWHLE3vTLE3v6EbtF3vW
                                                                                                                                                                                                                          MD5:52E55DE8C489265064A01CEEC823DCDD
                                                                                                                                                                                                                          SHA1:16F314A56AE0EAC9DAD58ADDEA6B25813A5BAA05
                                                                                                                                                                                                                          SHA-256:C2CE5B74F9E9C190B21C5DF4106303B7B794481228FB9A57065B9C822A1059C3
                                                                                                                                                                                                                          SHA-512:6010F29BF75D0CB4EE4F10781423A8CC68D5018DE8C633CD1217A7FE1299A0532E8C0E5D120188B748171EB255C587BB0B64B7384A58F725F3B6A4B9EA04393E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_GB DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_GB TIME_FORMAT "%T".. ::msgcat::mcset en_GB TIME_FORMAT_12 "%T".. ::msgcat::mcset en_GB DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\en_hk.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):329
                                                                                                                                                                                                                          Entropy (8bit):4.851471679101967
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoa+joaQ9PoaAx/G4soaYYW3v6ay/5oaAx/T+3v4x6HyFvn:4EnLB383BSiF4KxW3v6ay/B/3v4ISVn
                                                                                                                                                                                                                          MD5:DE2A484508615D7C1377522AFF03E16C
                                                                                                                                                                                                                          SHA1:C27C0D10E7667AD95FFF731B4E45B2C6E665CC36
                                                                                                                                                                                                                          SHA-256:563450A38DB6C6A1911BC04F4F55B816910B3E768B1465A69F9B3BD27292DBEE
                                                                                                                                                                                                                          SHA-512:A360B0FD7E36BCC0FB4603D622C36199E5D4C705396C6701F29730EB5CB33D81B208541CADFAED5303FC329C7C6A465D23CA9584F0DEC2DE128E258478DD6661
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_HK AM "AM".. ::msgcat::mcset en_HK PM "PM".. ::msgcat::mcset en_HK DATE_FORMAT "%B %e, %Y".. ::msgcat::mcset en_HK TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_HK DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\en_ie.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):286
                                                                                                                                                                                                                          Entropy (8bit):4.833246107458447
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoK6qyFjoKi+3vLjoKi+3v6mjoKv+3vnFDoAkvn:4EnLB383CqW13vJ3v6b3v9dmn
                                                                                                                                                                                                                          MD5:57F0BBE1316D14BC41D0858902A7980A
                                                                                                                                                                                                                          SHA1:B68BF99A021B9F01FE69341DF06F5D1453156A97
                                                                                                                                                                                                                          SHA-256:9E0DCEE86A03B7BDD831E0008868A9B874C506315BF01DF3982AD3813FD3BA8E
                                                                                                                                                                                                                          SHA-512:864F32254AAD39859AFC47D0C90DC5F38CA86EF0BBC7DE61BE253756C22B7806E616B59802C4F4D7B2F5543BF7C070FFF6FAF253E0A337EC443337E63A2E5A57
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_IE DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_IE TIME_FORMAT "%T".. ::msgcat::mcset en_IE TIME_FORMAT_12 "%T".. ::msgcat::mcset en_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\en_in.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):318
                                                                                                                                                                                                                          Entropy (8bit):4.80637980762728
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoKr3ujoKrGtoKr5vMoKrw3v1oKr5o+3voAsvn:4EnLB383T9xvT3vJF3vonn
                                                                                                                                                                                                                          MD5:1A54E506E70B2125C6016B373D3DD074
                                                                                                                                                                                                                          SHA1:15289902BAA93208D8FB224E119166D0E044E34E
                                                                                                                                                                                                                          SHA-256:ADEA3A1AB8AA84237DDB2F276ABDB96DCB4C51932E920D1A5E336904E1138664
                                                                                                                                                                                                                          SHA-512:0D663233E6C96515713B3B829B605E72D8CE581AEF1C02FF6CA96598C040DCA42A3AC765EE9B5002E8969A331EB19A9AF0F8215F7113D0AD2F2EB2C560239D53
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_IN AM "AM".. ::msgcat::mcset en_IN PM "PM".. ::msgcat::mcset en_IN DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_IN TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_IN DATE_TIME_FORMAT "%d %B %Y %H:%M:%S %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\en_nz.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):307
                                                                                                                                                                                                                          Entropy (8bit):4.939458132662909
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoyejbmvFjo63v1o63v6p6HyFjoy7+3vjb0ysvn:4EnLB383temdj3vd3v6QS1S3ven
                                                                                                                                                                                                                          MD5:7E81708F107658FFD31C3BFBF704A488
                                                                                                                                                                                                                          SHA1:7941ED040707591B68581337F8D90FA03C5E1406
                                                                                                                                                                                                                          SHA-256:EC305B7CB393421E6826D8F4FEA749D3902EBA53BFA488F2B463412F4070B9ED
                                                                                                                                                                                                                          SHA-512:8F038FF960F81D96FF9E3454D8ABDA7FFDA5B99DA304ACECC42E74DDBED839388246F66B58928DA902D3B475FBA46602B34F6829A87ECB1124FFC47C036B4DBE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_NZ DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset en_NZ TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_NZ TIME_FORMAT_12 "%I:%M:%S %P %z".. ::msgcat::mcset en_NZ DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\en_ph.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):329
                                                                                                                                                                                                                          Entropy (8bit):4.824360175945298
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoojoOo2e4soe3v6ay/5o27+3v4x6HyFvn:4EnLB38304u3v6ay/k3v4ISVn
                                                                                                                                                                                                                          MD5:E2E3BD806C20D7FB88109B7F3B84C072
                                                                                                                                                                                                                          SHA1:2D7AD6BECA9C4D611BAE9747AD55A3E9385C2B42
                                                                                                                                                                                                                          SHA-256:3A9C22B07906544C04F7A29B800FCE87C09D7FDF5C251236925115CF251A3890
                                                                                                                                                                                                                          SHA-512:B14756B59BCABF8B29B41AC688E4F3A011735AF190B88F88B7B5FDDD3DA77F63FFC0F7875B3B453729CD3BC65E79F75F6E632CA68952EF473F78337D89E80BF2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_PH AM "AM".. ::msgcat::mcset en_PH PM "PM".. ::msgcat::mcset en_PH DATE_FORMAT "%B %e, %Y".. ::msgcat::mcset en_PH TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_PH DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\en_sg.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.911413468674953
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoQW53FuoQGuX3v6ZwoQWa+3v3F0fxvn:4EnLB383V83FOJ3v62c3v3FEn
                                                                                                                                                                                                                          MD5:F70245D73BE985091459ADF74B089EBC
                                                                                                                                                                                                                          SHA1:21D52C336C08526D9DCF1AEC1F0701CB8B073D7A
                                                                                                                                                                                                                          SHA-256:D565679AE9AACBFE3B5273FE29BD46F46FFBB63C837D7925C11356D267F5FF82
                                                                                                                                                                                                                          SHA-512:171C70EB10D5E6421A55CE9B1AE99763E23FB6A6F563F69FE099D07C07FCA0CF8D3F6F00C5BB38BFF59A5F4C311506C4A9593F86C12B3B9E1861E72656B3800B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_SG DATE_FORMAT "%d %b %Y".. ::msgcat::mcset en_SG TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset en_SG DATE_TIME_FORMAT "%d %b %Y %P %I:%M:%S %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\en_za.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.937431055623088
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoOr0lIZoOK3v6poOs+3v0l6Uvn:4EnLB383z+3v6R3vl2n
                                                                                                                                                                                                                          MD5:FCA7B13CA6C9527D396A95BEA94CC92D
                                                                                                                                                                                                                          SHA1:E6F338A08F72DA11B97F70518D1565E6EF9AD798
                                                                                                                                                                                                                          SHA-256:67C253E2A187AA814809418E5B7A21F3A1F9FB5073458A59D80290F58C6C1EB4
                                                                                                                                                                                                                          SHA-512:37B8B4EA24B1C77AF0252A17660650CB2D4F8BB55C75817D6A94E1B81A3DDEF9913D12D3BF80C7BFE524CD0AD84E353E73238056759E6545BFE69EF5F806B8B7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_ZA DATE_FORMAT "%Y/%m/%d".. ::msgcat::mcset en_ZA TIME_FORMAT_12 "%I:%M:%S".. ::msgcat::mcset en_ZA DATE_TIME_FORMAT "%Y/%m/%d %I:%M:%S %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\en_zw.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.934659260313229
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoEmGMoEs6W3v6ay/5oEmT+3vR6HyFvn:4EnLB383Zr0s6W3v6ay/ZJ3voSVn
                                                                                                                                                                                                                          MD5:A302091F490344B7A79C9463480AD7CF
                                                                                                                                                                                                                          SHA1:E3992D665077177BAD5A4771F1BAF52C2AD1829C
                                                                                                                                                                                                                          SHA-256:6F4754CE29DFA4F0E7957923249151CE8277395D1AF9F102D61B185F85899E4E
                                                                                                                                                                                                                          SHA-512:FEBDB0BD6D0FD4C592DB781836F93F0C579399D324112F8829B769303CC6EEA487AAB14EBD60ED1B4F3B3DABF501601C9F65656327FF54853BF2CD9EC6A2F00F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_ZW DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_ZW TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_ZW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\eo.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1285
                                                                                                                                                                                                                          Entropy (8bit):4.3537859241297845
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83dRb4vyomrIsmZ55vrAO0LH+50ydAcveva:43PT5rWvrAR60yW6oa
                                                                                                                                                                                                                          MD5:D87605E6282713EED41D56D53B7A04FD
                                                                                                                                                                                                                          SHA1:41AAD4BD3B72CCBB6A762FEED3C24931642DD867
                                                                                                                                                                                                                          SHA-256:98D52CAB5CA65789D1DC37949B65BAF0272AB87BCCBB4D4982C3AF380D5406AB
                                                                                                                                                                                                                          SHA-512:4A4F51B2FD0248B52530B5D9FE6BFCFE455147CBE2C1F073804A53666945405F89CBBAD219FFF6904C1F92885F7C53B9D9A969732D662CEA8EC1717B3303B294
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eo DAYS_OF_WEEK_ABBREV [list \.. "di"\.. "lu"\.. "ma"\.. "me"\.. "\u0135a"\.. "ve"\.. "sa"].. ::msgcat::mcset eo DAYS_OF_WEEK_FULL [list \.. "diman\u0109o"\.. "lundo"\.. "mardo"\.. "merkredo"\.. "\u0135a\u016ddo"\.. "vendredo"\.. "sabato"].. ::msgcat::mcset eo MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "a\u016dg"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset eo MONTHS_FULL [list \.. "januaro"\.. "februaro"\.. "marto"\.. "aprilo"\.. "majo"\.. "junio"\.. "julio"\.. "a\u016dgusto"\.. "septembro"\.. "oktobro"\.. "novembro"\.. "decembro"\.. ""].. ::m

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1232
                                                                                                                                                                                                                          Entropy (8bit):4.2910064237800025
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83hEVIhlp4herIsYoorrClH+Fo9ARhprBvtFvr6:43OVY7+ercrmsYsr1thr6
                                                                                                                                                                                                                          MD5:91DE6EE8E1A251EF73CC74BFB0216CAC
                                                                                                                                                                                                                          SHA1:1FB01E3CF2CAFA95CC451BC34AB89DC542BBD7DD
                                                                                                                                                                                                                          SHA-256:E9A6FE8CCE7C808487DA505176984D02F7D644425934CEDB10B521FE1E796202
                                                                                                                                                                                                                          SHA-512:46CFD80E68461F165EE6A93AB6B433E4D4DA6A9A76CB7F3EF5766AC67567A7AFFB7B4E950A5AFA7C69C91F72AC82D2A448D32E39BBFC0BF26D2257460471EEC1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es DAYS_OF_WEEK_ABBREV [list \.. "dom"\.. "lun"\.. "mar"\.. "mi\u00e9"\.. "jue"\.. "vie"\.. "s\u00e1b"].. ::msgcat::mcset es DAYS_OF_WEEK_FULL [list \.. "domingo"\.. "lunes"\.. "martes"\.. "mi\u00e9rcoles"\.. "jueves"\.. "viernes"\.. "s\u00e1bado"].. ::msgcat::mcset es MONTHS_ABBREV [list \.. "ene"\.. "feb"\.. "mar"\.. "abr"\.. "may"\.. "jun"\.. "jul"\.. "ago"\.. "sep"\.. "oct"\.. "nov"\.. "dic"\.. ""].. ::msgcat::mcset es MONTHS_FULL [list \.. "enero"\.. "febrero"\.. "marzo"\.. "abril"\.. "mayo"\.. "junio"\.. "julio"\.. "agosto"\.. "septiembre"\.. "octubre"\.. "noviembre"\.. "diciembre"\.. ""].. ::msgc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_ar.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):248
                                                                                                                                                                                                                          Entropy (8bit):4.878377455979812
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo8GzvFjot/W3v1o8T+3v9ysvn:4EnLB3833GzdV3vLK3vnn
                                                                                                                                                                                                                          MD5:313966A7E4F50BB77996FDE45E342CA9
                                                                                                                                                                                                                          SHA1:021DF7211DAE9A635D52F7005672C157DBBAE182
                                                                                                                                                                                                                          SHA-256:B97DCEA4FEC3E14632B1511D8C4F9E5A157D97B4EBBC7C6EE100C3558CB2947F
                                                                                                                                                                                                                          SHA-512:79DCC76263310523BAF1100C70918FCE6BECB47BE360E4A26F11C61F27E14FC28B588A9253AA0C1F08F45AE8A03312A30FBDCF4FDFFDC5BF9D086C4B539DE022
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_AR DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_AR TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset es_AR DATE_TIME_FORMAT "%d/%m/%Y %H:%M:%S %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_bo.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.924579610789789
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoYePWWjoU3v6ry/5oY7+3vPUe6HyFvn:4EnLB383nedh3v6ry/nS3vs3SVn
                                                                                                                                                                                                                          MD5:EF58B1097A3C6F2133BD7AA8CCC1AD1B
                                                                                                                                                                                                                          SHA1:BD479E4635F3CD70A6A90E07B7E92757BC9E2687
                                                                                                                                                                                                                          SHA-256:B47F55539DB6F64304DEA080D6F9A39165F1B9D4704DCBA4C182DBD3AA31A11B
                                                                                                                                                                                                                          SHA-512:F9EB1489E5002200D255A45DC57132DEFD2A2C6DE5BC049D0D9720575E4FDD1B6A212D9E15974C6A2E0D0886069EA0DD967AD7C20845EC38EB74CBED0C3E5BE1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_BO DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset es_BO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_BO DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_cl.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.9352990174129925
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xodvPWWjok3v6ry/5odo+3vPUe6HyFvn:4EnLB383OdV3v6ry/i3vs3SVn
                                                                                                                                                                                                                          MD5:42BCE0EE3A3F9E9782E5DE72C989903A
                                                                                                                                                                                                                          SHA1:0960646417A61E8C31D408AE00B36A1284D0300E
                                                                                                                                                                                                                          SHA-256:9D1A2A6EBA673C6F6D964DBCDDF228CB64978F282E70E494B60D74E16A1DB9CB
                                                                                                                                                                                                                          SHA-512:C53DDCC17F261CFFAA2205879A131CFD23A7BCF4D3787090A0EA8D18530C4805903ED6CF31B53A34C70510A314EBBB68676E9F128289B42C5EFBC701405D5645
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CL DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset es_CL TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CL DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_co.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.908553844782894
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo4FjbmvFjo4F+3v6ry/5o4++3vjb0f6HyFvn:4EnLB3831mdD+3v6ry/P3vbSVn
                                                                                                                                                                                                                          MD5:6A8F31AE734DCEE4845454408CDB3BC5
                                                                                                                                                                                                                          SHA1:A3B9A0124D3CFA9E0E5957612897B23193AD5D59
                                                                                                                                                                                                                          SHA-256:5FAC53ACFB305C055AFD0BA824742A78CB506046B26DAC21C73F0BB60C2B889A
                                                                                                                                                                                                                          SHA-512:188A65CFE2FBD04D83F363AEA166F224137C8A7009A9EBEB24B2A9AC89D9484D3A7109A4CE08F5C0A28911D81571230CC37554F4F19956AE163F9304911EE53C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CO DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_CO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CO DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_cr.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.919346233482604
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo76GzvFjoTW3v6ry/5o76T+3v9f6HyFvn:4EnLB383K6Gzdj3v6ry/K6K3vMSVn
                                                                                                                                                                                                                          MD5:2EDDA3F61BA4D049E6C871D88322CF72
                                                                                                                                                                                                                          SHA1:40AFB64AF810596FCBDBD742ACAFE25CE56F3949
                                                                                                                                                                                                                          SHA-256:A33DC22330D087B8567670B4915C334FF1741EE03F05D616CC801ECFDA1D9E64
                                                                                                                                                                                                                          SHA-512:B6A6059B44F064C5CB59A3DAFAA7BE9064EE3E38F5FA6391017D931EF3A2B471DC4D556B7BEC6852FD1F6260EF17F476754D6BEA89E035748E9304977513CFB5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CR DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_CR TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CR DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_do.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.913083040975068
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xomerQZ2jou3v6ry/5om7+3vrQZg6HyFvn:4EnLB383sk4/3v6ry/s3vkrSVn
                                                                                                                                                                                                                          MD5:76CFD4F568EA799F9A4082865633FF97
                                                                                                                                                                                                                          SHA1:B09846BBF7A78243A5075F2DC9241791DCBA434B
                                                                                                                                                                                                                          SHA-256:8DC2F857E91912ED46A94EB6B37DD6170EA7BCDDCD41CB85C0926A74EE12FCC1
                                                                                                                                                                                                                          SHA-512:58B20A8A5D1F8C19AC36E61965106266B7E6F7E95DDD6AD9C4BB9FD7FFC561CB0E2103639D901A6A78CE2DD154CBF7F3AE0F71B4DC1CCB11DC6BB40D9C6E2157
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_DO DATE_FORMAT "%m/%d/%Y".. ::msgcat::mcset es_DO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_DO DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_ec.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.915857529388286
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xozgzvFjoro+3v6ry/5oz9+3v9f6HyFvn:4EnLB383OgzdkF3v6ry/OI3vMSVn
                                                                                                                                                                                                                          MD5:94B713B1560FE7711EA746F1CEBD37CD
                                                                                                                                                                                                                          SHA1:E7047E8F04D731D38FA328FBC0E1856C4A8BB23D
                                                                                                                                                                                                                          SHA-256:52AB5A6C9DD4F130A75C049B3AF8F54B84071FC190374BCCF5FA0E1F3B91EB21
                                                                                                                                                                                                                          SHA-512:EE807D4D74A609F642CC3C6FC3D736708F67A6931DEB95288AB5822DA256BE4C908A346036195CF4266408458906D28BB5C715EEAFCACFC4FE45D4E6D8E435FE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_EC DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_EC TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_EC DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_gt.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.9102355704853435
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xohvjbmvFjoI3v6ry/5oho+3vjb0f6HyFvn:4EnLB383KmdJ3v6ry/W3vbSVn
                                                                                                                                                                                                                          MD5:761D0A468DF2EE75BC2CAB09D5FF38CD
                                                                                                                                                                                                                          SHA1:D627BE45FE71CCB3CA53153393C075FF5136C2F3
                                                                                                                                                                                                                          SHA-256:19B4D3025156C060A16328370A3FDB9F141298DECFC8F97BE606F6438FECE2EE
                                                                                                                                                                                                                          SHA-512:6CF7C9004A8A3B70495862B7D21921B1A6263C2153FEBC5C4997366498ABBFE70263B436C2B4998550780A4C3A58DCF0AAE7420FF9D414323D731FA44BD83104
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_GT DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_GT TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_GT DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_hn.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.947925914291734
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoIvriSFjoP3v6ry/5oIo+3vrig6HyFvn:4EnLB383V+2m3v6ry/v3v+lSVn
                                                                                                                                                                                                                          MD5:33CEE7F947A484B076F5FA7871A30FEB
                                                                                                                                                                                                                          SHA1:F77F8D1F42008770A6FF1F5097C863ECF482BEBE
                                                                                                                                                                                                                          SHA-256:07873D4D59BB41000706A844859C73D26B1FF794058AA83CFFCA804981A24038
                                                                                                                                                                                                                          SHA-512:EBF6873F9CB554489EFCD352943100C00171E49D27153769D1C4DB25E2D1F44F2D34869B596C267C9BB59ED0444468D9982137CFB1C6035FB15A855BB867133B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_HN DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_HN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_HN DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_mx.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.9102355704853435
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoPjbmvFjoH+3v6ry/5oI+3vjb0f6HyFvn:4EnLB383UmdD3v6ry/k3vbSVn
                                                                                                                                                                                                                          MD5:678D7A6DC32355246BF3AC485A24AF4D
                                                                                                                                                                                                                          SHA1:B6C273D3BE5FB9F5A221B0333870CCE41CEDFDE4
                                                                                                                                                                                                                          SHA-256:A0F57137D2C0ABDC933E03CFB188F5632176C195CEADB9DC80D469C8DC6CEDC6
                                                                                                                                                                                                                          SHA-512:571404CCB0591C681C975E3F7A6C6972FAF2362F1D48BFC95E69A9EAE2DB3F40BF4B666C41950C4924E3FD820C61ED91204F92283B8554F1BD35B64D53BD4125
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_MX DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_MX TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_MX DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_ni.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.918215906418583
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoe/GriSFjo3W3v6ry/5oe/T+3vrig6HyFvn:4EnLB383Re+2eW3v6ry/RS3v+lSVn
                                                                                                                                                                                                                          MD5:471C41907CE5DB1F30C647A789870F78
                                                                                                                                                                                                                          SHA1:C575A639609620AF7C56430991D0E4C2B50BDEC5
                                                                                                                                                                                                                          SHA-256:6250663DA1378E54BEDCEF206583D212BC0D61D04D070495238D33715BB20CAE
                                                                                                                                                                                                                          SHA-512:CAE32DF8F583542CAFE3292501725D85B697A5C1F9A0A7993490E8A69B6CE5CE3DE3AA2733B14D989A8D13B5E31B437DB42E9AB9D1851FE72313592C752B5061
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_NI DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_NI TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_NI DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_pa.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.906719336603863
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoX5rQZ2joHE3v6ry/5oXa+3vrQZg6HyFvn:4EnLB383ak4F3v6ry/G3vkrSVn
                                                                                                                                                                                                                          MD5:571F6716293442672521F70854A5AD05
                                                                                                                                                                                                                          SHA1:525EBDEA6F85FC769B6C0C0B179BD98381647123
                                                                                                                                                                                                                          SHA-256:EBB661C1C09E7D4F6FBCC4B2DAD0F41442B1FFDD27F003ABDC0375DD316E57D7
                                                                                                                                                                                                                          SHA-512:C6176EE48515BDFC09B8347DAC5FD2C0165AA765916457DC7B057E526785AC912481CB72F118D2943372213B23CE3C39739263C2B3DA4DBFEB24C522ACC0439D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PA DATE_FORMAT "%m/%d/%Y".. ::msgcat::mcset es_PA TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PA DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_pe.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.90959433688075
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoIgzvFjoQ9X3v6ry/5oI9+3v9f6HyFvn:4EnLB383+zdB3v6ry/y3vMSVn
                                                                                                                                                                                                                          MD5:5A5997D834DDD3E2E8FF8C6956AD54AC
                                                                                                                                                                                                                          SHA1:AB4110E37B3665D738A8F2B3E64CBA9E99127301
                                                                                                                                                                                                                          SHA-256:90C130B66958CF63CB3DDD2C633E58444357DBAB44C56831DD794CBD2EB1AED0
                                                                                                                                                                                                                          SHA-512:1FEB8E77EA7B886E4A06279AC8A4B6200DBB86DCD28989651B92A0C9147A7BCFBB871DF8F904A1CF8F869BFFBD21325505AC44A4DBEBE1EFC87D43174597F1F3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PE DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_PE TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_pr.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.905689521403511
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo06GriSFjoeW3v6ry/5o06T+3vrig6HyFvn:4EnLB383gG+263v6ry/gK3v+lSVn
                                                                                                                                                                                                                          MD5:CE811BB8D12C7E6D53338759CCFB0A22
                                                                                                                                                                                                                          SHA1:0AED290AA479DE6887CCB58D3F0A0F379EF8D558
                                                                                                                                                                                                                          SHA-256:F790E8E48DC079DCD7DEB58170561006A31294F7E4ACBF9CF2ABFA3DB9E3FA9E
                                                                                                                                                                                                                          SHA-512:0C73654CC3D33F76D9BF545BD6C5E42CBDD10B6D9750BFD6536806010F3B6A3C3647FB9D5E7E75A39823FDB857E13D07B7F987809C94B9F980E6D3A6D3108E85
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PR DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_PR TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PR DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_py.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.917539255090736
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo/5zvFjovE3v6ry/5o/a+3v9f6HyFvn:4EnLB383Czdt3v6ry/+3vMSVn
                                                                                                                                                                                                                          MD5:9CD6FAC4121E3D287C87157142E32845
                                                                                                                                                                                                                          SHA1:3081FE2197017EC8E052756A407880C1C4ED026A
                                                                                                                                                                                                                          SHA-256:70263F7EB22822DFEE8849B7AC4418ED9331275A71E77236B59226396505CDFF
                                                                                                                                                                                                                          SHA-512:25DC054085C4078734988EEDD87E31ABE93DA8B43512E924DE4BCDE9F8EC670436B72FAD1855484F9AC71DD0BEDD9ED30304D02219C4FFC4B0516D8889BDF9F9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PY DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_PY TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_sv.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.929035824905457
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xofriSFjo3+3v6ry/5oY+3vrig6HyFvn:4EnLB383Y+22+3v6ry/Q3v+lSVn
                                                                                                                                                                                                                          MD5:AF300EA6E733DC6820768EA16194B472
                                                                                                                                                                                                                          SHA1:7766A6EB3D07BCC759CF6718EF3D6EC3FCE13565
                                                                                                                                                                                                                          SHA-256:26A38B3745C95673D21BABB987F1D41EE08DDA945C670F5432BA0CE6F893C0E9
                                                                                                                                                                                                                          SHA-512:C38D67C912584BE539D71881C6517AC186CBB336A160602DA716CE2708B2D38CE8FA7DD23EDB98890ABB7119B924B6C7816C18EC18F20C49D6284DF2386E32EE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_SV DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_SV TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_SV DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_uy.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.923802447598272
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xooygzvFjooq9X3v6ry/5ooy9+3v9f6HyFvn:4EnLB3835rzdbsX3v6ry/5J3vMSVn
                                                                                                                                                                                                                          MD5:2DC550FEC3F477B1159B824479BCE707
                                                                                                                                                                                                                          SHA1:4D0B20CF3E50B64D74655A405A7750E0B0BB4375
                                                                                                                                                                                                                          SHA-256:1291B58810739EA0651493DD7887F5EE3E14BDB806E06DD4BB8AE2520C742EDA
                                                                                                                                                                                                                          SHA-512:B12B927ACA6274904928A6A6CAEC8339A794C74A1F1804FF93AABC132AF9AD8AC5117F20067A60EFEBC9887150D7ACA5BE9643FF61509666011FD203211C25B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_UY DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_UY TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_UY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\es_ve.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.928484426267027
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoXrzvFjoXK3v6ry/5oXs+3v9f6HyFvn:4EnLB3838zdv3v6ry/c3vMSVn
                                                                                                                                                                                                                          MD5:184D6C4B9F0AA874DEB959F63F7CC01B
                                                                                                                                                                                                                          SHA1:5FB370B498289590C977F6B489FF646F0FB27425
                                                                                                                                                                                                                          SHA-256:91191517403C712299919F9C797F952502E33CB6961D1DBEE3A7C9E8D2B170B9
                                                                                                                                                                                                                          SHA-512:881CCAB0950AE993744ECCA141120C005F53D684167A3E5CBDDF950D110D630FB2B4F6AE6E3D0E06D5110AE25EA00A4F4DAFB03AD3B227DC8C63464D434431DA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_VE DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_VE TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_VE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\et.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1258
                                                                                                                                                                                                                          Entropy (8bit):4.391217201307309
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83P1Y2+1YoQVTsC/m48qpRTVTR7I/68qqq4Z0yoN7emG5wsvtqmsv5t:43P1p+1jQ9sq8y9v8Yko7emG5wKtqmKX
                                                                                                                                                                                                                          MD5:C8C5EF2FA6DD8DBD5BBD2699BE1A0BF6
                                                                                                                                                                                                                          SHA1:F5E26B40786B8987C98F9CBDEF5522043574A9ED
                                                                                                                                                                                                                          SHA-256:4BEE224C21B0483CFF39BE145C671AA20CB7872C8727FD918C0E8ECA2BBEB172
                                                                                                                                                                                                                          SHA-512:757FA85C137A11C1A3F4A8392C7A4E4030A67D0E593FA25A98BEC07DB295399AB2C0D9EBE61E07420B14387A29C060DC3AF812A1E7B85110DBB13C3C3DCB3600
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset et DAYS_OF_WEEK_ABBREV [list \.. "P"\.. "E"\.. "T"\.. "K"\.. "N"\.. "R"\.. "L"].. ::msgcat::mcset et DAYS_OF_WEEK_FULL [list \.. "p\u00fchap\u00e4ev"\.. "esmasp\u00e4ev"\.. "teisip\u00e4ev"\.. "kolmap\u00e4ev"\.. "neljap\u00e4ev"\.. "reede"\.. "laup\u00e4ev"].. ::msgcat::mcset et MONTHS_ABBREV [list \.. "Jaan"\.. "Veebr"\.. "M\u00e4rts"\.. "Apr"\.. "Mai"\.. "Juuni"\.. "Juuli"\.. "Aug"\.. "Sept"\.. "Okt"\.. "Nov"\.. "Dets"\.. ""].. ::msgcat::mcset et MONTHS_FULL [list \.. "Jaanuar"\.. "Veebruar"\.. "M\u00e4rts"\.. "Aprill"\.. "Mai"\.. "Juuni"\.. "Juuli"\.. "August"\.. "September"\.. "Oktoober"\.. "November"\.. "De

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\eu.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1032
                                                                                                                                                                                                                          Entropy (8bit):4.002617252503668
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83DEXk8TT7vXk8TTMtzCIsOo/ssP6tvf1I49sHT:434bTbbTc+RjKi4mz
                                                                                                                                                                                                                          MD5:ED9805AF5BFB54EB28C6CB3975F86F5B
                                                                                                                                                                                                                          SHA1:2BD91BD850028712F35A2DDB2555036FBF6E8114
                                                                                                                                                                                                                          SHA-256:6889B57D29B670C6CFB7B5A3F2F1749D12C802E8E9629014D06CE23C034C7EF1
                                                                                                                                                                                                                          SHA-512:16F31DE5D2B0D3ED2D975C7891C73C48F073CDAC28F17572FC9424C2D384DDFE9E5E235F17C788F42840CB2D819D2D9499B909AB80FEF1B09F2AE1627CF1DADC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eu DAYS_OF_WEEK_ABBREV [list \.. "igandea"\.. "astelehena"\.. "asteartea"\.. "asteazkena"\.. "osteguna"\.. "ostirala"\.. "larunbata"].. ::msgcat::mcset eu DAYS_OF_WEEK_FULL [list \.. "igandea"\.. "astelehena"\.. "asteartea"\.. "asteazkena"\.. "osteguna"\.. "ostirala"\.. "larunbata"].. ::msgcat::mcset eu MONTHS_ABBREV [list \.. "urt"\.. "ots"\.. "mar"\.. "api"\.. "mai"\.. "eka"\.. "uzt"\.. "abu"\.. "ira"\.. "urr"\.. "aza"\.. "abe"\.. ""].. ::msgcat::mcset eu MONTHS_FULL [list \.. "urtarrila"\.. "otsaila"\.. "martxoa"\.. "apirila"\.. "maiatza"\.. "ekaina"\.. "uztaila"\.. "abuztua"\.. "iraila"\.. "urria"\.. "azaroa"\..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\eu_es.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):294
                                                                                                                                                                                                                          Entropy (8bit):4.915392589807169
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoszFnJF+l6VvBoszw3vLjoszw3v6mjosz++3v/RHvn:4EnLB383FL+l6VQ3vO3v6G3vZPn
                                                                                                                                                                                                                          MD5:4C91AA000D4316585893025CBB96E910
                                                                                                                                                                                                                          SHA1:3D4E73839A1A8CB9DEC1E59D9D2813257D9480F0
                                                                                                                                                                                                                          SHA-256:D45CC432E5743E6CEC34E9A1E0F91A9D5C315CDA409E0826B51AD9D908479EB6
                                                                                                                                                                                                                          SHA-512:0731F2EEB22ADC7EF8AF215B9EB4C5A66B33BC90E4F80CF7AA482AD002CB30543547230124A0507EC79EDDD6903A042EDA5D7C8AFD77F7FC994EFC6853FABB05
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eu_ES DATE_FORMAT "%a, %Yeko %bren %da".. ::msgcat::mcset eu_ES TIME_FORMAT "%T".. ::msgcat::mcset eu_ES TIME_FORMAT_12 "%T".. ::msgcat::mcset eu_ES DATE_TIME_FORMAT "%y-%m-%d %T %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\fa.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1711
                                                                                                                                                                                                                          Entropy (8bit):4.21837106187395
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83CnMqnbxbGwgjSyiY/Xw2mS1yM/8ye48YyfNqTb2gyj/8yHkQp:43Yzyhgvs9yi4P
                                                                                                                                                                                                                          MD5:7AB25F4E7E457469DC61A33176B3AA72
                                                                                                                                                                                                                          SHA1:EEA98283D250A99E33DD4D5D9B1B76A029716CE6
                                                                                                                                                                                                                          SHA-256:86898728B275288693B200568DC927C3FF5B9050690876C4441A8339DAE06386
                                                                                                                                                                                                                          SHA-512:7524437F91E91751BEB7A378D7674C49E5D84B716FE962F4C23580C46A671F3F33638FCD37A8F90C86E24DA8F54448E06AC9C3AEFFB5613E94A04E512C1AD68D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa DAYS_OF_WEEK_ABBREV [list \.. "\u06cc\u2214"\.. "\u062f\u2214"\.. "\u0633\u2214"\.. "\u0686\u2214"\.. "\u067e\u2214"\.. "\u062c\u2214"\.. "\u0634\u2214"].. ::msgcat::mcset fa DAYS_OF_WEEK_FULL [list \.. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\.. "\u062f\u0648\u0634\u0646\u0628\u0647"\.. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\.. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\.. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\.. "\u062c\u0645\u0639\u0647"\.. "\u0634\u0646\u0628\u0647"].. ::msgcat::mcset fa MONTHS_ABBREV [list \.. "\u0698\u0627\u0646"\.. "\u0641\u0648\u0631"\.. "\u0645\u0627\u0631"\.. "\u0622\u0648\u0631"\.. "\u0645\u0640\u0647"\.. "\u0698\u0648\u0646"\.. "\u0698\u0648\u06cc"\.. "\u0627\u0648\u062a

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\fa_in.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2009
                                                                                                                                                                                                                          Entropy (8bit):4.491667766230948
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83KnMqnbxbGUgjDiY/Xw2mS1yM/8ye48tfNqTb2gyj/8yHkQLoRv9v/vNv0P:43wihgvsai4Rmv53JU
                                                                                                                                                                                                                          MD5:C59EE7CA80AD9F612A21C8B6674A820E
                                                                                                                                                                                                                          SHA1:AEFD631EFC1892063244FA622DE1A091C461E370
                                                                                                                                                                                                                          SHA-256:6B56545C1AE1DE53BC2389BB7AE59F115BADE24F907E384E079491DC77D6541D
                                                                                                                                                                                                                          SHA-512:42F52091480599D317FB80DF8E52A6C6F88614C6172BF4033974DD136FB30E6F47D38982C8A7BC14CF3165C3EBAE3680F94DF3A0ED079AB68165286251CD0BD7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa_IN DAYS_OF_WEEK_ABBREV [list \.. "\u06cc\u2214"\.. "\u062f\u2214"\.. "\u0633\u2214"\.. "\u0686\u2214"\.. "\u067e\u2214"\.. "\u062c\u2214"\.. "\u0634\u2214"].. ::msgcat::mcset fa_IN DAYS_OF_WEEK_FULL [list \.. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\.. "\u062f\u0648\u0634\u0646\u0628\u0647"\.. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\.. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\.. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\.. "\u062c\u0645\u0639\u0647"\.. "\u0634\u0646\u0628\u0647"].. ::msgcat::mcset fa_IN MONTHS_ABBREV [list \.. "\u0698\u0627\u0646"\.. "\u0641\u0648\u0631"\.. "\u0645\u0627\u0631"\.. "\u0622\u0648\u0631"\.. "\u0645\u0640\u0647"\.. "\u0698\u0648\u0646"\.. "\u0698\u0648\u06cc"\.. "\u0627\u0

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\fa_ir.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):426
                                                                                                                                                                                                                          Entropy (8bit):5.12739029869254
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLB383D2WGz7A/3vy3v6TANCmK3vz7AAbn:4aR83DoPivkvFk5vPN
                                                                                                                                                                                                                          MD5:9778A7C3ABD37ECBEC0BB9715E52FAF8
                                                                                                                                                                                                                          SHA1:D8063CA7779674EB1D9FE3E4B4774DB20B93038B
                                                                                                                                                                                                                          SHA-256:3D9779C27E8960143D00961F6E82124120FD47B7F3CB82DB3DF21CDD9090C707
                                                                                                                                                                                                                          SHA-512:B90B4A96CE5E8B9BF512B98C406603C60EA00F6740D04CD1FC30810C7155A37851AE5E28716F959137806F1A9E3152D2A0D79B8EA7E681A0737A28593657DE66
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa_IR AM "\u0635\u0628\u062d".. ::msgcat::mcset fa_IR PM "\u0639\u0635\u0631".. ::msgcat::mcset fa_IR DATE_FORMAT "%d\u2044%m\u2044%Y".. ::msgcat::mcset fa_IR TIME_FORMAT "%S:%M:%H".. ::msgcat::mcset fa_IR TIME_FORMAT_12 "%S:%M:%l %P".. ::msgcat::mcset fa_IR DATE_TIME_FORMAT "%d\u2044%m\u2044%Y %S:%M:%H %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\fi.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1195
                                                                                                                                                                                                                          Entropy (8bit):4.32217771842326
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83KTvIhmuw4tW/UWJTttWKeqA+3ewvtyv3e6:43YvIwuw4t05ttnlzt0p
                                                                                                                                                                                                                          MD5:CC06F0ABD8F985654DAD8256598EBCB7
                                                                                                                                                                                                                          SHA1:71C880F9F395ACD32AF7F538033211F392F83645
                                                                                                                                                                                                                          SHA-256:9929A6B7139BD7E0F29487F7888A83E4C4F5E9CE0352738CFCA94EE2DDF3BD6B
                                                                                                                                                                                                                          SHA-512:E1292665270B6FBF7738CC3864B55194E7B827C6AD9492FB2E54DC1B626159B243052CE502335B9D92E2B8F58A4DD1FA0E628CB6A9D1D3A652FE2B93A3FB711A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fi DAYS_OF_WEEK_ABBREV [list \.. "su"\.. "ma"\.. "ti"\.. "ke"\.. "to"\.. "pe"\.. "la"].. ::msgcat::mcset fi DAYS_OF_WEEK_FULL [list \.. "sunnuntai"\.. "maanantai"\.. "tiistai"\.. "keskiviikko"\.. "torstai"\.. "perjantai"\.. "lauantai"].. ::msgcat::mcset fi MONTHS_ABBREV [list \.. "tammi"\.. "helmi"\.. "maalis"\.. "huhti"\.. "touko"\.. "kes\u00e4"\.. "hein\u00e4"\.. "elo"\.. "syys"\.. "loka"\.. "marras"\.. "joulu"\.. ""].. ::msgcat::mcset fi MONTHS_FULL [list \.. "tammikuu"\.. "helmikuu"\.. "maaliskuu"\.. "huhtikuu"\.. "toukokuu"\.. "kes\u00e4kuu"\.. "hein\u00e4kuu"\.. "elokuu"\.. "syyskuu"\.. "lokakuu"\.. "marraskuu"\..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\fo.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1033
                                                                                                                                                                                                                          Entropy (8bit):4.15884265510429
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR834YPxTSBFSa+E6rIsmYmyAxyIQbXHU92W1T:43a6rIyAE0B
                                                                                                                                                                                                                          MD5:5D224E66FD9521CA4327D4F164CD6585
                                                                                                                                                                                                                          SHA1:FC8F4C1D9A69931679028DE02155D96A18F6542E
                                                                                                                                                                                                                          SHA-256:2EC9B03469FA38B260915C93318F446EA5E12B9090BD441936B57552EBA1E3C9
                                                                                                                                                                                                                          SHA-512:0E0F97D99F0274A8A92AA7DC992B252A0BB696D69A8835602D8F4C03A6A15780F45971F00863436949CD81AD7DF6EE6BC463CE5B9FECF5E39508BA4D4E83C693
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fo DAYS_OF_WEEK_ABBREV [list \.. "sun"\.. "m\u00e1n"\.. "t\u00fds"\.. "mik"\.. "h\u00f3s"\.. "fr\u00ed"\.. "ley"].. ::msgcat::mcset fo DAYS_OF_WEEK_FULL [list \.. "sunnudagur"\.. "m\u00e1nadagur"\.. "t\u00fdsdagur"\.. "mikudagur"\.. "h\u00f3sdagur"\.. "fr\u00edggjadagur"\.. "leygardagur"].. ::msgcat::mcset fo MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset fo MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "apr\u00edl"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\fo_fo.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):286
                                                                                                                                                                                                                          Entropy (8bit):4.864028070948858
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoZA4WjoZd3vLjoZd3v6mjoZd+3vnFDoAkvn:4EnLB3831P23vS3v6u3v9dmn
                                                                                                                                                                                                                          MD5:92E2B6483B2374817548F4EAA1731820
                                                                                                                                                                                                                          SHA1:071E1E9368CCB4EC864E78622B2113F460920203
                                                                                                                                                                                                                          SHA-256:C3DCCF5E5904C24D4AD9AAA36160A78F5397A7452510C0C0E61DE4DE863305CB
                                                                                                                                                                                                                          SHA-512:E79D4D38A22298252FA46D15C383CFB2A1E49E8196C265A58F9BA4982DFD9CE29E87C0B85BE3F39617359451831B792FCD3092A52EDF8FFD999AFE5CFE1D170D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fo_FO DATE_FORMAT "%d/%m-%Y".. ::msgcat::mcset fo_FO TIME_FORMAT "%T".. ::msgcat::mcset fo_FO TIME_FORMAT_12 "%T".. ::msgcat::mcset fo_FO DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\fr.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1257
                                                                                                                                                                                                                          Entropy (8bit):4.383721663740675
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR835LzAX2t6KOkPwzZIGzRmzQf1waGqHvivh:43mlwIFZtA/qPkh
                                                                                                                                                                                                                          MD5:4D63B4A7CF13A28A6F6784B5597EEF43
                                                                                                                                                                                                                          SHA1:FE1B35A93CB72666D7D6BC37D9BE081B05A00CD9
                                                                                                                                                                                                                          SHA-256:96B1E1E12CD13A56722EBF27D362C70B467342FA1282A40B89FB16B5105A0480
                                                                                                                                                                                                                          SHA-512:5647CAE859B62C7CE1CEE6426A076361D2A29EFE6B6F311DDC0E7D006194BA68D575852FEC5FDE2AB43DF8AE440C57013D32A3951095CB856327070FD9BD1C76
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr DAYS_OF_WEEK_ABBREV [list \.. "dim."\.. "lun."\.. "mar."\.. "mer."\.. "jeu."\.. "ven."\.. "sam."].. ::msgcat::mcset fr DAYS_OF_WEEK_FULL [list \.. "dimanche"\.. "lundi"\.. "mardi"\.. "mercredi"\.. "jeudi"\.. "vendredi"\.. "samedi"].. ::msgcat::mcset fr MONTHS_ABBREV [list \.. "janv."\.. "f\u00e9vr."\.. "mars"\.. "avr."\.. "mai"\.. "juin"\.. "juil."\.. "ao\u00fbt"\.. "sept."\.. "oct."\.. "nov."\.. "d\u00e9c."\.. ""].. ::msgcat::mcset fr MONTHS_FULL [list \.. "janvier"\.. "f\u00e9vrier"\.. "mars"\.. "avril"\.. "mai"\.. "juin"\.. "juillet"\.. "ao\u00fbt"\.. "septembre"\.. "octobre"\.. "novembre"\.. "d\u00e9cembre

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\fr_be.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):286
                                                                                                                                                                                                                          Entropy (8bit):4.910112619660625
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoXqyFjoIX3vLjoIX3v6mjog+3vnFDoAkvn:4EnLB383AqWv3vL3v6d3v9dmn
                                                                                                                                                                                                                          MD5:07EEADB8C2F2425FF9A27E46A81827A2
                                                                                                                                                                                                                          SHA1:AA18A651C64098C7885F1F869B9F221453F42987
                                                                                                                                                                                                                          SHA-256:AAD828BCBB512FBD9902DCDD3812247A74913CC574DEB07DA95A7BBE74B1FE48
                                                                                                                                                                                                                          SHA-512:1FA60B1A69B2F5FD2C009EC18695A937C4484D7C418F7E8398D95723B857698143E0584A546F9032B75894730CBBEF78453061AC13D90199FF702E148D983C28
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_BE DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset fr_BE TIME_FORMAT "%T".. ::msgcat::mcset fr_BE TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\fr_ca.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):286
                                                                                                                                                                                                                          Entropy (8bit):4.890376345610709
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xooIso13vLjo13v6mjo1+3vnFDoAkvn:4EnLB383vIF3vU3v6A3v9dmn
                                                                                                                                                                                                                          MD5:2F70BDDE7685E2892C5F79C632FC2F0F
                                                                                                                                                                                                                          SHA1:FD1A6F6042E59D1563ABB5858C348C1D785C435E
                                                                                                                                                                                                                          SHA-256:0624DF9A56723DDB89E59736C20A5837DEA2206A789EBE7EEF19AD287590CA45
                                                                                                                                                                                                                          SHA-512:50FC0C91AB2C75FFC4F100C0D42DFC4B2101DB9713FD77E6FF5BF3F25A0AF4A535A4709CF4586809CEEE76C25B66ABC0DD4FD61524510C57AA0E63EA8F46E8D5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_CA DATE_FORMAT "%Y-%m-%d".. ::msgcat::mcset fr_CA TIME_FORMAT "%T".. ::msgcat::mcset fr_CA TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_CA DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\fr_ch.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):288
                                                                                                                                                                                                                          Entropy (8bit):4.913241133684606
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoFt28oF+3vLjoF+3v6mjo++3vnFDoAkvn:4EnLB383yte+3vs+3v6/3v9dmn
                                                                                                                                                                                                                          MD5:83FC7EBA68C3727F7C13C8EEAF79823F
                                                                                                                                                                                                                          SHA1:81C27F9B97F5F5190F7189230535EC09CD228158
                                                                                                                                                                                                                          SHA-256:290CA6EB74BAEAC4E2420D0755D148849F89EE87E37860F25CBB7B8AFA3EDCBC
                                                                                                                                                                                                                          SHA-512:35DA46558A246D7B3FAB02208001CE986E2E6DD88D6318AF743F4E81CA6920471D1425BB009A7476A79E7F61E1353C027B765331CD8EFA07A9E884DCB73F2195
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_CH DATE_FORMAT "%d. %m. %y".. ::msgcat::mcset fr_CH TIME_FORMAT "%T".. ::msgcat::mcset fr_CH TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_CH DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ga.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1188
                                                                                                                                                                                                                          Entropy (8bit):4.314271783103334
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR835k0CM/hlrXa754pD73/tKSx54pbIK5f2CA:43W05rXUa173/VadDA
                                                                                                                                                                                                                          MD5:67D137E5D853DB61A4B4264871E793F7
                                                                                                                                                                                                                          SHA1:4280E7F662DE792175AF8B4C93874F035F716F0F
                                                                                                                                                                                                                          SHA-256:880806867ACABD9B39E3029A5ADD26B690CC5709082D43B0959EBA725EA07AB5
                                                                                                                                                                                                                          SHA-512:C27B745143539D3E6D94BB754DCA35065CDE9B1AA6EE038D47F658175CFACC20236124D38BE5BBB03CAF8F613BD748C43CB8DFCC9234E915D18B5A477BAEF94E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ga DAYS_OF_WEEK_ABBREV [list \.. "Domh"\.. "Luan"\.. "M\u00e1irt"\.. "C\u00e9ad"\.. "D\u00e9ar"\.. "Aoine"\.. "Sath"].. ::msgcat::mcset ga DAYS_OF_WEEK_FULL [list \.. "D\u00e9 Domhnaigh"\.. "D\u00e9 Luain"\.. "D\u00e9 M\u00e1irt"\.. "D\u00e9 C\u00e9adaoin"\.. "D\u00e9ardaoin"\.. "D\u00e9 hAoine"\.. "D\u00e9 Sathairn"].. ::msgcat::mcset ga MONTHS_ABBREV [list \.. "Ean"\.. "Feabh"\.. "M\u00e1rta"\.. "Aib"\.. "Beal"\.. "Meith"\.. "I\u00fail"\.. "L\u00fan"\.. "MF\u00f3mh"\.. "DF\u00f3mh"\.. "Samh"\.. "Noll"\.. ""].. ::msgcat::mcset ga MONTHS_FULL [list \.. "Ean\u00e1ir"\.. "Feabhra"\.. "M\u00e1rta"\.. "Aibre\u00e1n"\.. "M\u00ed na Bealtaine"\.. "Meith"\..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ga_ie.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):286
                                                                                                                                                                                                                          Entropy (8bit):4.824539027053997
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xobHAygDobHAqo+3vLjobHAqo+3v6mjobHAy9+3vnFDoAkv:4EnLB383p23vy3v6a3v9dmn
                                                                                                                                                                                                                          MD5:C27BD7F317AAADB380F4C38AE0D2FDA6
                                                                                                                                                                                                                          SHA1:79870A0E68AA0A9B301414EDC21889F83BB81E40
                                                                                                                                                                                                                          SHA-256:3F9615C617D3CDBC1E127B3EFEE785B0CB5E92E17B7DABAC80DA2BEAF076362C
                                                                                                                                                                                                                          SHA-512:3605B9A914284CF1D3CC90DF2F21A86C0472AEE59800942DC93D842C7AE164E1DA72813787F163DC80B72269D2C391953ABAD6A8B72CCF069BEE96D418A173E9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ga_IE DATE_FORMAT "%d.%m.%y".. ::msgcat::mcset ga_IE TIME_FORMAT "%T".. ::msgcat::mcset ga_IE TIME_FORMAT_12 "%T".. ::msgcat::mcset ga_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\gl.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):997
                                                                                                                                                                                                                          Entropy (8bit):4.120890519790248
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83okzalCcPdJ5rK8yzMY4JlV1ZDqqIkFo8w:43JkPj9K8y4HHZLIQtw
                                                                                                                                                                                                                          MD5:A3D098C1A47E380F7C25233A52FBDE38
                                                                                                                                                                                                                          SHA1:C97E4EAA9E7A7F99950F422B93C57134B532C639
                                                                                                                                                                                                                          SHA-256:34D61B49DBF9584893051FFB458D6DE9E7E2E7774AC0011F70C4DD4184EBA81C
                                                                                                                                                                                                                          SHA-512:4687AB3D2FAA65FED90678EBC08C074959E93A9FEFAF3D61EEE39DB08FD200CB57C0DDB4DDBF6451FE1EF5E07EA976EDEF830769FF403CE51734129CEF24DA9F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gl DAYS_OF_WEEK_ABBREV [list \.. "Dom"\.. "Lun"\.. "Mar"\.. "M\u00e9r"\.. "Xov"\.. "Ven"\.. "S\u00e1b"].. ::msgcat::mcset gl DAYS_OF_WEEK_FULL [list \.. "Domingo"\.. "Luns"\.. "Martes"\.. "M\u00e9rcores"\.. "Xoves"\.. "Venres"\.. "S\u00e1bado"].. ::msgcat::mcset gl MONTHS_ABBREV [list \.. "Xan"\.. "Feb"\.. "Mar"\.. "Abr"\.. "Mai"\.. "Xu\u00f1"\.. "Xul"\.. "Ago"\.. "Set"\.. "Out"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset gl MONTHS_FULL [list \.. "Xaneiro"\.. "Febreiro"\.. "Marzo"\.. "Abril"\.. "Maio"\.. "Xu\u00f1o"\.. "Xullo"\.. "Agosto"\.. "Setembro"\.. "Outubro"\.. "Novembro"\.. "Decembro"\.. ""]..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\gl_es.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.886176304042503
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoPhkgMoPxsF3v6ay/5oPhk9+3vR6HyFvn:4EnLB383WrfK3v6ay/WJ3voSVn
                                                                                                                                                                                                                          MD5:78B9163C5E8E5E7049CBF91D1A5889A4
                                                                                                                                                                                                                          SHA1:F2F07AF3D79D61C8E0C73B13E2CA8266E10E396B
                                                                                                                                                                                                                          SHA-256:B5688CA07D713227B713655877710258CD503617E8DF79293A971649E3134F05
                                                                                                                                                                                                                          SHA-512:E86074B687670542CFA097C94D150292E1A73C9F231E92CD84386580A446569CC6F8F5817F46ED64A1D00F95D59F6F1F5D4B961DF3C8335938D83F3517794353
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gl_ES DATE_FORMAT "%d %B %Y".. ::msgcat::mcset gl_ES TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset gl_ES DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\gv.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1084
                                                                                                                                                                                                                          Entropy (8bit):4.213672208102291
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR832vTXAC2/fS5JfaCroeLaCAQbSm5qJe1:43QTXs32zrf
                                                                                                                                                                                                                          MD5:518FC3964D50854081FB79189A42D3E7
                                                                                                                                                                                                                          SHA1:59392F16CD56E3E6A685F78974D539FB3A972B98
                                                                                                                                                                                                                          SHA-256:404795F2C88D0038F9ED0B5120A251D26EDF8B236E1B1698BC71ACD4DC75AC45
                                                                                                                                                                                                                          SHA-512:E5C88CAB8741D631938CEC2E0959C0FE26685C395F5F9F4F1B5C9E146E84D23D897CD7A823AB46D4B62C590AE15EC76B87EB59308ACFB1BB6F61398890B43622
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gv DAYS_OF_WEEK_ABBREV [list \.. "Jed"\.. "Jel"\.. "Jem"\.. "Jerc"\.. "Jerd"\.. "Jeh"\.. "Jes"].. ::msgcat::mcset gv DAYS_OF_WEEK_FULL [list \.. "Jedoonee"\.. "Jelhein"\.. "Jemayrt"\.. "Jercean"\.. "Jerdein"\.. "Jeheiney"\.. "Jesarn"].. ::msgcat::mcset gv MONTHS_ABBREV [list \.. "J-guer"\.. "T-arree"\.. "Mayrnt"\.. "Avrril"\.. "Boaldyn"\.. "M-souree"\.. "J-souree"\.. "Luanistyn"\.. "M-fouyir"\.. "J-fouyir"\.. "M.Houney"\.. "M.Nollick"\.. ""].. ::msgcat::mcset gv MONTHS_FULL [list \.. "Jerrey-geuree"\.. "Toshiaght-arree"\.. "Mayrnt"\.. "Averil"\.. "Boaldyn"\.. "Mean-souree"\.. "Jerrey-souree"\.. "Luanistyn"\.. "Mean-fouyir"\..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\gv_gb.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.936566750568767
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoQbtvMoQLE3v6ay/5oQbto+3vR6HyFvn:4EnLB383PbtvALE3v6ay/PbtF3voSVn
                                                                                                                                                                                                                          MD5:0B6BE614EF5F5F25A30D2D33701A9F94
                                                                                                                                                                                                                          SHA1:65800FBD73D9DAE550E04E1D818A6B9D1AEF86FE
                                                                                                                                                                                                                          SHA-256:86CABF3B9360C0E686CC4CBEB843E971C28BC6D35210ED378B54EB58CC41F3D5
                                                                                                                                                                                                                          SHA-512:376D21B38DA49A8F7C2983F2B808FD55AC9F6383BC66DF28DB99DBF61FDC9FFF8CD20F077EC3ED873EF47F0F613BDD9AD02DFFB1CB51F9A36715C7FC798C3B70
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gv_GB DATE_FORMAT "%d %B %Y".. ::msgcat::mcset gv_GB TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset gv_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\he.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1990
                                                                                                                                                                                                                          Entropy (8bit):4.298934047406144
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83Y71LCLxL0eCLbCLKCLaCLXL7CLB0p1dLGCoCLU5LT5Gv5LJ9p5LnLEHLGCh:43sl7KqpU/nNbhbOezd2ICn
                                                                                                                                                                                                                          MD5:A0E60036EB17208A449AAFC3AAAE622C
                                                                                                                                                                                                                          SHA1:9D7479BA85FBB00A2DF2B61F4ED2CBEA8F1EC8C3
                                                                                                                                                                                                                          SHA-256:787DA79AF58872BF45AB09E3B6A920A4496B5BD8A4F3C7F010CF013EC2E8EFE0
                                                                                                                                                                                                                          SHA-512:46D12C14B5736E5EA97EB728BF58999E9D7C2CF910D8F5AFA3F5D3A86329ABF41A3E2BEBD81EE4EF64BEA0DC173B77A9FE12471C1BD9D768ED552A55B3B80213
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset he DAYS_OF_WEEK_ABBREV [list \.. "\u05d0"\.. "\u05d1"\.. "\u05d2"\.. "\u05d3"\.. "\u05d4"\.. "\u05d5"\.. "\u05e9"].. ::msgcat::mcset he DAYS_OF_WEEK_FULL [list \.. "\u05d9\u05d5\u05dd \u05e8\u05d0\u05e9\u05d5\u05df"\.. "\u05d9\u05d5\u05dd \u05e9\u05e0\u05d9"\.. "\u05d9\u05d5\u05dd \u05e9\u05dc\u05d9\u05e9\u05d9"\.. "\u05d9\u05d5\u05dd \u05e8\u05d1\u05d9\u05e2\u05d9"\.. "\u05d9\u05d5\u05dd \u05d7\u05de\u05d9\u05e9\u05d9"\.. "\u05d9\u05d5\u05dd \u05e9\u05d9\u05e9\u05d9"\.. "\u05e9\u05d1\u05ea"].. ::msgcat::mcset he MONTHS_ABBREV [list \.. "\u05d9\u05e0\u05d5"\.. "\u05e4\u05d1\u05e8"\.. "\u05de\u05e8\u05e5"\.. "\u05d0\u05e4\u05e8"\.. "\u05de\u05d0\u05d9"\.. "\u05d9\u05d5\u05e0"\.. "\u05d9\u05d5\u05dc"\.. "\u05d0\u05d5\u05d2"\..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\hi.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1777
                                                                                                                                                                                                                          Entropy (8bit):4.2117128941697715
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:438n4kALqrU1fbokQTbWqrU1fbokQTw38:28OD86D8gM
                                                                                                                                                                                                                          MD5:4219A929E27308ADC04A9F368F063F38
                                                                                                                                                                                                                          SHA1:FA728EEBA8751F4CE032ED32AECFDE124D1B68E2
                                                                                                                                                                                                                          SHA-256:192F4A8E77E1627712F85533C9896EF6A040157C7BD56DF3A4A7FA56AD6746C2
                                                                                                                                                                                                                          SHA-512:223B137AC1FC15908F5541067736EF3A29493549B963393EB78660036A82982E57CFC4AD09CBD33D32A5187FF9F4ACFB5F83A0C974702434B7FAD1B2539B7F76
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hi DAYS_OF_WEEK_FULL [list \.. "\u0930\u0935\u093f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0932\u0935\u093e\u0930"\.. "\u092c\u0941\u0927\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset hi MONTHS_ABBREV [list \.. "\u091c\u0928\u0935\u0930\u0940"\.. "\u092b\u093c\u0930\u0935\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u0905\u092a\u094d\u0930\u0947\u0932"\.. "\u092e\u0908"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u093e\u0908"\.. "\u0905\u0917\u0938\u094d\u0924"\.. "\u0938\u093f\u0924\u092e\u094d\u092c\u0930"\.. "\u0905\u0915\u094d\u091f\u0942\u092c\u0930"\.. "\u0928\u0935\u

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\hi_in.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.9286948144352865
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xocv+IZoz3v6ry/5oco+3v+6f6HyFvn:4EnLB383Jvlg3v6ry/JF3vmSVn
                                                                                                                                                                                                                          MD5:1C1E1484EA0286175FADCB90937C9F34
                                                                                                                                                                                                                          SHA1:5CA1BF19021D529CB3B3A308EFFFCA7E4D073640
                                                                                                                                                                                                                          SHA-256:5A3BF0DD61BFB5A2BF75E96B11E0E3528FFAB720A0BF1923853606F8CAF0E76D
                                                                                                                                                                                                                          SHA-512:F9A43E1E18ADB6DC6B18BEDC3303A99F514DF6CA54F12100989F734233012D7D60216116915351CCACC12F6942795BF8F3BBD26B15A86E88101067D64BEE54F5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hi_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset hi_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset hi_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\hr.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1171
                                                                                                                                                                                                                          Entropy (8bit):4.36311224714184
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83dVX79VIE9bLTWnh7rT+5dPcdvgrNv5KvOA1:43kmrQ7n+odIrJ6OS
                                                                                                                                                                                                                          MD5:906963A3AD09EAC781B35C190B77484E
                                                                                                                                                                                                                          SHA1:E5AA49DA9C4987EAFA839115F84612426EB8615E
                                                                                                                                                                                                                          SHA-256:105A9180BC5D23738183374FA0EA8DD80484BF3947E1432E515BDC2913C017D9
                                                                                                                                                                                                                          SHA-512:557BD1C8306750D09215D9774069A52C7D60E03DE2DF39FF909A8F658AB0565739D127E24ACDC96F736C69A71BEFA30B8A30BB489C7B7FDEA85386C802166349
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hr DAYS_OF_WEEK_ABBREV [list \.. "ned"\.. "pon"\.. "uto"\.. "sri"\.. "\u010det"\.. "pet"\.. "sub"].. ::msgcat::mcset hr DAYS_OF_WEEK_FULL [list \.. "nedjelja"\.. "ponedjeljak"\.. "utorak"\.. "srijeda"\.. "\u010detvrtak"\.. "petak"\.. "subota"].. ::msgcat::mcset hr MONTHS_ABBREV [list \.. "sij"\.. "vel"\.. "o\u017eu"\.. "tra"\.. "svi"\.. "lip"\.. "srp"\.. "kol"\.. "ruj"\.. "lis"\.. "stu"\.. "pro"\.. ""].. ::msgcat::mcset hr MONTHS_FULL [list \.. "sije\u010danj"\.. "velja\u010da"\.. "o\u017eujak"\.. "travanj"\.. "svibanj"\.. "lipanj"\.. "srpanj"\.. "kolovoz"\.. "rujan"\.. "listopad"\.. "studeni"\.. "prosinac"\..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\hu.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1381
                                                                                                                                                                                                                          Entropy (8bit):4.511450677731002
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83IFb7ZTmKrkAYm2LZyyApLDV2uZi5WF+shHUTyvtsv+:43C3ZTmKQAyZyyAp0BotK+
                                                                                                                                                                                                                          MD5:E398158EE1CD49CB5286D9642D4A61DD
                                                                                                                                                                                                                          SHA1:A93A588B0ADD198C067C4BB070DC1E5170E6E208
                                                                                                                                                                                                                          SHA-256:993475532F89E1EA7214ADB265294040862305612D680CFF01DD20615B731CCC
                                                                                                                                                                                                                          SHA-512:9E5791FB97110FE5F7A1F49FF2ED8801A05E49D5B9AF579474C0081073D2B40ECFFE6E4EB5B61F12B1995FDCC0A557CB572E5E116F951FD286A6254253DAEC01
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hu DAYS_OF_WEEK_ABBREV [list \.. "V"\.. "H"\.. "K"\.. "Sze"\.. "Cs"\.. "P"\.. "Szo"].. ::msgcat::mcset hu DAYS_OF_WEEK_FULL [list \.. "vas\u00e1rnap"\.. "h\u00e9tf\u0151"\.. "kedd"\.. "szerda"\.. "cs\u00fct\u00f6rt\u00f6k"\.. "p\u00e9ntek"\.. "szombat"].. ::msgcat::mcset hu MONTHS_ABBREV [list \.. "jan."\.. "febr."\.. "m\u00e1rc."\.. "\u00e1pr."\.. "m\u00e1j."\.. "j\u00fan."\.. "j\u00fal."\.. "aug."\.. "szept."\.. "okt."\.. "nov."\.. "dec."\.. ""].. ::msgcat::mcset hu MONTHS_FULL [list \.. "janu\u00e1r"\.. "febru\u00e1r"\.. "m\u00e1rcius"\.. "\u00e1prilis"\.. "m\u00e1jus"\.. "j\u00fanius"\.. "j\u00falius"\.. "augusztus"\.. "szeptembe

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\id.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):961
                                                                                                                                                                                                                          Entropy (8bit):4.02166638427728
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83dcTcWKutdXaMmEfc2ftdT2dHblWZ0VT:43dQrKutdntdI8g
                                                                                                                                                                                                                          MD5:191ACF2E8A8F10A1360B283D42886382
                                                                                                                                                                                                                          SHA1:EE2C00D021381EA638B6CE3F395DEA5F8491ED9B
                                                                                                                                                                                                                          SHA-256:41C0C3D3B4491E9B36E719466503EFCD325175CB7824C4A5055CB113D347BE0F
                                                                                                                                                                                                                          SHA-512:29BC4F7D3FAE7DE392B175FEA76138FA823B7D9D0B051A19A73F7D36D51DE34E0D0C7C129867307ABF51FC92E70853C15BD96B8484AD21EAB0A8EB83B0411E03
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset id DAYS_OF_WEEK_ABBREV [list \.. "Min"\.. "Sen"\.. "Sel"\.. "Rab"\.. "Kam"\.. "Jum"\.. "Sab"].. ::msgcat::mcset id DAYS_OF_WEEK_FULL [list \.. "Minggu"\.. "Senin"\.. "Selasa"\.. "Rabu"\.. "Kamis"\.. "Jumat"\.. "Sabtu"].. ::msgcat::mcset id MONTHS_ABBREV [list \.. "Jan"\.. "Peb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Agu"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset id MONTHS_FULL [list \.. "Januari"\.. "Pebruari"\.. "Maret"\.. "April"\.. "Mei"\.. "Juni"\.. "Juli"\.. "Agustus"\.. "September"\.. "Oktober"\.. "November"\.. "Desember"\.. ""]..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\id_id.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.904408530699153
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo0kGMo0F/W3v6ay/5o0kT+3vR6HyFvn:4EnLB383wG33v6ay/wK3voSVn
                                                                                                                                                                                                                          MD5:FEB4D50576BF3E11A0A40FD29ABE35A7
                                                                                                                                                                                                                          SHA1:8CEAA187C8AA5EC101743060A877D039850964CA
                                                                                                                                                                                                                          SHA-256:BA7FC0C0452D3E482DB6E19BDF512CACED639BA72B92ED8F66D80B52FEA11AC0
                                                                                                                                                                                                                          SHA-512:8B5D18E3D6628F369FB387C8EF08CC80000E0CBE500972958F4AD75F1C2F0DD6058F9777BD7DD0D7C26E7ECAA65E5071E2BF51B560973E88637942116C7576FB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset id_ID DATE_FORMAT "%d %B %Y".. ::msgcat::mcset id_ID TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset id_ID DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\is.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1305
                                                                                                                                                                                                                          Entropy (8bit):4.457417703528286
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83XVhVTeMVHGPbfXSmWzaZlfFxUQbW1U6ZY95n123etvmv3eTn:43Xz0b/uzaZtXUMw8n
                                                                                                                                                                                                                          MD5:ACF0452D5BB6D36A40061D2B0AF4D7A6
                                                                                                                                                                                                                          SHA1:9DF4D88F1962A672EFBDDE524550F7A5D02D446D
                                                                                                                                                                                                                          SHA-256:778BE3D6BFE2DFFB64FF1AFB9EC8351A3343B314CF93A68E8F7FD1073EE122BB
                                                                                                                                                                                                                          SHA-512:34CC02D7D28B5E161ED10250C214375561FD3D00979BFB8BCF3DB72A81BD9B7C225301528B400F7C54D8B6379F772EB6477D5D03F2CF7DC4DD19D22AEEC151B5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset is DAYS_OF_WEEK_ABBREV [list \.. "sun."\.. "m\u00e1n."\.. "\u00feri."\.. "mi\u00f0."\.. "fim."\.. "f\u00f6s."\.. "lau."].. ::msgcat::mcset is DAYS_OF_WEEK_FULL [list \.. "sunnudagur"\.. "m\u00e1nudagur"\.. "\u00feri\u00f0judagur"\.. "mi\u00f0vikudagur"\.. "fimmtudagur"\.. "f\u00f6studagur"\.. "laugardagur"].. ::msgcat::mcset is MONTHS_ABBREV [list \.. "jan."\.. "feb."\.. "mar."\.. "apr."\.. "ma\u00ed"\.. "j\u00fan."\.. "j\u00fal."\.. "\u00e1g\u00fa."\.. "sep."\.. "okt."\.. "n\u00f3v."\.. "des."\.. ""].. ::msgcat::mcset is MONTHS_FULL [list \.. "jan\u00faar"\.. "febr\u00faar"\.. "mars"\.. "apr\u00edl"\.. "ma\u00ed"\.. "j\u00fan\u00ed"\.. "j\u00fal\

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\it.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1294
                                                                                                                                                                                                                          Entropy (8bit):4.282101355195382
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83JYEVI2vfYpQjAOnhWBIIsmdC2lkOKk+Z+FoPJ6G3vesvY:43JZVB8eAOnh4IzR2+J6G/eKY
                                                                                                                                                                                                                          MD5:3354A6FC06C298E33AA14163929E56EB
                                                                                                                                                                                                                          SHA1:C3005370DAE8A266AE21F7E2B871AEA5A656A155
                                                                                                                                                                                                                          SHA-256:1D72170B9F9028A237364F7CD7EA8B48BD4770E61922205CE862300103B13DE5
                                                                                                                                                                                                                          SHA-512:58B64D4F5827CA2A1BF2DDFD1F7EFDDBBD46709A6A9B7277E8EB386D80043A87ADDE2B3D5A49A934E8EB8F797BD735FADA1D22AD3DD856FFE9507F71B9E45CBA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset it DAYS_OF_WEEK_ABBREV [list \.. "dom"\.. "lun"\.. "mar"\.. "mer"\.. "gio"\.. "ven"\.. "sab"].. ::msgcat::mcset it DAYS_OF_WEEK_FULL [list \.. "domenica"\.. "luned\u00ec"\.. "marted\u00ec"\.. "mercoled\u00ec"\.. "gioved\u00ec"\.. "venerd\u00ec"\.. "sabato"].. ::msgcat::mcset it MONTHS_ABBREV [list \.. "gen"\.. "feb"\.. "mar"\.. "apr"\.. "mag"\.. "giu"\.. "lug"\.. "ago"\.. "set"\.. "ott"\.. "nov"\.. "dic"\.. ""].. ::msgcat::mcset it MONTHS_FULL [list \.. "gennaio"\.. "febbraio"\.. "marzo"\.. "aprile"\.. "maggio"\.. "giugno"\.. "luglio"\.. "agosto"\.. "settembre"\.. "ottobre"\.. "novembre"\.. "dicembre"\.. "

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\it_ch.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):250
                                                                                                                                                                                                                          Entropy (8bit):4.8982877714191035
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoi5jL/oyJ+3v1oia+3vjLtAsvn:4EnLB383b3F+3vV3v3tnn
                                                                                                                                                                                                                          MD5:E4400C16406A46C2880250522BED2EDE
                                                                                                                                                                                                                          SHA1:787A04037A355FF845025B8865335EB938280BFB
                                                                                                                                                                                                                          SHA-256:24B5F303F5C7AF6F63FDC23ADB4D713087AE74B6D18C117D787AF03374C5F57E
                                                                                                                                                                                                                          SHA-512:3551DEEF0EAAC66042143F77F2F4DD9154764F35BD624DAB3C9F0F59F3489CA39CE34BC2A69BC5BFBB1926C6F5C39D74A806ECB1A47F6B374101071957FD417B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset it_CH DATE_FORMAT "%e. %B %Y".. ::msgcat::mcset it_CH TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset it_CH DATE_TIME_FORMAT "%e. %B %Y %H:%M:%S %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ja.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1689
                                                                                                                                                                                                                          Entropy (8bit):4.951012555106795
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83Gl84OCtnbf3wvtMwvLv4GTwhvevTwSoXghGhD6h:43FULWttbdEVoES8gshD6h
                                                                                                                                                                                                                          MD5:11FBE427747012444AEEAFD6134034A4
                                                                                                                                                                                                                          SHA1:58C72C432053264EAE6335D6CC93C5FFA33C42B8
                                                                                                                                                                                                                          SHA-256:2B6D15A191437F1B84FA7023E34153B61E6BF1DE1452EA921E9CCBBE5D4BEB1C
                                                                                                                                                                                                                          SHA-512:4F993BDF5D50D6D9F7410C83D226FEF30BA8C989F9977A7025C36BE22CEECCD6C68CDD6AFC5C9CE3D700559C4EDC619042E14DD88EE7583B9D5AA66F0268FD23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ja DAYS_OF_WEEK_ABBREV [list \.. "\u65e5"\.. "\u6708"\.. "\u706b"\.. "\u6c34"\.. "\u6728"\.. "\u91d1"\.. "\u571f"].. ::msgcat::mcset ja DAYS_OF_WEEK_FULL [list \.. "\u65e5\u66dc\u65e5"\.. "\u6708\u66dc\u65e5"\.. "\u706b\u66dc\u65e5"\.. "\u6c34\u66dc\u65e5"\.. "\u6728\u66dc\u65e5"\.. "\u91d1\u66dc\u65e5"\.. "\u571f\u66dc\u65e5"].. ::msgcat::mcset ja MONTHS_FULL [list \.. "1\u6708"\.. "2\u6708"\.. "3\u6708"\.. "4\u6708"\.. "5\u6708"\.. "6\u6708"\.. "7\u6708"\.. "8\u6708"\.. "9\u6708"\.. "10\u6708"\.. "11\u6708"\.. "12\u6708"].. ::msgcat::mcset ja BCE "\u7d00\u5143\u524d".. ::msgcat::mcset ja CE "\u897f\u66a6".. ::msgcat::mcset ja AM "\u5348\u524d".. ::msgcat::mcset ja PM "\u5348\u5f8c".. ::ms

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\kl.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1025
                                                                                                                                                                                                                          Entropy (8bit):4.097746630492712
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83E7XIE/OWbjH3Tw2PzJrIsmZ5maAXaMHPB:43WlrraA/vB
                                                                                                                                                                                                                          MD5:2F79804667D6F8C77BB188D59EF5F3DF
                                                                                                                                                                                                                          SHA1:10950ECA798F24A7C405B3E18B559CCC0C056EC1
                                                                                                                                                                                                                          SHA-256:96FF17F1CFF976E4E204D3616D1EFCED4D0F907C5E6A0F04B4536CB4AD1190C9
                                                                                                                                                                                                                          SHA-512:1B8ADC3B7FF920F8F53A17BFCC7EA24A0F8E276A42E5C63F9880DAE9B74E12716DD12DB647A80A9D99294449146C643EC58A33B03681AA4FA26A5FBC508C248C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kl DAYS_OF_WEEK_ABBREV [list \.. "sab"\.. "ata"\.. "mar"\.. "pin"\.. "sis"\.. "tal"\.. "arf"].. ::msgcat::mcset kl DAYS_OF_WEEK_FULL [list \.. "sabaat"\.. "ataasinngorneq"\.. "marlunngorneq"\.. "pingasunngorneq"\.. "sisamanngorneq"\.. "tallimanngorneq"\.. "arfininngorneq"].. ::msgcat::mcset kl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset kl MONTHS_FULL [list \.. "januari"\.. "februari"\.. "martsi"\.. "aprili"\.. "maji"\.. "juni"\.. "juli"\.. "augustusi"\.. "septemberi"\.. "oktoberi"\.. "novemberi"\.. "dece

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\kl_gl.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):286
                                                                                                                                                                                                                          Entropy (8bit):4.882476709336307
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoEpb53FuoEpLE3vLjoEpLE3v6mjoEpba+3vnFDoAkvn:4EnLB383jF3Fyw3vxw3v6A/3v9dmn
                                                                                                                                                                                                                          MD5:255830678C8724E65C05A7E020E68B5B
                                                                                                                                                                                                                          SHA1:0AEA48AB0439C04F92B5CA9A3B5182718B7F116B
                                                                                                                                                                                                                          SHA-256:3027CFE9EBD2172CEFC15C025786CAD47A6E2894BF0474AFC1B0C341E70202AA
                                                                                                                                                                                                                          SHA-512:99039FFA7269DD136D1693121E261DB5586E86EC401D2B1EB8FB1D13A9A7F1E514D9FC941B838286B986C02ED281828ED67E59002D837E350A64F4832340516A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kl_GL DATE_FORMAT "%d %b %Y".. ::msgcat::mcset kl_GL TIME_FORMAT "%T".. ::msgcat::mcset kl_GL TIME_FORMAT_12 "%T".. ::msgcat::mcset kl_GL DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ko.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1621
                                                                                                                                                                                                                          Entropy (8bit):4.612163420716489
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:43fMlylslXlslxl1hVuqLGuqqntH4xUyw9:2fKYqVq3f
                                                                                                                                                                                                                          MD5:CCB2C2254D3FA3025183DB7E010CAD66
                                                                                                                                                                                                                          SHA1:510BBB6A9162F2EF908E6561CC714848C2EA74CA
                                                                                                                                                                                                                          SHA-256:EF6FB319C398EEA79B3A951319F831F3B186D556565D17D738E5F9B4B77570F2
                                                                                                                                                                                                                          SHA-512:A0264565899BD1B0783ADC0388F893CCE713ADB23BDD63907CF092A74ACB4F7D3BE09DA29801E9C11A7B08CB1706E3771C598ACED351A0FCCBF4EBBD7871148D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ko DAYS_OF_WEEK_ABBREV [list \.. "\uc77c"\.. "\uc6d4"\.. "\ud654"\.. "\uc218"\.. "\ubaa9"\.. "\uae08"\.. "\ud1a0"].. ::msgcat::mcset ko DAYS_OF_WEEK_FULL [list \.. "\uc77c\uc694\uc77c"\.. "\uc6d4\uc694\uc77c"\.. "\ud654\uc694\uc77c"\.. "\uc218\uc694\uc77c"\.. "\ubaa9\uc694\uc77c"\.. "\uae08\uc694\uc77c"\.. "\ud1a0\uc694\uc77c"].. ::msgcat::mcset ko MONTHS_ABBREV [list \.. "1\uc6d4"\.. "2\uc6d4"\.. "3\uc6d4"\.. "4\uc6d4"\.. "5\uc6d4"\.. "6\uc6d4"\.. "7\uc6d4"\.. "8\uc6d4"\.. "9\uc6d4"\.. "10\uc6d4"\.. "11\uc6d4"\.. "12\uc6d4"\.. ""].. ::msgcat::mcset ko MONTHS_FULL [list \.. "1\uc6d4"\.. "2\uc6d4"\.. "3\uc6d4"\.. "4\uc6d4"\.. "5\uc6d4"\.. "6\uc6d4"\..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ko_kr.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):354
                                                                                                                                                                                                                          Entropy (8bit):5.058233326545794
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo56SFZhjAo56m5Ys5o56TGMovBo56a/W3v6mfKo56TT+3+:4EnLB383g62vjV6m5Ysg6TG26a+3v6oo
                                                                                                                                                                                                                          MD5:58CA45CE26AF8ECA729BA72898BB633D
                                                                                                                                                                                                                          SHA1:CBBEDB7370890A1DB65080A359A9A5C164B525D5
                                                                                                                                                                                                                          SHA-256:4CAC8FB43D290A63A4D3215F22228B358AB4FA174F08712DD6C5B64C5E485071
                                                                                                                                                                                                                          SHA-512:48CCBD3F7B96D0998B6D1A1F8D7FE2B4B070BB5B8809FABE0A38209AEAF2E95E098292A5B9B5F0954E7729708A2173D32AAD70B6C0F336DB1E9BFA2968E6A56B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ko_KR BCE "\uae30\uc6d0\uc804".. ::msgcat::mcset ko_KR CE "\uc11c\uae30".. ::msgcat::mcset ko_KR DATE_FORMAT "%Y.%m.%d".. ::msgcat::mcset ko_KR TIME_FORMAT_12 "%P %l:%M:%S".. ::msgcat::mcset ko_KR DATE_TIME_FORMAT "%Y.%m.%d %P %l:%M:%S %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\kok.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1997
                                                                                                                                                                                                                          Entropy (8bit):4.202940482570495
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83cm48Vc7VczMmDNVcYVcR0prdSmS68FeDJVcYVcR0prdSmS68FeuT:4354a+0prjS68mq0prjS68pT
                                                                                                                                                                                                                          MD5:67FA08F588A3B44D67E42EC1025013BC
                                                                                                                                                                                                                          SHA1:6895FEF0476DE0349895DB052B335AC46636B23A
                                                                                                                                                                                                                          SHA-256:9D215E31A39FED45B3657144E5F73C942E59E500036CE16B1FFF201FD6358595
                                                                                                                                                                                                                          SHA-512:4C2708BD9DD98320D3133EEFFD19A8018F49A36AB8348DB7C0B0287ADB4C052D3EFAD3686C8E46E0520F3CE27F361978272BA8752EB04E5A7BC07780398480DB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kok DAYS_OF_WEEK_FULL [list \.. "\u0906\u0926\u093f\u0924\u094d\u092f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u093e\u0930"\.. "\u092c\u0941\u0927\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset kok MONTHS_ABBREV [list \.. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\.. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u090f\u092a\u094d\u0930\u093f\u0932"\.. "\u092e\u0947"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u0948"\.. "\u0913\u0917\u0938\u094d\u091f"\.. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\.. "\u0913\u0915\u094d\

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\kok_in.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):260
                                                                                                                                                                                                                          Entropy (8bit):4.904340548436718
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo5VsNv+IZo5VsU3v6ry/5o5VsNo+3v+6f6HyFvn:4EnLB383gVsNvlAVsU3v6ry/gVsNF3vj
                                                                                                                                                                                                                          MD5:0AA20289A63BA3A14DCFED75EED980DE
                                                                                                                                                                                                                          SHA1:2B76013593D886B0724D82849FD1840B20922902
                                                                                                                                                                                                                          SHA-256:644F2B6D4BA27AF14891B781DEF60F708A9F18FC2F73566649B631A6DEA3EF09
                                                                                                                                                                                                                          SHA-512:6E13E0DC8BFD2ABE0D04B0BC098C40972F088F8D3D6ACA00338B17473ABC6F69840A88EC0C965C493B4270DEC777A0EA2D762BC33044EFE7030E437604EE201B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kok_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset kok_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset kok_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\kw.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1013
                                                                                                                                                                                                                          Entropy (8bit):4.060027087416375
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83no1UwRlw4MAwBdc//3rpF6HFoot8:43vglHM7MTCHFs
                                                                                                                                                                                                                          MD5:CCEC7B77DCA1F6A406311FC43EE57030
                                                                                                                                                                                                                          SHA1:4ED329BB09A8F7C67F8984CD790E9B6819DE6F00
                                                                                                                                                                                                                          SHA-256:EAB468AC5BF1833D4F8CD658789413D4A46CAD16B63FB9B906CFF6DC9EA26251
                                                                                                                                                                                                                          SHA-512:4EFF6E49CC479A1BF0CEEAE256A1FAE7D4AE7D0ACE23CD87851471EC96BB5AF580C58A142E1B6CE72BC8B6BFF946A38801E681443B7DD9527A1DEB6E7EDD7D22
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kw DAYS_OF_WEEK_ABBREV [list \.. "Sul"\.. "Lun"\.. "Mth"\.. "Mhr"\.. "Yow"\.. "Gwe"\.. "Sad"].. ::msgcat::mcset kw DAYS_OF_WEEK_FULL [list \.. "De Sul"\.. "De Lun"\.. "De Merth"\.. "De Merher"\.. "De Yow"\.. "De Gwener"\.. "De Sadorn"].. ::msgcat::mcset kw MONTHS_ABBREV [list \.. "Gen"\.. "Whe"\.. "Mer"\.. "Ebr"\.. "Me"\.. "Evn"\.. "Gor"\.. "Est"\.. "Gwn"\.. "Hed"\.. "Du"\.. "Kev"\.. ""].. ::msgcat::mcset kw MONTHS_FULL [list \.. "Mys Genver"\.. "Mys Whevrel"\.. "Mys Merth"\.. "Mys Ebrel"\.. "Mys Me"\.. "Mys Evan"\.. "Mys Gortheren"\.. "Mye Est"\.. "Mys Gwyngala"\.. "Mys Hedra"\.. "Mys Du"\.. "Mys Kevardhu"\..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\kw_gb.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.959913054070712
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoh6AvMoh633v6ay/5oh6Ao+3vR6HyFvn:4EnLB38346AvR633v6ay/46AF3voSVn
                                                                                                                                                                                                                          MD5:18E8576F63B978F1AFEF15AC57B44FBF
                                                                                                                                                                                                                          SHA1:D50EB90944FF81E3CBFF942B16C1874EB7EA2562
                                                                                                                                                                                                                          SHA-256:EDAC14D929D1C6559EC46E9B460F8F44A189B78FB915F2D641104549CBD94188
                                                                                                                                                                                                                          SHA-512:F3DE5EE77BB889DA1353F9C9A1811083AB28BBEE4B7D6C8782F38B1AE44CF77565371A0E18F7E2BACD7EF590BC1215CA3E41AF929A15F60B3E85F6099A4CF378
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kw_GB DATE_FORMAT "%d %B %Y".. ::msgcat::mcset kw_GB TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset kw_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\lt.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1307
                                                                                                                                                                                                                          Entropy (8bit):4.506235846178408
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83iHYuAMLzHYCaNu3d3nT15T31FhAlDgK/YrDZ/6Qz2C9kGPCveksvc:43iHFnHuUd3/T3xM/+SQCC9kGPEekKc
                                                                                                                                                                                                                          MD5:D4EC2E96995E0EB263F338DD16CC4F8D
                                                                                                                                                                                                                          SHA1:7ED86175489B1AE3CA5C0E8D42969F951C895D6B
                                                                                                                                                                                                                          SHA-256:855B652FCC8066BA45C7DC8DBFD3807D1B4759EA8D71C523567F47BF445D1DE6
                                                                                                                                                                                                                          SHA-512:A55E0D759A22360FF6668CEFAFFB812BABB316C447ADDB1FD5CDBC06AE1DA2E891E09952D073164C013AD9BF4184614102E7ADA553EEEFB2BBA26208B79B277F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset lt DAYS_OF_WEEK_ABBREV [list \.. "Sk"\.. "Pr"\.. "An"\.. "Tr"\.. "Kt"\.. "Pn"\.. "\u0160t"].. ::msgcat::mcset lt DAYS_OF_WEEK_FULL [list \.. "Sekmadienis"\.. "Pirmadienis"\.. "Antradienis"\.. "Tre\u010diadienis"\.. "Ketvirtadienis"\.. "Penktadienis"\.. "\u0160e\u0161tadienis"].. ::msgcat::mcset lt MONTHS_ABBREV [list \.. "Sau"\.. "Vas"\.. "Kov"\.. "Bal"\.. "Geg"\.. "Bir"\.. "Lie"\.. "Rgp"\.. "Rgs"\.. "Spa"\.. "Lap"\.. "Grd"\.. ""].. ::msgcat::mcset lt MONTHS_FULL [list \.. "Sausio"\.. "Vasario"\.. "Kovo"\.. "Baland\u017eio"\.. "Gegu\u017e\u0117s"\.. "Bir\u017eelio"\.. "Liepos"\.. "Rugpj\u016b\u010dio"\.. "Rugs\u0117jo"\.. "Spa

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\lv.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1271
                                                                                                                                                                                                                          Entropy (8bit):4.460631492946299
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83Amshb4mZdA7nl9kMmfpK269rkbi5vWm0W9ARivirXsv05vkn:430bHA7XRr95QWQQgaKkn
                                                                                                                                                                                                                          MD5:554ED2CAFD25F5F82DA54AE057F4BA98
                                                                                                                                                                                                                          SHA1:E25CDF0F9C4B523B5B05408E7820F7B4F627D19E
                                                                                                                                                                                                                          SHA-256:7E90D2008B220DB19C796C7107AD69D263B8AC8C7BDDFB879230699D978E9A0A
                                                                                                                                                                                                                          SHA-512:612201CCD64A51EC943921196D8C74D8BCA3AB3E35B0C9E91AE7F3A6B36F4F255AA9ADB3A254EC03629B01BD221B0B3F8CC4DFBFAC1F1718775E81CAD188AA86
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset lv DAYS_OF_WEEK_ABBREV [list \.. "Sv"\.. "P"\.. "O"\.. "T"\.. "C"\.. "Pk"\.. "S"].. ::msgcat::mcset lv DAYS_OF_WEEK_FULL [list \.. "sv\u0113tdiena"\.. "pirmdiena"\.. "otrdiena"\.. "tre\u0161diena"\.. "ceturdien"\.. "piektdiena"\.. "sestdiena"].. ::msgcat::mcset lv MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Maijs"\.. "J\u016bn"\.. "J\u016bl"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset lv MONTHS_FULL [list \.. "janv\u0101ris"\.. "febru\u0101ris"\.. "marts"\.. "apr\u012blis"\.. "maijs"\.. "j\u016bnijs"\.. "j\u016blijs"\.. "augusts"\.. "septembris"\.. "oktobris"\.. "novembris"\..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\mk.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2157
                                                                                                                                                                                                                          Entropy (8bit):4.299300188052441
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:4389QMsGqdQfRQPjQmofqJp9sk5BstSpWQiQ3QJQ5QL39I0QRQTQ8Ql4J8W:2W8SMq+9sWINi2Kc9I0+gXF
                                                                                                                                                                                                                          MD5:888014F13A82511ABEF99497A753BFC3
                                                                                                                                                                                                                          SHA1:7F4231BEDE191370B37E8B917B6AD8829D15CA7D
                                                                                                                                                                                                                          SHA-256:4C0EB07F0FCB36DD12A3F7EDD6531616611ABF62BF7705B5A37CC59098221D5D
                                                                                                                                                                                                                          SHA-512:D748127CC615584901D35B6492EC566448B6C4DA6363858B5145921E9CD09490355CF4315F0F7A8542AA12790CD3432011A643A3A8F74B0119DB0DCE19FD68A4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mk DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0435\u0434."\.. "\u043f\u043e\u043d."\.. "\u0432\u0442."\.. "\u0441\u0440\u0435."\.. "\u0447\u0435\u0442."\.. "\u043f\u0435\u0442."\.. "\u0441\u0430\u0431."].. ::msgcat::mcset mk DAYS_OF_WEEK_FULL [list \.. "\u043d\u0435\u0434\u0435\u043b\u0430"\.. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\.. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0441\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0440\u0442\u043e\u043a"\.. "\u043f\u0435\u0442\u043e\u043a"\.. "\u0441\u0430\u0431\u043e\u0442\u0430"].. ::msgcat::mcset mk MONTHS_ABBREV [list \.. "\u0458\u0430\u043d."\.. "\u0444\u0435\u0432."\.. "\u043c\u0430\u0440."\.. "\u0430\u043f\u0440."\.. "\u043c\u0430\u0458."\.. "\u0458\u0443\u

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\mr.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1846
                                                                                                                                                                                                                          Entropy (8bit):4.220147808639664
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR833cXh48Vc7VczfVczPmzNVcYVcR0prdSmS68FezUVcYVcR0prdSmS68FeoV:43K4S+0prjS68Yh0prjS68nV
                                                                                                                                                                                                                          MD5:07F99E0A05083B10F80A4D6867163B23
                                                                                                                                                                                                                          SHA1:B6036C7DA8043E3401583D03831E7A4BF755D93D
                                                                                                                                                                                                                          SHA-256:AE873BF5484EACBBE179913D43451BE53378FA701B5D81594D052266B8A09AF0
                                                                                                                                                                                                                          SHA-512:3A032C81B8FBFEE6EB66C1538CBD16329A1B393E4684B4E9B3FBCDD6344CE8AD34FA699F76EF953B3EB597D8E253345F54C2E92E7A43611C721038BCC2471EA2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mr DAYS_OF_WEEK_FULL [list \.. "\u0930\u0935\u093f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset mr MONTHS_ABBREV [list \.. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\.. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u090f\u092a\u094d\u0930\u093f\u0932"\.. "\u092e\u0947"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u0948"\.. "\u0913\u0917\u0938\u094d\u091f"\.. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\.. "\u0913\u0915\u094d\u091f\u0

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\mr_in.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.89440333975705
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoGNv+IZoGU3v6ry/5oGNo+3v+6f6HyFvn:4EnLB383Zvlw3v6ry/ZF3vmSVn
                                                                                                                                                                                                                          MD5:67368E8A5715860BABD44E54A168192F
                                                                                                                                                                                                                          SHA1:7790D4B4B28FE5E38AB11CD037FFB826A8EB77FD
                                                                                                                                                                                                                          SHA-256:B7B1D379355A1D278E13EF557A887A662E84FB6A9B62B8E19A27927926270EF9
                                                                                                                                                                                                                          SHA-512:E95C90CFFA7CC4E61026FC328A4AA0BEE6A54A0061BA0B9459F9F0F4B008DD36F81BC9B8D8B964FA051FCEAB7FECE6D107CD456B3FD01A83B4900ECC3A0BCFA4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mr_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset mr_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset mr_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ms.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):957
                                                                                                                                                                                                                          Entropy (8bit):4.018924167342869
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLB383Zm/aufodZmt+JHEA7UVRosmAL/7Idzr43xRRosuL1PJHWZ6tHhHjv:4aR83ZsauSHJkA7umE/72UD21PJWZ0hT
                                                                                                                                                                                                                          MD5:7E6A943B7D82404F61BDBD95682073CD
                                                                                                                                                                                                                          SHA1:B96DBB1738F293D2842FDCEDF2DEF13004F77A8D
                                                                                                                                                                                                                          SHA-256:970B2F3ECC04980FCC2F9531CA6CE2BF36BC12942CB614BF70313B4CB0508985
                                                                                                                                                                                                                          SHA-512:12F5A5F7A170EE79D1F4398E96FF2DE84472027C5B5003DE7E86F46713E3F0997439E2EBA03FFB7DB611F0CE0E06EB149F5BD08ED2AA0409DB8348867487FFFD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ms DAYS_OF_WEEK_ABBREV [list \.. "Aha"\.. "Isn"\.. "Sei"\.. "Rab"\.. "Kha"\.. "Jum"\.. "Sab"].. ::msgcat::mcset ms DAYS_OF_WEEK_FULL [list \.. "Ahad"\.. "Isnin"\.. "Selasa"\.. "Rahu"\.. "Khamis"\.. "Jumaat"\.. "Sabtu"].. ::msgcat::mcset ms MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mac"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Ogos"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dis"\.. ""].. ::msgcat::mcset ms MONTHS_FULL [list \.. "Januari"\.. "Februari"\.. "Mac"\.. "April"\.. "Mei"\.. "Jun"\.. "Julai"\.. "Ogos"\.. "September"\.. "Oktober"\.. "November"\.. "Disember"\.. ""]..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ms_my.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):265
                                                                                                                                                                                                                          Entropy (8bit):4.818053174805798
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoChFfluoChF+3v6xyFjoCh++3vflm68vn:4EnLB383xPflwe3v6gZl3vflm6+n
                                                                                                                                                                                                                          MD5:A02F11BE0DF920E63E7A3ACCE746E32D
                                                                                                                                                                                                                          SHA1:4A8B1EF1A6F8A5FD022042D6E009A01E4B0FEBD3
                                                                                                                                                                                                                          SHA-256:F5B859D8DD2A2B5F756E39B0DFEB26B95878D2F54BA3CE46C56F0F26CF2B554B
                                                                                                                                                                                                                          SHA-512:5F9AF8C89F491CB4C158ED73EA4CF32E6A83CF44A94DA6FE1A962C58199BF2348530F3DEFA0C6F433BA3ADEF81AE9B3884F30CD7A841B159D52F9F21008B4F92
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ms_MY DATE_FORMAT "%A %d %b %Y".. ::msgcat::mcset ms_MY TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset ms_MY DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\mt.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):717
                                                                                                                                                                                                                          Entropy (8bit):4.55153350337982
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLB383VYmxWHWog4QUbxMmAMMiGZu+3v6ay/GK3vZsSVn:4aR83VYsxonQ2MmVVGRvjCGsvGSV
                                                                                                                                                                                                                          MD5:D8BBEC2F8935054E6081BB5E4AE8F7E3
                                                                                                                                                                                                                          SHA1:33FE6D51A284B8760BC6F442329B10374F506BDA
                                                                                                                                                                                                                          SHA-256:7DBC4E82D82FDE8CDF522FA10E082289D46B0C1A4A7D7A5FA83FF116677F052B
                                                                                                                                                                                                                          SHA-512:BF39C75DD6B3625897D7D44AC253AF5656CA21D0B394F78611584E2606CBC419C4A02353542D23393BEBCCF0CB4D861CDECD61AD89339F78C0260E966B495777
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mt DAYS_OF_WEEK_ABBREV [list \.. "\u0126ad"\.. "Tne"\.. "Tli"\.. "Erb"\.. "\u0126am"\.. "\u0120im"].. ::msgcat::mcset mt MONTHS_ABBREV [list \.. "Jan"\.. "Fra"\.. "Mar"\.. "Apr"\.. "Mej"\.. "\u0120un"\.. "Lul"\.. "Awi"\.. "Set"\.. "Ott"\.. "Nov"].. ::msgcat::mcset mt BCE "QK".. ::msgcat::mcset mt CE "".. ::msgcat::mcset mt DATE_FORMAT "%A, %e ta %B, %Y".. ::msgcat::mcset mt TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset mt DATE_TIME_FORMAT "%A, %e ta %B, %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\nb.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1209
                                                                                                                                                                                                                          Entropy (8bit):4.313626715960843
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83B0tSYuZrIsmYmPAxyIQ4HU92W16EL3Tvav31:43qhuZrIPAt04yTcF
                                                                                                                                                                                                                          MD5:42D02C3CAF28BE4994F27CEF5A183AB7
                                                                                                                                                                                                                          SHA1:DC411E8AC12C3D588AB2F3A3C95A75D8689AD402
                                                                                                                                                                                                                          SHA-256:534C5DACEF12F818FAF4ED806997A559F95D591F1B6236B0C30B07A107DD13F3
                                                                                                                                                                                                                          SHA-512:0BE27572106324FE2B6CDFF4513500DE7582AD1ABEF451FFC62B2050D3875A149DDDB66451E1B3F5BA9216268E9998D2A1C1E8343BBB9EF97947DA054B82818E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nb DAYS_OF_WEEK_ABBREV [list \.. "s\u00f8"\.. "ma"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f8"].. ::msgcat::mcset nb DAYS_OF_WEEK_FULL [list \.. "s\u00f8ndag"\.. "mandag"\.. "tirsdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f8rdag"].. ::msgcat::mcset nb MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset nb MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "april"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "desember"\.. ""].. ::msgcat::mcset nb BC

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\nl.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1129
                                                                                                                                                                                                                          Entropy (8bit):4.235969198645435
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR837Ed+RxRMZZsmUmnZAEEHM92WFU5vtrvs:43AAHRMZZPnZALsCtt7s
                                                                                                                                                                                                                          MD5:B9B949794203D204628D4DBEA29587AE
                                                                                                                                                                                                                          SHA1:1642D8040144469B5C359E80693E68036F87B849
                                                                                                                                                                                                                          SHA-256:9E2FE3851CF13EC79A9B10A09B01CEB0A26044AE0DC90A4E00BE57745E854C79
                                                                                                                                                                                                                          SHA-512:0CCCCF6D61423CEE0389C3BA1A8E94F2B092C53465D1937F5595AF91E46DD38B318D6C7EE3D88B89F32BFB952C0D55E0E67B46D7DF306ECA6690E283ADEB2CB9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nl DAYS_OF_WEEK_ABBREV [list \.. "zo"\.. "ma"\.. "di"\.. "wo"\.. "do"\.. "vr"\.. "za"].. ::msgcat::mcset nl DAYS_OF_WEEK_FULL [list \.. "zondag"\.. "maandag"\.. "dinsdag"\.. "woensdag"\.. "donderdag"\.. "vrijdag"\.. "zaterdag"].. ::msgcat::mcset nl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mrt"\.. "apr"\.. "mei"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset nl MONTHS_FULL [list \.. "januari"\.. "februari"\.. "maart"\.. "april"\.. "mei"\.. "juni"\.. "juli"\.. "augustus"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset nl DATE_FORM

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\nl_be.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):286
                                                                                                                                                                                                                          Entropy (8bit):4.865165930946383
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo4gPPdjog9X3vLjog9X3v6mjo49+3vnFDoAkvn:4EnLB3835gHdPF3vjF3v64I3v9dmn
                                                                                                                                                                                                                          MD5:3261F397ED0291368FF1881E7BA08ECE
                                                                                                                                                                                                                          SHA1:7147ABB62034EB152B1FED9246A533535F07372C
                                                                                                                                                                                                                          SHA-256:77A69DD60D171B321512B14794E75A66FF753410C007997B310790D86E09B057
                                                                                                                                                                                                                          SHA-512:C1526F454FA594DAD056B056F76F01D8B2AB713D04EB2A3643416B8E741B248CC94E000BAEE5B0F60436B88B1216FB1DE7F7C3FA456D4A4FBDE24F97C3B739B8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nl_BE DATE_FORMAT "%d-%m-%y".. ::msgcat::mcset nl_BE TIME_FORMAT "%T".. ::msgcat::mcset nl_BE TIME_FORMAT_12 "%T".. ::msgcat::mcset nl_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\nn.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1200
                                                                                                                                                                                                                          Entropy (8bit):4.282788574144479
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83tCtrJwuQrIsmYmLAxyIQ4HU92W1W4/3Hv+v31:434suQrILAt0EafIF
                                                                                                                                                                                                                          MD5:985E97517C2BF37719A618F575DF392C
                                                                                                                                                                                                                          SHA1:65BC07FC3A955300ED09B7485F90AEC18CBAD43F
                                                                                                                                                                                                                          SHA-256:06FA2D6D8C59D0B8EAC2EDE5AB0DDB8B6E095D1A023B1966FCE3B65916FA14FB
                                                                                                                                                                                                                          SHA-512:75BC14DBAD147A98D32D2AF0BE0BE50F115BB9C3BBE283B53977B9F264A055734B30F6B1C4EEE9686F1874D178C535111731C92D495B7D370FB17213B65C9A40
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nn DAYS_OF_WEEK_ABBREV [list \.. "su"\.. "m\u00e5"\.. "ty"\.. "on"\.. "to"\.. "fr"\.. "lau"].. ::msgcat::mcset nn DAYS_OF_WEEK_FULL [list \.. "sundag"\.. "m\u00e5ndag"\.. "tysdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "laurdag"].. ::msgcat::mcset nn MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset nn MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "april"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "desember"\.. ""].. ::msgcat::mcset nn BCE "f.Kr."

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\pl.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1263
                                                                                                                                                                                                                          Entropy (8bit):4.459506202908786
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83lUj0ORGgIzdW6RDYKG7FwRc0ypvOvX:43+HMg2W6RDYnFwRc0ydYX
                                                                                                                                                                                                                          MD5:79AB7C13AA3833A1DAEADDB1144CCE55
                                                                                                                                                                                                                          SHA1:C01ABC2F16549CAEC6B081448B2CBA88A680E250
                                                                                                                                                                                                                          SHA-256:61462C325DB0065352D8155307F949869862A86CAC67AD7BB6703F57A7FA2FF3
                                                                                                                                                                                                                          SHA-512:79EB696164FDDD9B121558C2780E54E295FF2DC4D8E87A0DE507B4F2925612721A98FF5010199CB68CF894ACA7A07884E9E02F3DC1E078D241431E3DC884C0A1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pl DAYS_OF_WEEK_ABBREV [list \.. "N"\.. "Pn"\.. "Wt"\.. "\u015ar"\.. "Cz"\.. "Pt"\.. "So"].. ::msgcat::mcset pl DAYS_OF_WEEK_FULL [list \.. "niedziela"\.. "poniedzia\u0142ek"\.. "wtorek"\.. "\u015broda"\.. "czwartek"\.. "pi\u0105tek"\.. "sobota"].. ::msgcat::mcset pl MONTHS_ABBREV [list \.. "sty"\.. "lut"\.. "mar"\.. "kwi"\.. "maj"\.. "cze"\.. "lip"\.. "sie"\.. "wrz"\.. "pa\u017a"\.. "lis"\.. "gru"\.. ""].. ::msgcat::mcset pl MONTHS_FULL [list \.. "stycze\u0144"\.. "luty"\.. "marzec"\.. "kwiecie\u0144"\.. "maj"\.. "czerwiec"\.. "lipiec"\.. "sierpie\u0144"\.. "wrzesie\u0144"\.. "pa\u017adziernik"\.. "listopad"\..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\pt.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1177
                                                                                                                                                                                                                          Entropy (8bit):4.394980756969744
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83CYkjBc1yHYJt//0/I31YMY47flV7YaqgCyt9Fo8g6Gtvt76svi:43C5LHcNnxJ9Ltg6Gpt76Ki
                                                                                                                                                                                                                          MD5:8F53B3571DD29E12BD33349CFA32F28F
                                                                                                                                                                                                                          SHA1:C125E059B8BFE5FECD482D1A1DA50B8678872BF6
                                                                                                                                                                                                                          SHA-256:6F6EEEDDCF232BDCB952592A144810CED44A1CBB4BCC2C062D5F98D441505380
                                                                                                                                                                                                                          SHA-512:5CD7E7097B720E5399795126A71348816CBA697FD8F14160779E982ADAB00D5994978E2F9445785B0DE62F6F14232278AD1A65BC53730CA58D676B057F0BC406
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pt DAYS_OF_WEEK_ABBREV [list \.. "Dom"\.. "Seg"\.. "Ter"\.. "Qua"\.. "Qui"\.. "Sex"\.. "S\u00e1b"].. ::msgcat::mcset pt DAYS_OF_WEEK_FULL [list \.. "Domingo"\.. "Segunda-feira"\.. "Ter\u00e7a-feira"\.. "Quarta-feira"\.. "Quinta-feira"\.. "Sexta-feira"\.. "S\u00e1bado"].. ::msgcat::mcset pt MONTHS_ABBREV [list \.. "Jan"\.. "Fev"\.. "Mar"\.. "Abr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Ago"\.. "Set"\.. "Out"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset pt MONTHS_FULL [list \.. "Janeiro"\.. "Fevereiro"\.. "Mar\u00e7o"\.. "Abril"\.. "Maio"\.. "Junho"\.. "Julho"\.. "Agosto"\.. "Setembro"\.. "Outubro"\.. "Novembro"\.. "Dezembro"

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\pt_br.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):286
                                                                                                                                                                                                                          Entropy (8bit):4.8608779725401785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xofm6GPWWjofAW3vLjofAW3v6mjofm6T+3vnFDoAkvn:4EnLB383+NGdg93vk93v6fNK3v9dmn
                                                                                                                                                                                                                          MD5:A2626EA95C2480FEA68906AE6A1F6993
                                                                                                                                                                                                                          SHA1:A0592902337C00FC2E70B1DFB3A42453A86535BB
                                                                                                                                                                                                                          SHA-256:320BE7D5B730091E6FA35F196314737261C8E154577DCF6AC8C2057D44394AD7
                                                                                                                                                                                                                          SHA-512:9801A87D024565676D4F3EAF0702C213E59FC2B6719D8BE95C19C9ED53FC43487F65F5408378B401A2B4C2BD4E2E391C2D848CA87739A6082AB7766EC6B9EFE1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pt_BR DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset pt_BR TIME_FORMAT "%T".. ::msgcat::mcset pt_BR TIME_FORMAT_12 "%T".. ::msgcat::mcset pt_BR DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ro.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1224
                                                                                                                                                                                                                          Entropy (8bit):4.350784108088039
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83coPUMSeZmkTMm41icpK+7ZVoImEcVUCWdvHvWIn:43lPHFmkm1iMVoxEc+CWZPWIn
                                                                                                                                                                                                                          MD5:F6575EC17966320106FF7ABDFB3186E2
                                                                                                                                                                                                                          SHA1:68C6B72D664FDA27450FCE8B5734AB627CE825D7
                                                                                                                                                                                                                          SHA-256:25ED6AC7A353E23B954B98611AE3B7E56BDCF2B0CB0DB358253CFB8BEBBB831C
                                                                                                                                                                                                                          SHA-512:E564543231922A17C898419545BFA65E5E31FE9F005FDD201B735CFDE08E96FB3B98349C2A7959E29CA8F7E6934B0C4C6DE6B5E67209D0DD9A7746DFEBF037B3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ro DAYS_OF_WEEK_ABBREV [list \.. "D"\.. "L"\.. "Ma"\.. "Mi"\.. "J"\.. "V"\.. "S"].. ::msgcat::mcset ro DAYS_OF_WEEK_FULL [list \.. "duminic\u0103"\.. "luni"\.. "mar\u0163i"\.. "miercuri"\.. "joi"\.. "vineri"\.. "s\u00eemb\u0103t\u0103"].. ::msgcat::mcset ro MONTHS_ABBREV [list \.. "Ian"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mai"\.. "Iun"\.. "Iul"\.. "Aug"\.. "Sep"\.. "Oct"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset ro MONTHS_FULL [list \.. "ianuarie"\.. "februarie"\.. "martie"\.. "aprilie"\.. "mai"\.. "iunie"\.. "iulie"\.. "august"\.. "septembrie"\.. "octombrie"\.. "noiembrie"\.. "decembrie"\.. ""].. ::msgcat:

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ru.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2091
                                                                                                                                                                                                                          Entropy (8bit):4.2886524607041006
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:43D+pQ7keidQfRQPgQHB81Z/sFIAZSQWQXQrQxJQjQRnQBFQiWftkWt:26pgkeoSnpjA4tMYiJcCMFmVRt
                                                                                                                                                                                                                          MD5:9F1C8DD58550558977821FD500E7C0E0
                                                                                                                                                                                                                          SHA1:EFDD809BC2872A5BE0E353D31BE6D7D72E4B829C
                                                                                                                                                                                                                          SHA-256:BB35BB6F07BAEF72C329EC3E95D6527A2736070EE2FFE5DE227E1FF0332390F8
                                                                                                                                                                                                                          SHA-512:AA3C5C40AE9D342F8287958355C3321CF60566AD3E84E3D18D782FC022A998DA275506A61010A65D2E7D7578F2919C47C63AB0BA63A38800AA48D4B88ACE54D3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ru DAYS_OF_WEEK_ABBREV [list \.. "\u0412\u0441"\.. "\u041f\u043d"\.. "\u0412\u0442"\.. "\u0421\u0440"\.. "\u0427\u0442"\.. "\u041f\u0442"\.. "\u0421\u0431"].. ::msgcat::mcset ru DAYS_OF_WEEK_FULL [list \.. "\u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435"\.. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a"\.. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0441\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0435\u0440\u0433"\.. "\u043f\u044f\u0442\u043d\u0438\u0446\u0430"\.. "\u0441\u0443\u0431\u0431\u043e\u0442\u0430"].. ::msgcat::mcset ru MONTHS_ABBREV [list \.. "\u044f\u043d\u0432"\.. "\u0444\u0435\u0432"\.. "\u043c\u0430\u0440"\.. "\u0430\u043f\u0440"\.. "\u043c\u0430\u0439"\.. "\u0438\u044e\u

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ru_ua.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):248
                                                                                                                                                                                                                          Entropy (8bit):4.9420431225061
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoVAgWIZoVY9X3vtfNrsoVA9+3vW6Q9vn:4EnLB383SFWIyaX3vtNl/3vWHNn
                                                                                                                                                                                                                          MD5:DC98D88964650E302BE97FDB3B33326E
                                                                                                                                                                                                                          SHA1:1DDDCC4265D7B980B867FEE674BEF2FD87D823F7
                                                                                                                                                                                                                          SHA-256:13E4E79A0ED82034BADE0CFF8DEF5DE1222F6968108AD710662BDB7DAF36D7E1
                                                                                                                                                                                                                          SHA-512:F3B9D528C529DD520FEDA3C20ED354E521C5B3C29F3317E15B7939CE06A3D67554D34DD6E54FE038585E46C560C604A1FD7E7F84914086B5994D52CE2C9E99CE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ru_UA DATE_FORMAT "%d.%m.%Y".. ::msgcat::mcset ru_UA TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset ru_UA DATE_TIME_FORMAT "%d.%m.%Y %k:%M:%S %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\sh.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1212
                                                                                                                                                                                                                          Entropy (8bit):4.359036493565628
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83/YIXo4YY0dD6kMm7fX2NaSIvZdHZgHZ/IxvaGWxvtl9svWTN:43rLTR44/yWltOWB
                                                                                                                                                                                                                          MD5:E297221FA73BD78577B398BC7D061D21
                                                                                                                                                                                                                          SHA1:F2A6B456272F913A9E97C495CEE73AC774C90FA1
                                                                                                                                                                                                                          SHA-256:E65D6E5E837DF0A2DF0DB77BCE45334BBC27EFFF9023C37119E75D49932D9D6C
                                                                                                                                                                                                                          SHA-512:AB9DDAE7CB21193C7753041F0B88CF2D40987E7E604B47816219458D217F084AA4EBF36719E22AAB3FD71A271D9F956ADC353182991903D7ADE8C8F00F6B2F9B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sh DAYS_OF_WEEK_ABBREV [list \.. "Ned"\.. "Pon"\.. "Uto"\.. "Sre"\.. "\u010cet"\.. "Pet"\.. "Sub"].. ::msgcat::mcset sh DAYS_OF_WEEK_FULL [list \.. "Nedelja"\.. "Ponedeljak"\.. "Utorak"\.. "Sreda"\.. "\u010cetvrtak"\.. "Petak"\.. "Subota"].. ::msgcat::mcset sh MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Maj"\.. "Jun"\.. "Jul"\.. "Avg"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset sh MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "Mart"\.. "April"\.. "Maj"\.. "Juni"\.. "Juli"\.. "Avgust"\.. "Septembar"\.. "Oktobar"\.. "Novembar"\.. "Decembar"\.. ""].. ::msgcat::mcset sh BC

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\sk.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1255
                                                                                                                                                                                                                          Entropy (8bit):4.4043119723436135
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83c46o40u3rIsmJIcm93ApLDVb2IcU95WFGEXF3eUCvtz/v3e6:43c3ow3rF93Ap7tEXFREtznp
                                                                                                                                                                                                                          MD5:24DA40901D907D35195CC1B3A675EBC7
                                                                                                                                                                                                                          SHA1:8AF31248F06FADA5CFB0D83A940CFF5CE70E2577
                                                                                                                                                                                                                          SHA-256:976813F6C53C9BEBBF976B0F560FD7FC5E4EC4C574D7E1CD31F9A4056765CB7A
                                                                                                                                                                                                                          SHA-512:A9BC6AAFE9AEEDFD1E483E54A2D27871A09ADD6807D8F90410CD2BB82A91BA9DF435652EC9A7C3AD0A080D7F153CA848BB47DAD3936BA30E4AEFF3C474C433CC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sk DAYS_OF_WEEK_ABBREV [list \.. "Ne"\.. "Po"\.. "Ut"\.. "St"\.. "\u0160t"\.. "Pa"\.. "So"].. ::msgcat::mcset sk DAYS_OF_WEEK_FULL [list \.. "Nede\u013ee"\.. "Pondelok"\.. "Utorok"\.. "Streda"\.. "\u0160tvrtok"\.. "Piatok"\.. "Sobota"].. ::msgcat::mcset sk MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "m\u00e1j"\.. "j\u00fan"\.. "j\u00fal"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sk MONTHS_FULL [list \.. "janu\u00e1r"\.. "febru\u00e1r"\.. "marec"\.. "apr\u00edl"\.. "m\u00e1j"\.. "j\u00fan"\.. "j\u00fal"\.. "august"\.. "september"\.. "okt\u00f3ber"\.. "november"\.. "decem

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\sl.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1216
                                                                                                                                                                                                                          Entropy (8bit):4.333705818952628
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83MIXpC9opYuGS/BrIsmZ5hv1yAxyIVjd392WFThENvt0vJoO:43fXYujZrqyApYJtyR
                                                                                                                                                                                                                          MD5:CB76F54CBE0D1AAE8BA956B4C51CBD2A
                                                                                                                                                                                                                          SHA1:C1F78375EDB0BD2504553E33B2024C0C63FDB1B2
                                                                                                                                                                                                                          SHA-256:11A6264676DBED87E4F718075127E32E107854F35F141642454F484984084486
                                                                                                                                                                                                                          SHA-512:69964348FF08DE6EEB5E3DD61057FF0DF5441105EB7BEE7FB7E9AC5E26DCC164E3C7C011CA5CD7BC5B97A7872532331C97CCBC80563F6C5A3548014BFA8BEF16
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sl DAYS_OF_WEEK_ABBREV [list \.. "Ned"\.. "Pon"\.. "Tor"\.. "Sre"\.. "\u010cet"\.. "Pet"\.. "Sob"].. ::msgcat::mcset sl DAYS_OF_WEEK_FULL [list \.. "Nedelja"\.. "Ponedeljek"\.. "Torek"\.. "Sreda"\.. "\u010cetrtek"\.. "Petek"\.. "Sobota"].. ::msgcat::mcset sl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "avg"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sl MONTHS_FULL [list \.. "januar"\.. "februar"\.. "marec"\.. "april"\.. "maj"\.. "junij"\.. "julij"\.. "avgust"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset sl B

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\sq.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1321
                                                                                                                                                                                                                          Entropy (8bit):4.408176575111904
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83F7ONQEwXwjjTlVoSEh76W/X+WZQJ4hv+H6v2V:43NwjPEwl4VQ8q
                                                                                                                                                                                                                          MD5:E606F620F03EC0FBDBE6551601299C5F
                                                                                                                                                                                                                          SHA1:0B50AB679E8D90D8E7319BCADAC426E004594D3B
                                                                                                                                                                                                                          SHA-256:1F4EFD78F6B45B65F73F09B2F52FC13C2A7C4138DCB7664804878D197B6EBDF9
                                                                                                                                                                                                                          SHA-512:08AF2B51EB7111E334ADDA3A03F9A8816C104E9742B523EC363FB5131A3DF73D298A8DDCD573D23C23C65CCFD2B8898DF75AE3D4F04BF80744044FB6BAB5EC0A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sq DAYS_OF_WEEK_ABBREV [list \.. "Die"\.. "H\u00ebn"\.. "Mar"\.. "M\u00ebr"\.. "Enj"\.. "Pre"\.. "Sht"].. ::msgcat::mcset sq DAYS_OF_WEEK_FULL [list \.. "e diel"\.. "e h\u00ebn\u00eb"\.. "e mart\u00eb"\.. "e m\u00ebrkur\u00eb"\.. "e enjte"\.. "e premte"\.. "e shtun\u00eb"].. ::msgcat::mcset sq MONTHS_ABBREV [list \.. "Jan"\.. "Shk"\.. "Mar"\.. "Pri"\.. "Maj"\.. "Qer"\.. "Kor"\.. "Gsh"\.. "Sht"\.. "Tet"\.. "N\u00ebn"\.. "Dhj"\.. ""].. ::msgcat::mcset sq MONTHS_FULL [list \.. "janar"\.. "shkurt"\.. "mars"\.. "prill"\.. "maj"\.. "qershor"\.. "korrik"\.. "gusht"\.. "shtator"\.. "tetor"\.. "n\u00ebntor"\.. "dhjetor"\.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\sr.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2087
                                                                                                                                                                                                                          Entropy (8bit):4.307749748884122
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:43ilQTSBQrQP9QenzMKSFD9NI/QiNQEQrQL1KKYjU5rtAx:2I5EyLMKSFZNIYMzYMKKiqW
                                                                                                                                                                                                                          MD5:BF363AB60B57F6D8FDCDBFD230A28DDF
                                                                                                                                                                                                                          SHA1:6375CBA0A2197DA7E65BEE45C42F02C4F0B9142D
                                                                                                                                                                                                                          SHA-256:FA00A7B22C9941F6C2B893F22B703DCB159CA2F2E4005FD6A74A632AEB786BFA
                                                                                                                                                                                                                          SHA-512:91AD8085EF321A5A0E4D2ED204940CB66E8E230BBEDE59A8A07D1CEED9155FCC6B075A1FCC44AE834C1FEEEB3A59256C4310684C5AC453D4C50DFABD88469814
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sr DAYS_OF_WEEK_ABBREV [list \.. "\u041d\u0435\u0434"\.. "\u041f\u043e\u043d"\.. "\u0423\u0442\u043e"\.. "\u0421\u0440\u0435"\.. "\u0427\u0435\u0442"\.. "\u041f\u0435\u0442"\.. "\u0421\u0443\u0431"].. ::msgcat::mcset sr DAYS_OF_WEEK_FULL [list \.. "\u041d\u0435\u0434\u0435\u0459\u0430"\.. "\u041f\u043e\u043d\u0435\u0434\u0435\u0459\u0430\u043a"\.. "\u0423\u0442\u043e\u0440\u0430\u043a"\.. "\u0421\u0440\u0435\u0434\u0430"\.. "\u0427\u0435\u0442\u0432\u0440\u0442\u0430\u043a"\.. "\u041f\u0435\u0442\u0430\u043a"\.. "\u0421\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset sr MONTHS_ABBREV [list \.. "\u0408\u0430\u043d"\.. "\u0424\u0435\u0431"\.. "\u041c\u0430\u0440"\.. "\u0410\u043f\u0440"\.. "\u041c\u0430\u0458"\.. "\u0408\u0443\u043d"\.. "\

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\sv.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1219
                                                                                                                                                                                                                          Entropy (8bit):4.3542418837714285
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83qoLt6yLQoAusrIsmZ5m4AcjTHX92WFfjr4MvBvX:43ZLxQNusrr4Aw3Jkq1X
                                                                                                                                                                                                                          MD5:3B5C3FFA0829768470BDA1B46D882060
                                                                                                                                                                                                                          SHA1:C96799036EC5CCDE799A6B50CD7748908935A2F3
                                                                                                                                                                                                                          SHA-256:483916B51BD7E071E88F9EC36AAF3E08FEA823991532F832DE491C6C40B55A9F
                                                                                                                                                                                                                          SHA-512:684FA249123878AA7F856DF0FD3B0D9F041113CFEA8EEFA47D0E1948DA23694330BF0D62BA896A3891CD559C16CAE9330BF31508F530AC003D2929D5FD9246D8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sv DAYS_OF_WEEK_ABBREV [list \.. "s\u00f6"\.. "m\u00e5"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f6"].. ::msgcat::mcset sv DAYS_OF_WEEK_FULL [list \.. "s\u00f6ndag"\.. "m\u00e5ndag"\.. "tisdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f6rdag"].. ::msgcat::mcset sv MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sv MONTHS_FULL [list \.. "januari"\.. "februari"\.. "mars"\.. "april"\.. "maj"\.. "juni"\.. "juli"\.. "augusti"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat:

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\sw.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1040
                                                                                                                                                                                                                          Entropy (8bit):4.108744949579904
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLB383A4mScvhkzoR4mtuWckRkoay3UVxMmALfG7IdzVJ633xRCPLMYMvYo76u:4aR83/Shkz1uckO76kMmEf62qOTdMvvn
                                                                                                                                                                                                                          MD5:5774860C8AEECBD48F1502E616158CAB
                                                                                                                                                                                                                          SHA1:DE7059713EA7913A0C79F5386833CE2BCAD2CFD7
                                                                                                                                                                                                                          SHA-256:1DA068C9AA02EF14A2440758C6040D632D96044A20EC501DBB9E40D8592E0E7F
                                                                                                                                                                                                                          SHA-512:91E69222DDF55E9E0E389DB77D7A0F2E082351DC3FB34A1A2C1E350E4187E8BB940F6C2EDE1B8651159C2787AA0BE4D7268F33F7A82CAED03514FCE462530408
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sw DAYS_OF_WEEK_ABBREV [list \.. "Jpi"\.. "Jtt"\.. "Jnn"\.. "Jtn"\.. "Alh"\.. "Iju"\.. "Jmo"].. ::msgcat::mcset sw DAYS_OF_WEEK_FULL [list \.. "Jumapili"\.. "Jumatatu"\.. "Jumanne"\.. "Jumatano"\.. "Alhamisi"\.. "Ijumaa"\.. "Jumamosi"].. ::msgcat::mcset sw MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Ago"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset sw MONTHS_FULL [list \.. "Januari"\.. "Februari"\.. "Machi"\.. "Aprili"\.. "Mei"\.. "Juni"\.. "Julai"\.. "Agosti"\.. "Septemba"\.. "Oktoba"\.. "Novemba"\.. "Desemba"\.. ""].. ::msgcat::mcset sw BCE "

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ta.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1874
                                                                                                                                                                                                                          Entropy (8bit):4.080580566597515
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83AI0xnJdnQhmHlHYPKtul+eOPfIxyH5ztUSLu8tptLtrl+eOPfIxyH5ztUSU:43N0dQmHlHYPKtu1HxMtr1Hx/
                                                                                                                                                                                                                          MD5:85288236C3997302EA26D7403BBA2C15
                                                                                                                                                                                                                          SHA1:05AB389CC4DCF17B37BFF6ED1ECD58D6E9850A01
                                                                                                                                                                                                                          SHA-256:AEFDC4255890D5B3FFE5CEE1B457B7D711283C2287ABA644155C10956012F6C1
                                                                                                                                                                                                                          SHA-512:8E389D46606176EE14B8356153095B49C9426B80139B672A620F488891F091D1A272D4FB116775900E4AB4EC84DDDEBD8D6AF81AC672F14F148F2BFC638D2B10
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ta DAYS_OF_WEEK_FULL [list \.. "\u0b9e\u0bbe\u0baf\u0bbf\u0bb1\u0bc1"\.. "\u0ba4\u0bbf\u0b99\u0bcd\u0b95\u0bb3\u0bcd"\.. "\u0b9a\u0bc6\u0bb5\u0bcd\u0bb5\u0bbe\u0baf\u0bcd"\.. "\u0baa\u0bc1\u0ba4\u0ba9\u0bcd"\.. "\u0bb5\u0bbf\u0baf\u0bbe\u0bb4\u0ba9\u0bcd"\.. "\u0bb5\u0bc6\u0bb3\u0bcd\u0bb3\u0bbf"\.. "\u0b9a\u0ba9\u0bbf"].. ::msgcat::mcset ta MONTHS_ABBREV [list \.. "\u0b9c\u0ba9\u0bb5\u0bb0\u0bbf"\.. "\u0baa\u0bc6\u0baa\u0bcd\u0bb0\u0bb5\u0bb0\u0bbf"\.. "\u0bae\u0bbe\u0bb0\u0bcd\u0b9a\u0bcd"\.. "\u0b8f\u0baa\u0bcd\u0bb0\u0bb2\u0bcd"\.. "\u0bae\u0bc7"\.. "\u0b9c\u0bc2\u0ba9\u0bcd"\.. "\u0b9c\u0bc2\u0bb2\u0bc8"\.. "\u0b86\u0b95\u0bb8\u0bcd\u0b9f\u0bcd"\.. "\u0b9a\u0bc6\u0baa\u0bcd\u0b9f\u0bae\u0bcd\u0baa\u0bb0\u0bcd"\.. "\u0b85\u0b95\u0bcd\u0b9f\u0bcb\u0baa\u0bb0\u0bcd"\.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\ta_in.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):4.863003494480733
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xosDv+IZosK3v6ry/5osDo+3v+6f6HyFvn:4EnLB383ZDvl5K3v6ry/ZDF3vmSVn
                                                                                                                                                                                                                          MD5:CF078352DA0507C767F04E31D6C14296
                                                                                                                                                                                                                          SHA1:0A9B1255BD85B60D3620AE61370F54748AB7A182
                                                                                                                                                                                                                          SHA-256:4978A193076DE56944236F7F1DCECACFF739536DFB3DBEFC1F7FE2B97A8AEAF4
                                                                                                                                                                                                                          SHA-512:6FFC85B2A8DECB373EC76B1CD1A9459A30E443319F2C8DB9BBE6E115F5EFEEBAC314D4E8BE996EA55EE46466C6F6057A73078F5FDCF1C4CBAF1A270E45BC10C0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ta_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset ta_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset ta_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\te.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2149
                                                                                                                                                                                                                          Entropy (8bit):4.097884113767283
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:43a8mxI9k3JR0UjjFbPcniLHVktjjFbPcniLHVM:2a8v9k3JdbPcIidbPcIG
                                                                                                                                                                                                                          MD5:61E4CB2AAD66285E9113071057F39C35
                                                                                                                                                                                                                          SHA1:A2BD21090859669C4B6A875E077825381B7E2702
                                                                                                                                                                                                                          SHA-256:9E96C7123100234A7018533764502985A208F2EB3314F5B6332D46016725A63F
                                                                                                                                                                                                                          SHA-512:589A2D65508B07B5FDEDA883F71A4B496B25458CA1ECE7C4D4F5DAE82EB683DA82C8E21E57D63A235AB600174C9D362A746B2E27BAA6E3ADE1B7BD9D6000BE27
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset te DAYS_OF_WEEK_ABBREV [list \.. "\u0c06\u0c26\u0c3f"\.. "\u0c38\u0c4b\u0c2e"\.. "\u0c2e\u0c02\u0c17\u0c33"\.. "\u0c2c\u0c41\u0c27"\.. "\u0c17\u0c41\u0c30\u0c41"\.. "\u0c36\u0c41\u0c15\u0c4d\u0c30"\.. "\u0c36\u0c28\u0c3f"].. ::msgcat::mcset te DAYS_OF_WEEK_FULL [list \.. "\u0c06\u0c26\u0c3f\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c38\u0c4b\u0c2e\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c2e\u0c02\u0c17\u0c33\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c2c\u0c41\u0c27\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c17\u0c41\u0c30\u0c41\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c36\u0c41\u0c15\u0c4d\u0c30\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c36\u0c28\u0c3f\u0c35\u0c3e\u0c30\u0c02"].. ::msgcat::mcset te MONTHS_ABBREV [list \.. "\u0c1c\u0c28\u0c35\u0c30\u0c3f"\.. "\u0c2b\u0c3f\u0c2c\u0c4d\u0c30\u0c35\u0c30\u0c3f"\.. "\u0c2e\u0c3

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\te_in.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):419
                                                                                                                                                                                                                          Entropy (8bit):5.058324650031252
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLB383LjZWsn0sHjoD0savzda3v6ry/ZF3vMSVn:4aR833Z1nnHjoDnavzd8vSCZNvMSV
                                                                                                                                                                                                                          MD5:BCA040A356E7E8CC597EFB9B9065F8E1
                                                                                                                                                                                                                          SHA1:ADAF7EC8C2035BC06E168D3F1BD7F39277E9273F
                                                                                                                                                                                                                          SHA-256:B110FEEDDA21ECCEFA624BEF8E1476E9F221FB253880AC370967AE4D0237CA7A
                                                                                                                                                                                                                          SHA-512:D408ECE8CF89FB23B45420D3CBA7655EEE713498210889A84EE25D3417360705546D97028EAAAA47764B6E9B0A3699669B98C0A53861A38E0DFCB9F3B8A47BEC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset te_IN AM "\u0c2a\u0c42\u0c30\u0c4d\u0c35\u0c3e\u0c39\u0c4d\u0c28".. ::msgcat::mcset te_IN PM "\u0c05\u0c2a\u0c30\u0c3e\u0c39\u0c4d\u0c28".. ::msgcat::mcset te_IN DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset te_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset te_IN DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\th.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2359
                                                                                                                                                                                                                          Entropy (8bit):4.382796122808316
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:439X4QKPQJecQwFA0P9JmDsxQ7KHfWkD2CQM0DnWxFDzCYmdrtVP:29ohCi1028QmHfIC4jW3DmHB
                                                                                                                                                                                                                          MD5:7F61E1EA256D78948189EF07119663CD
                                                                                                                                                                                                                          SHA1:6867E9780049FACE9984B7788B6F362B8D1AD718
                                                                                                                                                                                                                          SHA-256:48BEAF693BF5B6EED15234DB0D375B97E6D576A749E9048420C153E6CAFC0259
                                                                                                                                                                                                                          SHA-512:F3E24E0B41A7D722AC2FA0E429A2DCB1CCB5BAECC9912ADF6AF79C51366EA1AC9F931F0F44F068F3CEE6873516E6223CC5E7616CF523B1DFB9E528DE4D58454A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset th DAYS_OF_WEEK_ABBREV [list \.. "\u0e2d\u0e32."\.. "\u0e08."\.. "\u0e2d."\.. "\u0e1e."\.. "\u0e1e\u0e24."\.. "\u0e28."\.. "\u0e2a."].. ::msgcat::mcset th DAYS_OF_WEEK_FULL [list \.. "\u0e27\u0e31\u0e19\u0e2d\u0e32\u0e17\u0e34\u0e15\u0e22\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e08\u0e31\u0e19\u0e17\u0e23\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e2d\u0e31\u0e07\u0e04\u0e32\u0e23"\.. "\u0e27\u0e31\u0e19\u0e1e\u0e38\u0e18"\.. "\u0e27\u0e31\u0e19\u0e1e\u0e24\u0e2b\u0e31\u0e2a\u0e1a\u0e14\u0e35"\.. "\u0e27\u0e31\u0e19\u0e28\u0e38\u0e01\u0e23\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e40\u0e2a\u0e32\u0e23\u0e4c"].. ::msgcat::mcset th MONTHS_ABBREV [list \.. "\u0e21.\u0e04."\.. "\u0e01.\u0e1e."\.. "\u0e21\u0e35.\u0e04."\.. "\u0e40\u0e21.\u0e22."\.. "\u0e1e.\u0e04."\.. "\u0e21\u0

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\tr.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1183
                                                                                                                                                                                                                          Entropy (8bit):4.390397293529625
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR83ZVUflVdq4qTr6dyX59508THHCh5LbQgWiNv9KvWIn:43PXTtbTngLhWiJGWIn
                                                                                                                                                                                                                          MD5:017F0F989BD5DBBF25E7C797CE09C45C
                                                                                                                                                                                                                          SHA1:162922DBD55A31A74410375A36EE7BC50E092BDD
                                                                                                                                                                                                                          SHA-256:4B85B345D6C43F7257C6849A60A492397FD5FD9D82DF3A2252189D7A1ECCBB64
                                                                                                                                                                                                                          SHA-512:73B6CF395753D863330687404E8A584CB08B81A8CC456DCE7BB49C4EA15EA19E45E3CC1E1367E10915DE14AC6258383289BCFEF55AD2768A50889DF390D37EF9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset tr DAYS_OF_WEEK_ABBREV [list \.. "Paz"\.. "Pzt"\.. "Sal"\.. "\u00c7ar"\.. "Per"\.. "Cum"\.. "Cmt"].. ::msgcat::mcset tr DAYS_OF_WEEK_FULL [list \.. "Pazar"\.. "Pazartesi"\.. "Sal\u0131"\.. "\u00c7ar\u015famba"\.. "Per\u015fembe"\.. "Cuma"\.. "Cumartesi"].. ::msgcat::mcset tr MONTHS_ABBREV [list \.. "Oca"\.. "\u015eub"\.. "Mar"\.. "Nis"\.. "May"\.. "Haz"\.. "Tem"\.. "A\u011fu"\.. "Eyl"\.. "Eki"\.. "Kas"\.. "Ara"\.. ""].. ::msgcat::mcset tr MONTHS_FULL [list \.. "Ocak"\.. "\u015eubat"\.. "Mart"\.. "Nisan"\.. "May\u0131s"\.. "Haziran"\.. "Temmuz"\.. "A\u011fustos"\.. "Eyl\u00fcl"\.. "Ekim"\.. "Kas\u0131m"\.. "Aral\u

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\uk.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2165
                                                                                                                                                                                                                          Entropy (8bit):4.289021158621493
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:436yILgoQjQPxUIkgPDRQnQ0vVQbC1iQwweIgWQDIoZI7QDI3QbI87IVQnIzQ7mh:2AzUe3EhV8CYgrbH7z3fLVTzgn5jyX7p
                                                                                                                                                                                                                          MD5:323BD95809A44B0BADC71AD36E5F095B
                                                                                                                                                                                                                          SHA1:44F6016873CA955D27545C56CCD24BDB06A83C43
                                                                                                                                                                                                                          SHA-256:7093DA7E39CEB6D3F51EB6CF1CCA2D7F3680ED7B8FE4A5F0CECEEF6BEB21AC77
                                                                                                                                                                                                                          SHA-512:DB16E0E2D17CE47673DE781A7171944C14CC550FB8EB0920C05B979E4D067E36DF0B59B8BFA81F82D8FCE1FFDDAAD2755E68BFE5BC0DBB11E8716A4D18BA5F7E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset uk DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0434"\.. "\u043f\u043d"\.. "\u0432\u0442"\.. "\u0441\u0440"\.. "\u0447\u0442"\.. "\u043f\u0442"\.. "\u0441\u0431"].. ::msgcat::mcset uk DAYS_OF_WEEK_FULL [list \.. "\u043d\u0435\u0434\u0456\u043b\u044f"\.. "\u043f\u043e\u043d\u0435\u0434\u0456\u043b\u043e\u043a"\.. "\u0432\u0456\u0432\u0442\u043e\u0440\u043e\u043a"\.. "\u0441\u0435\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0435\u0440"\.. "\u043f'\u044f\u0442\u043d\u0438\u0446\u044f"\.. "\u0441\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset uk MONTHS_ABBREV [list \.. "\u0441\u0456\u0447"\.. "\u043b\u044e\u0442"\.. "\u0431\u0435\u0440"\.. "\u043a\u0432\u0456\u0442"\.. "\u0442\u0440\u0430\u0432"\.. "\u0447\u0435\u0440\u0432"\.. "\u043b

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\vi.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1471
                                                                                                                                                                                                                          Entropy (8bit):4.44729506678271
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4aR836DNjYTP55YAUy2tJ9kyzW68IFYHMBSW1K1pvhv1O:43dbYJyC8ySgI1dV1O
                                                                                                                                                                                                                          MD5:C127F54C462917D3B3EEF5F29F612138
                                                                                                                                                                                                                          SHA1:B1D9A67F856D93F98524C6372B352EA0DE1B9CD3
                                                                                                                                                                                                                          SHA-256:E9B7AECD456F1D2288604C982B5DED0DCF71DCA968C0B0EAFF4CA16CC3B73EC2
                                                                                                                                                                                                                          SHA-512:0B0F132F10580751258D37E070338C3B39DF57FDECDB9D0AFA67E90D6766DDCB4D711876E551ED759D177F1B8F4E9E1DD8F7899F7CB57F8039F55EC4C2984E87
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset vi DAYS_OF_WEEK_ABBREV [list \.. "Th 2"\.. "Th 3"\.. "Th 4"\.. "Th 5"\.. "Th 6"\.. "Th 7"\.. "CN"].. ::msgcat::mcset vi DAYS_OF_WEEK_FULL [list \.. "Th\u01b0\u0301 hai"\.. "Th\u01b0\u0301 ba"\.. "Th\u01b0\u0301 t\u01b0"\.. "Th\u01b0\u0301 n\u0103m"\.. "Th\u01b0\u0301 s\u00e1u"\.. "Th\u01b0\u0301 ba\u0309y"\.. "Chu\u0309 nh\u00e2\u0323t"].. ::msgcat::mcset vi MONTHS_ABBREV [list \.. "Thg 1"\.. "Thg 2"\.. "Thg 3"\.. "Thg 4"\.. "Thg 5"\.. "Thg 6"\.. "Thg 7"\.. "Thg 8"\.. "Thg 9"\.. "Thg 10"\.. "Thg 11"\.. "Thg 12"\.. ""].. ::msgcat::mcset vi MONTHS_FULL [list \.. "Th\u00e1ng m\u00f4\u0323t"\.. "Th\u00e1ng hai"\.. "Th\u00e1ng ba"\.. "Th\u00e1ng t\u01b0"\.. "Th\u00e

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\zh.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (1598), with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3385
                                                                                                                                                                                                                          Entropy (8bit):4.5164095151631125
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:43qrY2BBT7uxDqwPqDa8c3FLbYmhyvMDKbW0YGLuoEyke2gdr:2yPTKdo
                                                                                                                                                                                                                          MD5:2F356DE14D48B1091DEAA32D20C38D96
                                                                                                                                                                                                                          SHA1:4AB78D47A73290000955A7C1DFDF7106093F69FD
                                                                                                                                                                                                                          SHA-256:EB247F5184A59414D3DF7E3ECA51F5998C248CFB27D2C02E62A7A30AB35197A7
                                                                                                                                                                                                                          SHA-512:602410830018B455C68AE2EBDD83BA561CF59DA5898E00C80CE7EF619912E591EB38B4C8FE8D9B1F024E7105B0C4D2D326FC855F31E79C1B954429B947DFFBB1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh DAYS_OF_WEEK_ABBREV [list \.. "\u661f\u671f\u65e5"\.. "\u661f\u671f\u4e00"\.. "\u661f\u671f\u4e8c"\.. "\u661f\u671f\u4e09"\.. "\u661f\u671f\u56db"\.. "\u661f\u671f\u4e94"\.. "\u661f\u671f\u516d"].. ::msgcat::mcset zh DAYS_OF_WEEK_FULL [list \.. "\u661f\u671f\u65e5"\.. "\u661f\u671f\u4e00"\.. "\u661f\u671f\u4e8c"\.. "\u661f\u671f\u4e09"\.. "\u661f\u671f\u56db"\.. "\u661f\u671f\u4e94"\.. "\u661f\u671f\u516d"].. ::msgcat::mcset zh MONTHS_ABBREV [list \.. "\u4e00\u6708"\.. "\u4e8c\u6708"\.. "\u4e09\u6708"\.. "\u56db\u6708"\.. "\u4e94\u6708"\.. "\u516d\u6708"\.. "\u4e03\u6708"\.. "\u516b\u6708"\.. "\u4e5d\u6708"\.. "\u5341\u6708"\.. "\u5341\u4e00\u6708"\.. "\u5341\u4e8c\u6708"\.. ""].. ::msgcat::m

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\zh_cn.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):319
                                                                                                                                                                                                                          Entropy (8bit):5.167825099880243
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoX5YBoHJ+3vtfNrsoHJ+3v6MYBoXa+3vYq9vn:4EnLB383U5YMJ+3vtN3J+3v6LcL3vYqN
                                                                                                                                                                                                                          MD5:9FCDC2E80E13984D434E3CC91E1ED14C
                                                                                                                                                                                                                          SHA1:710D9EE2A71021F4AB609886138EED43C1380ACD
                                                                                                                                                                                                                          SHA-256:4C8A855700FEFE8EE21B08030FF4159D8011AE50353F063229C42DE6292475CF
                                                                                                                                                                                                                          SHA-512:D899A1F58DF1051BB2C2C4AC859C52A2D19B1593C37022A29439B37A8057ADC3941F3564E2E1D9CEB72AE123A4E12E24C3736343AA3A5EC8749AB5AEBBF65085
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_CN DATE_FORMAT "%Y-%m-%e".. ::msgcat::mcset zh_CN TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset zh_CN TIME_FORMAT_12 "%P%I\u65f6%M\u5206%S\u79d2".. ::msgcat::mcset zh_CN DATE_TIME_FORMAT "%Y-%m-%e %k:%M:%S %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\zh_hk.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):780
                                                                                                                                                                                                                          Entropy (8bit):4.716025632367214
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLB383HmSBBHZovDh4ToC4qU3WwVW3v6P3v3WwSn:4aR83Hxo14u3Ww+viv3WwS
                                                                                                                                                                                                                          MD5:CFDA7B6463305FA15DBBA72D725A1876
                                                                                                                                                                                                                          SHA1:2BF885073FBAF4A38B7AFDA76CA391F195A5A362
                                                                                                                                                                                                                          SHA-256:7E1C5BD9EC1A17BB851B0DCABD0DFA9FF9D64B89603D9D3FBEAAC609172346AE
                                                                                                                                                                                                                          SHA-512:55F974C706933ECE0575A33C381D9B370B8A408C5C5514C805EC04C8B0CA5BAFAA47267DA98E1805B478A9589FFB7549D79002B2A7AF387049011D78DD7605B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_HK DAYS_OF_WEEK_ABBREV [list \.. "\u65e5"\.. "\u4e00"\.. "\u4e8c"\.. "\u4e09"\.. "\u56db"\.. "\u4e94"\.. "\u516d"].. ::msgcat::mcset zh_HK MONTHS_ABBREV [list \.. "1\u6708"\.. "2\u6708"\.. "3\u6708"\.. "4\u6708"\.. "5\u6708"\.. "6\u6708"\.. "7\u6708"\.. "8\u6708"\.. "9\u6708"\.. "10\u6708"\.. "11\u6708"\.. "12\u6708"\.. ""].. ::msgcat::mcset zh_HK DATE_FORMAT "%Y\u5e74%m\u6708%e\u65e5".. ::msgcat::mcset zh_HK TIME_FORMAT_12 "%P%I:%M:%S".. ::msgcat::mcset zh_HK DATE_TIME_FORMAT "%Y\u5e74%m\u6708%e\u65e5 %P%I:%M:%S %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\zh_sg.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):347
                                                                                                                                                                                                                          Entropy (8bit):5.062880051437783
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoOpEoPpFocMohX3v6Zwoh+3v6fxvn:4EnLB383J53v6O3vCn
                                                                                                                                                                                                                          MD5:3218F8E6BEDD534277DE0849C423158E
                                                                                                                                                                                                                          SHA1:10C006446A10406A5644C4033665E877EBF72AF7
                                                                                                                                                                                                                          SHA-256:500546B3211D454659D845B4AB9AEF226125100DF40407C49530DE17CDD4363F
                                                                                                                                                                                                                          SHA-512:3142893DA85BA8F83A5B6851B313B5F5FF80D2B989C1AE015665EE70373249B44EFB4FF7C621F1D8F37AC6019EF5E8D6D21C76C48998C3D9072F9C5060AA8813
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_SG AM "\u4e0a\u5348".. ::msgcat::mcset zh_SG PM "\u4e2d\u5348".. ::msgcat::mcset zh_SG DATE_FORMAT "%d %B %Y".. ::msgcat::mcset zh_SG TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset zh_SG DATE_TIME_FORMAT "%d %B %Y %P %I:%M:%S %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\msgs\zh_tw.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):354
                                                                                                                                                                                                                          Entropy (8bit):5.124064818715749
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoAykaRULH/XRxy/5oAyjZRULHi5oAyU/G0OMoAyxW3v6ZQ:4EnLB38315xDOiKRRW3v6F3v8A2n
                                                                                                                                                                                                                          MD5:9010E34791B5DDB7F1E0AD4DA6BD4623
                                                                                                                                                                                                                          SHA1:418F7374BABEF27FEC8E00D3A32F535084593AB9
                                                                                                                                                                                                                          SHA-256:DBA0584B8E1925B439F06E0BF0965E97AFB7EB39E70E0E4C9B70769EBC5F996C
                                                                                                                                                                                                                          SHA-512:D3AB698B725E84DAB06E472C41FF2EB55D63885D22B4598C596800BAC83A02A44CB524524F267D090952AF7E0031F47720786ACF9E354EF672CF9EEFB7DB3BD4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_TW BCE "\u6c11\u570b\u524d".. ::msgcat::mcset zh_TW CE "\u6c11\u570b".. ::msgcat::mcset zh_TW DATE_FORMAT "%Y/%m/%e".. ::msgcat::mcset zh_TW TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset zh_TW DATE_TIME_FORMAT "%Y/%m/%e %P %I:%M:%S %z"..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\opt0.4\optparse.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):33777
                                                                                                                                                                                                                          Entropy (8bit):4.60013086740989
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:4D0xrpIuhenN4kA0G6sRcl5AdtsPLKiF64aJQ2L:HpnhsS9C5Adqua5aJvL
                                                                                                                                                                                                                          MD5:4ECD97188BFED58A15FE22EC566FA6A3
                                                                                                                                                                                                                          SHA1:6E4E91096298F1A0AE6CD4241F167C8B4F661EE5
                                                                                                                                                                                                                          SHA-256:67A157F1873D606B53DC4D894BD8E71F6B1A0DD66177B9513BD039B348B40349
                                                                                                                                                                                                                          SHA-512:1D5067BBB13DAB001168EEB41EBFA2D13BACB0F43A8067CC93923E8F4D062AA387DA23D7D98D6A2AE77D7C849A6026F2343102CBE03690C2CEA0890222339475
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# optparse.tcl --..#..# (private) Option parsing package..# Primarily used internally by the safe:: code...#..#.WARNING: This code will go away in a future release..#.of Tcl. It is NOT supported and you should not rely..#.on it. If your code does rely on this package you..#.may directly incorporate this code into your application.....package require Tcl 8.5-..# When this version number changes, update the pkgIndex.tcl file..# and the install directory in the Makefiles...package provide opt 0.4.8....namespace eval ::tcl {.... # Exported APIs.. namespace export OptKeyRegister OptKeyDelete OptKeyError OptKeyParse \.. OptProc OptProcArgGiven OptParse \... Lempty Lget \.. Lassign Lvarpop Lvarpop1 Lvarset Lvarincr \.. SetMax SetMin......################# Example of use / 'user documentation' ###################.... proc OptCreateTestProc {} {.....# Defines ::tcl::OptParseTest as a test proc with parsed arguments...# (can't be d

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\opt0.4\pkgIndex.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):620
                                                                                                                                                                                                                          Entropy (8bit):4.702477618616754
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:jHxIRu9zhjJS42wbGlTULuUAZb3KykszLYIGbyAkXaqrQ+pBb6:biRUJS42wbGlTUcZ+yk2LY0XaqrB4
                                                                                                                                                                                                                          MD5:07532085501876DCC6882567E014944C
                                                                                                                                                                                                                          SHA1:6BC7A122429373EB8F039B413AD81C408A96CB80
                                                                                                                                                                                                                          SHA-256:6A4ABD2C519A745325C26FB23BE7BBF95252D653A24806EB37FD4AA6A6479AFE
                                                                                                                                                                                                                          SHA-512:0D604E862F3A1A19833EAD99AAF15A9F142178029AB64C71D193CEE4901A0196C1EEDDC2BCE715B7FA958AC45C194E63C77A71E4BE4F9AEDFD5B44CF2A726E76
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Tcl package index file, version 1.1..# This file is generated by the "pkg_mkIndex -direct" command..# and sourced either when an application starts up or..# by a "package unknown" script. It invokes the..# "package ifneeded" command to set up package-related..# information so that packages will be loaded automatically..# in response to "package require" commands. When this..# script is sourced, the variable $dir must contain the..# full path name of this file's directory.....if {![package vsatisfies [package provide Tcl] 8.5-]} {return}..package ifneeded opt 0.4.8 [list source [file join $dir optparse.tcl]]..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\package.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):23995
                                                                                                                                                                                                                          Entropy (8bit):4.884828325514459
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:8xgjLNILEHsdAW2UfnImRqXqux6XmihmCchzPLrXJjJh6PLfzdklG:8xgjLNImsdnvIm86uGLhLchzDzJ9h6Dn
                                                                                                                                                                                                                          MD5:DDB0AB9842B64114138A8C83C4322027
                                                                                                                                                                                                                          SHA1:ECCACDC2CCD86A452B21F3CF0933FD41125DE790
                                                                                                                                                                                                                          SHA-256:F46AB61CDEBE3AA45FA7E61A48930D64A0D0E7E94D04D6BF244F48C36CAFE948
                                                                                                                                                                                                                          SHA-512:C0CF718258B4D59675C088551060B34CE2BC8638958722583AC2313DC354223BFEF793B02F1316E522A14C7BA9BED219531D505DE94DC3C417FC99D216A01463
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# package.tcl --..#..# utility procs formerly in init.tcl which can be loaded on demand..# for package management...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval tcl::Pkg {}....# ::tcl::Pkg::CompareExtension --..#..# Used internally by pkg_mkIndex to compare the extension of a file to a given..# extension. On Windows, it uses a case-insensitive comparison because the..# file system can be file insensitive...#..# Arguments:..# fileName.name of a file whose extension is compared..# ext..(optional) The extension to compare against; you must..#..provide the starting dot...#..Defaults to [info sharedlibextension]..#..# Results:..# Returns 1 if the extension matches, 0 otherwise....proc tcl::Pkg::CompareExtension {fileName {ext {}}} {.. global tcl_platfor

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\parray.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):844
                                                                                                                                                                                                                          Entropy (8bit):4.883013702569192
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:TF7S2n2wn2SNHaeYF9xcwrmXhbs1GUiSYX3EtSK78ex4VIpynEw88/McUBbPgnz:TF7Hn2wnlk2KwyZSM4SkV/3UB7Cz
                                                                                                                                                                                                                          MD5:577787C2F4F5956BA70F83012B980AE5
                                                                                                                                                                                                                          SHA1:040B2469F796F3FDFCD1E1DD2EB1C5B799EDEF62
                                                                                                                                                                                                                          SHA-256:E269029C8263E3CBC1920C3604ECDCF15EDCCB208A0D68F9EB42B73954D620C0
                                                                                                                                                                                                                          SHA-512:C2940F6F3D77412EFC537B8AB67352F519DFFA95739FCC17BF1817335AFD9E5BFE91ABE98CBA99E278CB4923D4E6D431ED9D72282745203C0F7D73193F550238
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# parray:..# Print the contents of a global array on stdout...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....proc parray {a {pattern *}} {.. upvar 1 $a array.. if {![array exists array]} {...return -code error "\"$a\" isn't an array".. }.. set maxl 0.. set names [lsort [array names array $pattern]].. foreach name $names {...if {[string length $name] > $maxl} {... set maxl [string length $name]...}.. }.. set maxl [expr {$maxl + [string length $a] + 2}].. foreach name $names {...set nameString [format %s(%s) $a $name]...puts stdout [format "%-*s = %s" $maxl $nameString $array($name)].. }..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\safe.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42223
                                                                                                                                                                                                                          Entropy (8bit):4.822635446297551
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:H/Jo8y7AyARYhZfc3njlVdRIp4xOtoYx4WneNiBq5vIhfwEaqadlUCJ2Pbb1P6:H/c7AmhZmnjvdRIG924WneNiBq5+fwEc
                                                                                                                                                                                                                          MD5:B8C1561D471CFBF4111C706411D59883
                                                                                                                                                                                                                          SHA1:71483EAEEF377EE9AF90BEC44F70C7B12C5BC720
                                                                                                                                                                                                                          SHA-256:C21DCE3AB31893118BBED01E559070F1D3541877FEE331BD45F5BF4300ED9654
                                                                                                                                                                                                                          SHA-512:465065A938C71AF4588B3331B51A62DD57F57492EB1CB6C0F52B9FD0A2FE7A54B1E995AA56E4A41D7A99EAFF665C1E23E3B240FB3F9840AB242C21B1DBFFFF45
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# safe.tcl --..#..# This file provide a safe loading/sourcing mechanism for safe interpreters...# It implements a virtual path mechanism to hide the real pathnames from the..# child. It runs in a parent interpreter and sets up data structure and..# aliases that will be invoked when used from a child interpreter...#..# See the safe.n man page for details...#..# Copyright (c) 1996-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....#..# The implementation is based on namespaces. These naming conventions are..# followed:..# Private procs starts with uppercase...# Public procs are exported and starts with lowercase..#....# Needed utilities package..package require opt 0.4.8....# Create the safe namespace..namespace eval ::safe {.. # Exported API:.. namespace export interpCreate interpInit interpConfigure interpDelete \...interpAddToAccessPath interpFindInAccessPath setL

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tclIndex

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5617
                                                                                                                                                                                                                          Entropy (8bit):4.747404679682368
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:eOaVhNUMUuUQU2UsUIUbUEUEeUkgU6UWSO0DT5RTdcvsilrvs+jscMK57ehXowrz:ejVHRRLP3LWDXewTbSO0DT5RTdcvsilg
                                                                                                                                                                                                                          MD5:C62FB22F4C9A3EFF286C18421397AAF4
                                                                                                                                                                                                                          SHA1:4A49B8768CFF68F2EFFAF21264343B7C632A51B2
                                                                                                                                                                                                                          SHA-256:DDF7E42DEF37888AD0A564AA4F8CA95F4EEC942CEBEBFCA851D35515104D5C89
                                                                                                                                                                                                                          SHA-512:558D401CB6AF8CE3641AF55CAEBC9C5005AB843EE84F60C6D55AFBBC7F7129DA9C58C2F55C887C3159107546FA6BC13FFC4CCA63EA8841D7160B8AA99161A185
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Tcl autoload index file, version 2.0..# -*- tcl -*-..# This file is generated by the "auto_mkindex" command..# and sourced to set up indexing information for one or..# more commands. Typically each line is a command that..# sets an element in the auto_index array, where the..# element name is the name of a command and the value is..# a script that loads the command.....set auto_index(auto_reset) [list source [file join $dir auto.tcl]]..set auto_index(tcl_findLibrary) [list source [file join $dir auto.tcl]]..set auto_index(auto_mkindex) [list source [file join $dir auto.tcl]]..set auto_index(auto_mkindex_old) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::init) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::cleanup) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::mkindex) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::hook) [list source [file join $dir auto.t

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tm.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12204
                                                                                                                                                                                                                          Entropy (8bit):4.763796758810551
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:55CjnlRfMKqaOH5bE2KjNkkpgpCmqkkuowUh9PTYMsvSO+xy8h/vuKisM68E:5q3MKYH5bE1jNkkpgomq/uCPTYMC+k83
                                                                                                                                                                                                                          MD5:215262A286E7F0A14F22DB1AA7875F05
                                                                                                                                                                                                                          SHA1:66B942BA6D3120EF8D5840FCDEB06242A47491FF
                                                                                                                                                                                                                          SHA-256:4B7ED9FD2363D6876092DB3F720CBDDF97E72B86B519403539BA96E1C815ED8F
                                                                                                                                                                                                                          SHA-512:6ECD745D7DA9D826240C0AB59023C703C94B158AE48C1410FAA961A8EDB512976A4F15AE8DEF099B58719ADF0D2A9C37E6F29F54D39C1AB7EE81FA333A60F39B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# -*- tcl -*-..#..# Searching for Tcl Modules. Defines a procedure, declares it as the primary..# command for finding packages, however also uses the former 'package unknown'..# command as a fallback...#..# Locates all possible packages in a directory via a less restricted glob. The..# targeted directory is derived from the name of the requested package, i.e...# the TM scan will look only at directories which can contain the requested..# package. It will register all packages it found in the directory so that..# future requests have a higher chance of being fulfilled by the ifneeded..# database without having to come to us again...#..# We do not remember where we have been and simply rescan targeted directories..# when invoked again. The reasoning is this:..#..# - The only way we get back to the same directory is if someone is trying to..# [package require] something that wasn't there on the first scan...#..# Either..# 1) It is there now: If we rescan, you get it; if not you don

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Abidjan

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):147
                                                                                                                                                                                                                          Entropy (8bit):4.995501022397479
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2DcsBdNMXGm2OHnFvpsYoHsdSalHFLwy:SlSWB9eg/2DBpDm2OHnFvmYoH1alHOy
                                                                                                                                                                                                                          MD5:FF8B5540631A6EE93507338C4E7AA49D
                                                                                                                                                                                                                          SHA1:817B261A1B6B92AA498EC286349964EA10FB5A84
                                                                                                                                                                                                                          SHA-256:7213997BB9CF9D384A7002B8C8EFEF25C01ABA6083D9835A16D583D5DCEE40A0
                                                                                                                                                                                                                          SHA-512:8D78AC4868ED0013EDA536C0E82E0E91398772AA18C637AEFE22F24B142FCDA55A4CB853B2282951E907C9E2F62BD3F831A5CF995F52898F5225D16889943A9C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Abidjan) {.. {-9223372036854775808 -968 0 LMT}.. {-1830383032 0 0 GMT}..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Accra

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):183
                                                                                                                                                                                                                          Entropy (8bit):4.832432925672155
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dc9XfBQDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DUGDBS
                                                                                                                                                                                                                          MD5:52FDFD3DB98475FBBB620D0D5565C5CC
                                                                                                                                                                                                                          SHA1:C7750452859663605272553DBEE0B6C134E1517C
                                                                                                                                                                                                                          SHA-256:6040827AFED8CEF45F252FBD7E3E862C0B5E9D06C1C98C58BAD61DFE67BD57CC
                                                                                                                                                                                                                          SHA-512:2FF9D96D81279148A86BE208FEEACCBCB8B4224D093D6C092ECD1C4EA2186589CCF947027D3A726600C703611B4CFEE029AA14ED3E8593C477B427C4F342CF27
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Accra) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Addis_Ababa

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):189
                                                                                                                                                                                                                          Entropy (8bit):4.817170256300069
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DczqIVDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DnaDkO
                                                                                                                                                                                                                          MD5:30CDD4D37E9DD60FBF6D754C9343F364
                                                                                                                                                                                                                          SHA1:56F896C21068764B7B8F884F374B18913CA3D9CA
                                                                                                                                                                                                                          SHA-256:E11FD8AD8572B684333810CFDC23B92E1ACF619875866985E288D92F8277D07F
                                                                                                                                                                                                                          SHA-512:78FC8043CCE25713404E70996229E5EA8238BF5C0F59029064EDA5494E2D4F54398931F3D855E30C82B2C53B789C40EE4CBF09D0F98C2BA6734595D4AA75017A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Addis_Ababa) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Algiers

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1080
                                                                                                                                                                                                                          Entropy (8bit):4.187497782275587
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MB862D7nmdHh5Cv6/lHY8SOSuvvzXipFSgSO5vW5aKmvbsF6VWsXN87QBWcAFy:5veSvKlHYXNujXipFSjKRKXiWsXCGWJy
                                                                                                                                                                                                                          MD5:E8D3DF11CE0E7575485573FA07D955D5
                                                                                                                                                                                                                          SHA1:3B2C00C85B6C0BFAA1C676C970D6DF1B4BDC3D4A
                                                                                                                                                                                                                          SHA-256:E6874647561CE1C5FD1F650C9B167F77AC5B24FD2026046399A9043CF998E5C4
                                                                                                                                                                                                                          SHA-512:E2968BE847622CF243C0E498436FD21BDC2E1DF0FD8D694F2C70569D17CE896CDE4968BB8ABDEF9F687439E4EA2D955AE87D6C15E81F881EE1413416A90765D4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Algiers) {.. {-9223372036854775808 732 0 LMT}.. {-2486592732 561 0 PMT}.. {-1855958961 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1531443600 0 0 WET}.. {-956365200 3600 1 WEST}.. {-950486400 0 0 WET}.. {-942012000 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796262400 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766630800 3600 0 CET}.. {-733280400 0 0 WET}.. {-439430400 3600 0 CET}.. {-212029200 0 0 WET}.. {41468400 3600 1 WEST}.. {54774000 0 0 WET}.. {231724800 3600 1 WEST}.. {246240000 3600 0 CET}.. {259545600 7200 1 CEST}.. {275274000 3600 0 CET}.. {309740400 0 0 WET}.. {

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Asmara

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.801054282631739
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcjEUEH+DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DGs+DR
                                                                                                                                                                                                                          MD5:A543BDEB3771017421FB75231F0004F2
                                                                                                                                                                                                                          SHA1:D682C58C27562FF3ABAB8EDE8EB6EA754DA7C02E
                                                                                                                                                                                                                          SHA-256:064EB7F9A1FA05A317C6BDCA6B102BC1560D980758F9E4DDB010C9E7DC068ECB
                                                                                                                                                                                                                          SHA-512:44848D60EDC79AF784A819714C0D9F62DCCB6329B47F25D74AB8C174BF9EC3F783C66FEB27F588A93FABA9BECAF076F453D6D797CE4F28461F7AE69440EA54C7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Asmara) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Asmera

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.806258322241929
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcjAWDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2D8DkOn
                                                                                                                                                                                                                          MD5:1B5E386E7A2F10D9385DE4C5683EBB85
                                                                                                                                                                                                                          SHA1:FECBA599C37493D2E0AEE8E21BAB40BF8E8DC82A
                                                                                                                                                                                                                          SHA-256:76939852A98EA7BF156D0AC18B434CC610DAF5232322C0FBB066CD52C5B72AF7
                                                                                                                                                                                                                          SHA-512:B36FABFCDB2187A3A4A211C8E033D96C91E3C4D47907D284E10786555562C82231566033EAB4753EF1E48DF1233CFC8C6C0FB3CA50748BE0B2554A972A88FBA0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Asmera) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Bamako

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.883634030944169
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcxAQDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DwNDBS
                                                                                                                                                                                                                          MD5:6B9BB5B37C41AA727E31BF03483DC1CA
                                                                                                                                                                                                                          SHA1:CB3BBA37B063EA4A54CD15C6E30C14D8CA30D3C0
                                                                                                                                                                                                                          SHA-256:F6D1BA22115A6565B6D6ABEB578F001DDB41E673C422C8EA70D0DF77B24115F6
                                                                                                                                                                                                                          SHA-512:23DB3E298FDEB165FD85D99E03C00835B584984B814AF7F54A9CDD4A9F93E16B0C58342D319129F46CF8EC36F93DE5EA51B492CA4CABDAB75D84709BC6C26119
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Bamako) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Bangui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178
                                                                                                                                                                                                                          Entropy (8bit):4.882974805254803
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcx2m/2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dw/2D4yn
                                                                                                                                                                                                                          MD5:92FF9E5835C0C80F358BFE69120660A0
                                                                                                                                                                                                                          SHA1:724758B43BD79DD8A29B02BE6910D492924F8280
                                                                                                                                                                                                                          SHA-256:5047A507D22B68C9349EB6A48C41C80DB4C69F98F99C6574059DEA87178E36C0
                                                                                                                                                                                                                          SHA-512:6FCB709DB4AC19191FECE1E8BAC55E77F265B5AF89F7A3565F06BFAF0BEE12E3EAF2F52CA09C68D75C358C25A31867505CE8AD75D7386DCD15F4BE1CE61272CD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Bangui) $TZData(:Africa/Lagos)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Banjul

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.888193386512119
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcx79FHp4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dw7J4c
                                                                                                                                                                                                                          MD5:46E5703CF284E44E15E5872DF075FCBC
                                                                                                                                                                                                                          SHA1:EA4BFA6D568DFA877F72302ADA21ECC2840D9FD5
                                                                                                                                                                                                                          SHA-256:77E610A02CCECE3045B09D07A9BE6100F5AA9C3C2AEB543535C9AE941194F4E4
                                                                                                                                                                                                                          SHA-512:1454467FE63E97DFA4DE66E359F68B2D80C92CDE59FC15A4BE513629FFD154D2281EADF3FC78F7AFDDF5A5896195F3A69E66697A659BBB1A0EAFD3E1DA6565EC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Banjul) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Bissau

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):176
                                                                                                                                                                                                                          Entropy (8bit):4.847843768169462
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2Dc5iDMXGm2OHGVkeoHsdSawwF6hSVPVFwy:SlSWB9eg/2D4uDm2OHCkeoH1awwFMmMy
                                                                                                                                                                                                                          MD5:7E710C939B9CC0C1AC1ECF4239B543C5
                                                                                                                                                                                                                          SHA1:429CC87086FB22727815ED05AC6472333FF06013
                                                                                                                                                                                                                          SHA-256:2A870E534DE67713C27F2F3B9BF26FA7498C240CF633988CE76DBDAC5B69214D
                                                                                                                                                                                                                          SHA-512:70D9365C31C43A95211FC20E9290B24D356FFEFA935B8829CE32831026A196DECDD12226097F6DA3B4B919E137AA0181714680CDBB72B00C130A87E3A4735004
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Bissau) {.. {-9223372036854775808 -3740 0 LMT}.. {-1830380400 -3600 0 -01}.. {157770000 0 0 GMT}..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Blantyre

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):183
                                                                                                                                                                                                                          Entropy (8bit):4.904342145830274
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2Dc8ycXp75h4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DAmp1hs
                                                                                                                                                                                                                          MD5:7AD3749D7047855CB9B9EC9696015402
                                                                                                                                                                                                                          SHA1:F792359AD9EEC2ABD98DAFA6661C1E57BAB89EBE
                                                                                                                                                                                                                          SHA-256:8F700409B8EEE33ACE5F050414971FFEE0270949842E58E9299BB5CD6CCF34DE
                                                                                                                                                                                                                          SHA-512:681C1B318746C587DEBA6E109D1D5A99D1F3E28FE46C24F36B69D533D884FDDC6EA35BB31A475575D683B73BF129FED761523EC9285F2FF1E4CACA2C54C046C5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Blantyre) $TZData(:Africa/Maputo)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Brazzaville

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):183
                                                                                                                                                                                                                          Entropy (8bit):4.901235831565769
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DciE0TMJZp4DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2D4qGp4D1
                                                                                                                                                                                                                          MD5:7028268EE88250AC40547A3FDBBFC67C
                                                                                                                                                                                                                          SHA1:5006D499CD1D1CB93EB3DA0EC279F76B7123DAA6
                                                                                                                                                                                                                          SHA-256:596DB2D64CDD6250642CB65514D5BCB52F3E3EA83F50D8915D9D4FDEA008F440
                                                                                                                                                                                                                          SHA-512:D623C69FE8A6050E77FB819C2F5FAEE35D5034182B1D30A409C17208155501656133E774E402875537335F8201E4734A0B5D327712CBF623AC330F1014D9025B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Brazzaville) $TZData(:Africa/Lagos)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Bujumbura

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.947752840781864
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DclbDcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DkbDEi
                                                                                                                                                                                                                          MD5:0EBC2D8F0BD1A32C21070F9397EAC9E2
                                                                                                                                                                                                                          SHA1:95AAA97427265635784E8AC624CA863DB9F1475D
                                                                                                                                                                                                                          SHA-256:9A15867255B43A954CA60DA11660F157553AAB6A15C50ACD49D182276E0CF4CC
                                                                                                                                                                                                                          SHA-512:4CD2E14F84C58E955742637A51D99DB9493972671A2B5D801EBD9D901D4903654E374C59BF010C70071D33FA17788358F78004201A787CCA2AD714D670393488
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Bujumbura) $TZData(:Africa/Maputo)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Cairo

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3852
                                                                                                                                                                                                                          Entropy (8bit):3.7766651198444507
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:58ybRwEa40MF4pt0/jaGYbaJF0a3T07ITB85oWXmSGmuyTVuV0apRQnL0KD3rZza:fLg1GbJFp3gHRQVy7DPUUQkiHMo
                                                                                                                                                                                                                          MD5:9DCDB3DD41DA13D81EB8E1CAF56964DA
                                                                                                                                                                                                                          SHA1:F95EE7B1EF464F2640EC4AE29F3C18B5BF2B2905
                                                                                                                                                                                                                          SHA-256:8698B0A53D858AEA7C495EDF759EF0E6C63F7E07A256599393DEC7B7A7413734
                                                                                                                                                                                                                          SHA-512:BA5898ABEE541BC72C9DEDD77BABB18024C7AEA0274FA3F809748FCBFF770BFAD902BF70680DDE989F7D3592E5398C100D0E0EA388D4200911ED7DE089535D6D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Cairo) {.. {-9223372036854775808 7509 0 LMT}.. {-2185409109 7200 0 EET}.. {-929844000 10800 1 EEST}.. {-923108400 7200 0 EET}.. {-906170400 10800 1 EEST}.. {-892868400 7200 0 EET}.. {-875844000 10800 1 EEST}.. {-857790000 7200 0 EET}.. {-844308000 10800 1 EEST}.. {-825822000 7200 0 EET}.. {-812685600 10800 1 EEST}.. {-794199600 7200 0 EET}.. {-779853600 10800 1 EEST}.. {-762663600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-165801600 7200 0 EET}.. {-147402000

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Casablanca

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5532
                                                                                                                                                                                                                          Entropy (8bit):3.535398586134154
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:zE+CJZtmaG6/eszBrlxs5MRhk9xPmwv7KbGKCDp0d:7MZSszBrlKcJC9k
                                                                                                                                                                                                                          MD5:18183122D242E0B69A80BC02BC0328DF
                                                                                                                                                                                                                          SHA1:C9976ABC0663EB29A2FEAAFDF6746C05A264B67C
                                                                                                                                                                                                                          SHA-256:8776EEDFDFEE09C4C833593127CEFAC9C33E2487AB9BF4BF8C73E5E11B4E5613
                                                                                                                                                                                                                          SHA-512:9611A6EF9C5B55FAB752C1EC7E464B8AF60AE32383CE9BA72F35168ABB68A45DB0654A9099CBDC123F5F6E2B6DB7C8FBF56A8DDB813824187AD1090971F12219
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Casablanca) {.. {-9223372036854775808 -1820 0 LMT}.. {-1773012580 0 0 +00}.. {-956361600 3600 1 +00}.. {-950490000 0 0 +00}.. {-942019200 3600 1 +00}.. {-761187600 0 0 +00}.. {-617241600 3600 1 +00}.. {-605149200 0 0 +00}.. {-81432000 3600 1 +00}.. {-71110800 0 0 +00}.. {141264000 3600 1 +00}.. {147222000 0 0 +00}.. {199756800 3600 1 +00}.. {207702000 0 0 +00}.. {231292800 3600 1 +00}.. {244249200 0 0 +00}.. {265507200 3600 1 +00}.. {271033200 0 0 +00}.. {448243200 3600 0 +01}.. {504918000 0 0 +00}.. {1212278400 3600 1 +00}.. {1220223600 0 0 +00}.. {1243814400 3600 1 +00}.. {1250809200 0 0 +00}.. {1272758400 3600 1 +00}.. {1281222000 0 0 +00}.. {1301788800 3600 1 +00}.. {1312066800 0 0 +00}.. {1335664800 3600 1 +00}.. {1342749600 0 0 +00}.. {1345428000 3600 1 +00}.. {1348970400 0 0 +00}.. {1367114400 3600 1 +00}.. {13731

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Ceuta

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7536
                                                                                                                                                                                                                          Entropy (8bit):3.8315604186920704
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:TzLdXKy9f4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:TdayR41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                          MD5:30155093248C4F7E45EF7C0132D2B2AB
                                                                                                                                                                                                                          SHA1:FAD100CC49F0CB0910BDE39B43295A47512E1BE6
                                                                                                                                                                                                                          SHA-256:8827F7311EDE69A9679BDF2B7418DBF350A2FC8F973E8B1E1E4390D4D5C6D2E8
                                                                                                                                                                                                                          SHA-512:469A24AF0C2A4A40CB2488C3E21BB9BBDE057F876EACA08A31FC6F22845063D917A0A4AE96680401E45792DE534EE3A305F137A93C4DF879B4602510D881270E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Ceuta) {.. {-9223372036854775808 -1276 0 LMT}.. {-2177452800 0 0 WET}.. {-1630112400 3600 1 WEST}.. {-1616810400 0 0 WET}.. {-1451692800 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316390400 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1293840000 0 0 WET}.. {-94694400 0 0 WET}.. {-81432000 3600 1 WEST}.. {-71110800 0 0 WET}.. {141264000 3600 1 WEST}.. {147222000 0 0 WET}.. {199756800 3600 1 WEST}.. {207702000 0 0 WET}.. {231292800 3600 1 WEST}.. {244249200 0 0 WET}.. {265507200 3600 1 WEST}.. {271033200 0 0 WET}.. {448243200 3600 0 CET}.. {504918000 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Conakry

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):4.88110192592456
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcmMM1+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DCM1+c
                                                                                                                                                                                                                          MD5:8CDD2EEB7E0EC816F3EC051350FEBF13
                                                                                                                                                                                                                          SHA1:37F3A149B4A01DFA2EAB42A28C810BE66AAB7C52
                                                                                                                                                                                                                          SHA-256:3176C99FC45337CBCE0CD516DE4B02B8BAA47D00E84F698122A2ADD57797984E
                                                                                                                                                                                                                          SHA-512:5A90B6DB45EDAD7734D596FB81FD1959A433F57E71D2212E1DCBD6A12F3FD1FE747FA363C4C787A4D3023F542553C1E2C9CF4F61E28F1BB13042E4AFE3D0FF31
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Conakry) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Dakar

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):183
                                                                                                                                                                                                                          Entropy (8bit):4.856992353568779
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcXXMFBx/2DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DKXEBn
                                                                                                                                                                                                                          MD5:946D3B52F915445DBB8EE8BF67F4EFAB
                                                                                                                                                                                                                          SHA1:18345968B95E886CA72634D49F2B38F9B29BA629
                                                                                                                                                                                                                          SHA-256:D50F9732757B284BAC75526F2CFA585DF7F6974160827AFB0FF66124C7CFD361
                                                                                                                                                                                                                          SHA-512:00B531D1352CF35045EE25C777C7FEA17294E9861E68CE2DE0D9884C05EBDEA84D5F4F0E8B5605721295E25C259979446B7DB76525A633C7D2FA35B38962CF43
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Dakar) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Dar_es_Salaam

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):191
                                                                                                                                                                                                                          Entropy (8bit):4.8447607449193075
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2Dc8bEH+DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DJbVDR
                                                                                                                                                                                                                          MD5:7A819572758BC60F4085DF28F1DD1C01
                                                                                                                                                                                                                          SHA1:0A5BA34EBFBA5A8E8B896713BA527781FC90FF01
                                                                                                                                                                                                                          SHA-256:AB69948637416219A3D458777990FA4568BEBC89388884BBF129C0E1370A560B
                                                                                                                                                                                                                          SHA-512:C03E785D1E85292056BB0BDD8DF8326C5DFEB6070AB1C071E1032D14EA69C9DEBC57B2CC7852E35D31652187126CCF0009A6A5C32F9DBB75D56C705535DF05CC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Dar_es_Salaam) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Djibouti

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):186
                                                                                                                                                                                                                          Entropy (8bit):4.829357904445218
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcRHKQ1BQDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DOrkDR
                                                                                                                                                                                                                          MD5:7981499F9430DC1636C9F834273E0B91
                                                                                                                                                                                                                          SHA1:1D63F8578420D56E4A5D9D0881FBEC015421E416
                                                                                                                                                                                                                          SHA-256:E7F7560CCD65D53C446ADAE7128A74D37E17DD0B907A2F2FD85322FB8707B497
                                                                                                                                                                                                                          SHA-512:3C3F7D78E9A0DE6E2950E1C305EA2DBC986754AE9FB10AC410685F30C39EC235F6F221393099C012E62EE5A7B4F1BED67C96B7B81E90BBA064BA9FE685FE4050
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Djibouti) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\Douala

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178
                                                                                                                                                                                                                          Entropy (8bit):4.850101792457859
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcnKe2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dml2D4yn
                                                                                                                                                                                                                          MD5:44881E75AC32FA95FF6143066EF01B90
                                                                                                                                                                                                                          SHA1:A221619B4CDE8BE6A181E1F3869EAB665F2E98B8
                                                                                                                                                                                                                          SHA-256:FCF2DAD148F4D2951320EA99730C56D5EB43D505F37416BE4BAD265CE2902706
                                                                                                                                                                                                                          SHA-512:4FA67A5F84758366189F0FC4A7FA6C820BA083E1C56EA95D25D21A367F25F76261B7EB5631DFFEB20E095CFD64E770338773F76BD50D4CF6AE29AD3EDFCEC408
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Douala) $TZData(:Africa/Lagos)..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tcl\tzdata\Africa\El_Aaiun

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5235
                                                                                                                                                                                                                          Entropy (8bit):3.541189246992611
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:+eCJZtmaG6/eszBrlxs5MRhk9xPmwv7KbGKCDp0d:+eqZSszBrlKcJC9k
                                                                                                                                                                                                                          MD5:956F5B51FA8BA2E954A0E59AAC8F3276
                                                                                                                                                                                                                          SHA1:AE35A8502E57EA6EE173E3B42509E4CAC73DA091
                                                                                                                                                                                                                          SHA-256:5FB102A95B3C004AAB8371840B1A04AC352F48FF9E9EAFDEAAF21960B0F3CAA6
                                                                                                                                                                                                                          SHA-512:19E7F2574E2B62DF68CC24737F6B94864B3D64B2472BC7D78E6AB5142A1DC1AB3B3700AB802129CB16AED4A4FED29E2B8A5593EE327ADF496255FE2FEF6A7023
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/El_Aaiun) {.. {-9223372036854775808 -3168 0 LMT}.. {-1136070432 -3600 0 -01}.. {198291600 0 0 +00}.. {199756800 3600 1 +00}.. {207702000 0 0 +00}.. {231292800 3600 1 +00}.. {244249200 0 0 +00}.. {265507200 3600 1 +00}.. {271033200 0 0 +00}.. {1212278400 3600 1 +00}.. {1220223600 0 0 +00}.. {1243814400 3600 1 +00}.. {1250809200 0 0 +00}.. {1272758400 3600 1 +00}.. {1281222000 0 0 +00}.. {1301788800 3600 1 +00}.. {1312066800 0 0 +00}.. {1335664800 3600 1 +00}.. {1342749600 0 0 +00}.. {1345428000 3600 1 +00}.. {1348970400 0 0 +00}.. {1367114400 3600 1 +00}.. {1373162400 0 0 +00}.. {1376100000 3600 1 +00}.. {1382839200 0 0 +00}.. {1396144800 3600 1 +00}.. {1403920800 0 0 +00}.. {1406944800 3600 1 +00}.. {1414288800 0 0 +00}.. {1427594400 3600 1 +00}.. {1434247200 0 0 +00}.. {1437271200 3600 1 +00}.. {1445738400 0 0 +00}.. {1

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\images\README

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):329
                                                                                                                                                                                                                          Entropy (8bit):4.3973643486226655
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:nVxpJFBmHdeA1xNZgk0dIf3Ju4dFi6/XWrWhr3W7FxmVFraazmVAJFKyVQR7icr8:nj5Bqf1fZgp6A4FDG6dm7FUGAJVVMRmn
                                                                                                                                                                                                                          MD5:921245A21F7E783997DC7B859AF1B65B
                                                                                                                                                                                                                          SHA1:2EFE3C8F70CF18621006890BF21CC097770D140D
                                                                                                                                                                                                                          SHA-256:C6DB098EBD8A622164D37D4AB0A8C205DB1A83AC3065D5CDE3CB5FB61925D283
                                                                                                                                                                                                                          SHA-512:CAD823FF3D13A64C00825961E75B5133690556FB1F622834F8B1DF316A9E75BABB63B9F5148DAE7B1391123B4C8D55B4B8B2EB6F8E6E1DA9DE02A5BD7AC0FD6F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:README - images directory....This directory includes images for the Tcl Logo and the Tcl Powered..Logo. Please feel free to use the Tcl Powered Logo on any of your..products that employ the use of Tcl or Tk. The Tcl logo may also be..used to promote Tcl in your product documentation, web site or other..places you so desire...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\images\logo.eps

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PostScript document text conforming DSC level 3.0, type EPS
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):34991
                                                                                                                                                                                                                          Entropy (8bit):5.248845410801251
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:0YrY6a0v4uIqYMEKjodQKOfRXMLcSqDGpfTKFVm3AsanMEDzzBHWzaw7XUbTJjoB:0YrY6aeIqYMEKjouzfRXMLcSqDGpfTKo
                                                                                                                                                                                                                          MD5:23C4EDED40DEC065F99E6653AEE1BB31
                                                                                                                                                                                                                          SHA1:3175E261BE198731DEDB07264CCB84C8DEDF7967
                                                                                                                                                                                                                          SHA-256:76207D8DFDE189A29DC0E76ADB7EAAA606B96BC6C1C831F34D1C85B1C5B51DD3
                                                                                                                                                                                                                          SHA-512:BA139A64BE72BB681040924C4294E2726BA5AB243E805E60A854D2D23E154705E2431D1AB2DE732BFA393747FD30D8A5C913895CBE1463DBF50CC23CAE5B0454
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:%!PS-Adobe-3.0 EPSF-3.0..%%Creator: Adobe Illustrator(TM) 5.5..%%For: (Bud Northern) (Mark Anderson Design)..%%Title: (TCL/TK LOGO.ILLUS)..%%CreationDate: (8/1/96) (4:58 PM)..%%BoundingBox: 251 331 371 512..%%HiResBoundingBox: 251.3386 331.5616 370.5213 511.775..%%DocumentProcessColors: Cyan Magenta Yellow..%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0..%%+ procset Adobe_IllustratorA_AI5 1.0 0..%AI5_FileFormat 1.2..%AI3_ColorUsage: Color..%%DocumentCustomColors: (TCL RED)..%%CMYKCustomColor: 0 0.45 1 0 (Orange)..%%+ 0 0.25 1 0 (Orange Yellow)..%%+ 0 0.79 0.91 0 (TCL RED)..%AI3_TemplateBox: 306 396 306 396..%AI3_TileBox: 12 12 600 780..%AI3_DocumentPreview: Macintosh_ColorPic..%AI5_ArtSize: 612 792..%AI5_RulerUnits: 0..%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0..%AI5_TargetResolution: 800..%AI5_NumLayers: 1..%AI5_OpenToView: 90 576 2 938 673 18 1 1 2 40..%AI5_OpenViewLayers: 7..%%EndComments..%%BeginProlog..%%BeginResource: procset Adobe_level2_AI5 1.0 0..%%Title: (Adobe Illustrator

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\images\logo100.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 68 x 100
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2341
                                                                                                                                                                                                                          Entropy (8bit):6.9734417899888665
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:qF/mIXn3l7+ejbL/4nZEsKPKer1OPQqVRqJbPpRRKOv/UVO47f:81nHL4T0KorxvRKkc847f
                                                                                                                                                                                                                          MD5:FF04B357B7AB0A8B573C10C6DA945D6A
                                                                                                                                                                                                                          SHA1:BCB73D8AF2628463A1B955581999C77F09F805B8
                                                                                                                                                                                                                          SHA-256:72F6B34D3C8F424FF0A290A793FCFBF34FD5630A916CD02E0A5DDA0144B5957F
                                                                                                                                                                                                                          SHA-512:10DFE631C5FC24CF239D817EEFA14329946E26ED6BCFC1B517E2F9AF81807977428BA2539AAA653A89A372257D494E8136FD6ABBC4F727E6B199400DE05ACCD5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89aD.d...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....D.d........H......*\...z..Ht@Q...92.p...z.$.@@.E..u.Y.2..0c..q.cB.,[..... ..1..qbM.2~*].....s...S.@.L.j..#..\......h..........].D(..m......@.Z....oO...3=.c...G".(..pL...q]..%....[...#...+...X.h....^.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\images\logo64.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 43 x 64
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1670
                                                                                                                                                                                                                          Entropy (8bit):6.326462043862671
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:PF/mIXn3l7+ejbL/4xsgq4sNC6JYp6s/pmp76F:/1nHL404raM/op2
                                                                                                                                                                                                                          MD5:B226CC3DA70AAB2EBB8DFFD0C953933D
                                                                                                                                                                                                                          SHA1:EA52219A37A140FD98AEA66EA54685DD8158D9B1
                                                                                                                                                                                                                          SHA-256:138C240382304F350383B02ED56C69103A9431C0544EB1EC5DCD7DEC7A555DD9
                                                                                                                                                                                                                          SHA-512:3D043F41B887D54CCADBF9E40E48D7FFF99B02B6FAF6B1DD0C6C6FEF0F8A17630252D371DE3C60D3EFBA80A974A0670AF3747E634C59BDFBC78544D878D498D4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a+.@...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....+.@........H. .z..(tp......@...92....#. A.......C.\.%...)Z..1a.8s..W/..@....3..C...y$.GW.....5.FU..j..;.F(Pc+W.-..X.D-[.*g....F..`.:mkT...Lw...A/.....u.7p..a..9P.....q2..Xg..G....3}AKv.\.d..yL.>..1.#

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\images\logoLarge.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 354 x 520
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11000
                                                                                                                                                                                                                          Entropy (8bit):7.88559092427108
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:d+nY6zludc/We/yXy9JHBUoIMSapQdrGlapzmyNMK1vbXkgMmgFW/KxIq3NhZe:YnY6p4c/OCHyowaGUaCcMK1vbXNwFW/l
                                                                                                                                                                                                                          MD5:45D9B00C4CF82CC53723B00D876B5E7E
                                                                                                                                                                                                                          SHA1:DDD10E798AF209EFCE022E97448E5EE11CEB5621
                                                                                                                                                                                                                          SHA-256:0F404764D07A6AE2EF9E1E0E8EAAC278B7D488D61CF1C084146F2F33B485F2ED
                                                                                                                                                                                                                          SHA-512:6E89DACF2077E1307DA05C16EF8FDE26E92566086346085BE10A7FD88658B9CDC87A3EC4D17504AF57D5967861B1652FA476B2DDD4D9C6BCFED9C60BB2B03B6F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89ab.................f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....b..........H......*\....#J.H....3j.... '.;p....(.8X..^.0c.I...z8O.\.....:....$..Fu<8`...P.>%I.gO.C.h-..+.`....@..h....dJ.?...K...H.,U.._.#...g..[.*^.x.....J.L.!.'........=+eZ..i..ynF.8...].y|..m.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\images\logoMed.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 120 x 181
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3889
                                                                                                                                                                                                                          Entropy (8bit):7.425138719078912
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:9qqbIh+cE4C8ric/jxK5mxsFBu3/0GIJ6Qap1Y5uMiR8pw5rB/SgijDb+TOh:hy+mnZ7xK5IsTwDQmkdiiG5rB/BE+6h
                                                                                                                                                                                                                          MD5:BD12B645A9B0036A9C24298CD7A81E5A
                                                                                                                                                                                                                          SHA1:13488E4F28676F1E0CE383F80D13510F07198B99
                                                                                                                                                                                                                          SHA-256:4D0BD3228AB4CC3E5159F4337BE969EC7B7334E265C99B7633E3DAF3C3FCFB62
                                                                                                                                                                                                                          SHA-512:F62C996857CA6AD28C9C938E0F12106E0DF5A20D1B4B0B0D17F6294A112359BA82268961F2A054BD040B5FE4057F712206D02F2E668675BBCF6DA59A4DA0A1BB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87ax............................................................................z.....{..o.....m..b...`{.X....vy...hk.Um.N...I`.D..Z^.LP.?R.;!....?C.5C.3#.l..,6.*&.15...`..#(.If.y.....l...._..#/...Hm.>_.y..4R.k..#6..._......w..*K.^.."<.....G{.w..3_."C.Q..F....v..!K...v.2m.)_.[..!R.u.1t.g..)f. X.O..E..1z.g. _.Z..D..:..0..Z.. f.D..0..'z..m.N..C../.z.svC.q/.m.ze7.\..P..I..1%.,...............................................................................................................................................................................................................................................................................................................................................................................................,....x..........H.......D..!...7.PAQ...._l8.... C.<.a...*.x....0q.. ..M.%.<.HBe.@.....Q..7..XC..P..<z3..X...P.jA.%'@.J.lV.......R.,..+....t....7h.....(..a...+^.'..7..L.....V...s..$....a.....8`.9..}K......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\images\pwrdLogo.eps

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PostScript document text conforming DSC level 3.0, type EPS
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):29706
                                                                                                                                                                                                                          Entropy (8bit):5.33387357427899
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:0warY6a0v4uIqYMEKjodQKOfRtMLcSqDGpf88KFVmlhEtOI/eE7U0a1:03rY6aeIqYMEKjouzfRtMLcSqDGpfbKc
                                                                                                                                                                                                                          MD5:4AE11820D4D592D02CDE458E6F8CE518
                                                                                                                                                                                                                          SHA1:A2E8D3D6191B336D43E48A65C3AE6485B07D93C6
                                                                                                                                                                                                                          SHA-256:87FD9E46DBB5F2BF1529AFB411182C9FB9C58E23D830C66A233AF0C256BB8EFF
                                                                                                                                                                                                                          SHA-512:E0AD4ED570D414BF00931B0F5BBB61FEF981ABDB22ECC42F8E9841905D38874CDFE38F22EDB17ACD0F7539B2932F9C4A865FA73A49BB1458CE05EE10A78BE357
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:%!PS-Adobe-3.0 EPSF-3.0..%%Creator: Adobe Illustrator(TM) 5.5..%%For: (Bud Northern) (Mark Anderson Design)..%%Title: (TCL PWRD LOGO.ILLUS)..%%CreationDate: (8/1/96) (4:59 PM)..%%BoundingBox: 242 302 377 513..%%HiResBoundingBox: 242.0523 302.5199 376.3322 512.5323..%%DocumentProcessColors: Cyan Magenta Yellow..%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0..%%+ procset Adobe_IllustratorA_AI5 1.0 0..%AI5_FileFormat 1.2..%AI3_ColorUsage: Color..%%CMYKCustomColor: 0 0.45 1 0 (Orange)..%%+ 0 0.25 1 0 (Orange Yellow)..%%+ 0 0.79 0.91 0 (PANTONE Warm Red CV)..%%+ 0 0.79 0.91 0 (TCL RED)..%AI3_TemplateBox: 306 396 306 396..%AI3_TileBox: 12 12 600 780..%AI3_DocumentPreview: Macintosh_ColorPic..%AI5_ArtSize: 612 792..%AI5_RulerUnits: 0..%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0..%AI5_TargetResolution: 800..%AI5_NumLayers: 1..%AI5_OpenToView: 102 564 2 938 673 18 1 1 2 40..%AI5_OpenViewLayers: 7..%%EndComments..%%BeginProlog..%%BeginResource: procset Adobe_level2_AI5 1.0 0..%%Title: (Adobe I

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\images\pwrdLogo100.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 64 x 100
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1615
                                                                                                                                                                                                                          Entropy (8bit):7.461273815456419
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:aE45BzojC3r1WAQ+HT2gAdKhPFZ/ObchgB8:V5Gb1WN+yfcObmgW
                                                                                                                                                                                                                          MD5:DBFAE61191B9FADD4041F4637963D84F
                                                                                                                                                                                                                          SHA1:BD971E71AE805C2C2E51DD544D006E92363B6C0C
                                                                                                                                                                                                                          SHA-256:BCC0E6458249433E8CBA6C58122B7C0EFA9557CBC8FB5F9392EED5D2579FC70B
                                                                                                                                                                                                                          SHA-512:ACEAD81CC1102284ED7D9187398304F21B8287019EB98B0C4EC7398DD8B5BA8E7D19CAA891AA9E7C22017B73D734110096C8A7B41A070191223B5543C39E87AF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a@.d.............................f.................f...ff.f3.f..33.3.........f..ff.f3.33.3.f..f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....@.d....@.pH,..E.... ..(...H$..v..j....K....q..5L......^).3.Y7..r..u.v|g..om...\iHl..p...`G..\~....fn[q...P.g.Z.l....y...\.l......f.Z.g...%%....e...e...)....O.f..e. ....O..qf..%..(.H.u..]..&....#4.......@.).....u!.M..2. ..PJ..#..T..a.....P.Gi... <Hb....x..z.3.X.O..f.........].Bt..lB.Q.r...9pP....&...L. ..,`[.....E6.Q.....?.#L......|g........N....[.._........."4......b....G6.........m.zI].....I.@.......I.9...glew...2.B..c>./..2....x.....<...{...7;.....y.I.....4G.Qj0..7..%.W.V...?!..[...X..=..k.h..[Q<.....0.B....(P.x.,.......8O*Z.8P!.$....u.c..Ea!..eC....CB.. .H..E..#..C..E...z..&.Nu........c.0..#.T.M.U........l.p @..s.|..pf!..&.......8.#.8.....*..J>. .t..h6(........#..0.A...*!..)...x..u.Z....*%..H.....*.......`......|.....1.......&.....T*...f.l...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\images\pwrdLogo150.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 97 x 150
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2489
                                                                                                                                                                                                                          Entropy (8bit):7.708754027741608
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:/Ev7JJ+3uvz/Hwbcp7igaIwjBui7qFxIIOdJXcI+Ks:M9oWz/7pZAV7qPIImJXtXs
                                                                                                                                                                                                                          MD5:711F4E22670FC5798E4F84250C0D0EAA
                                                                                                                                                                                                                          SHA1:1A1582650E218B0BE6FFDEFFD64D27F4B9A9870F
                                                                                                                                                                                                                          SHA-256:5FC25C30AEE76477F1C4E922931CC806823DF059525583FF5705705D9E913C1C
                                                                                                                                                                                                                          SHA-512:220C36010208A87D0F674DA06D6F5B4D6101D196544ABCB4EE32378C46C781589DB1CE7C7DFE6471A8D8E388EE6A279DB237B18AF1EB9130FF9D0222578F1589
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89aa...............................f.................f...ff.f3.f..33.3............f..ff.f3.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....a......@.pH,...r.l:..TB.T..V..z..H.j..h...&.......t"....F...d..gN~Y...g....}..r....g.....o...g.......Y.w..W......N....Z....W....f...tL.~.f....New............W.M.r.........O.q........W-./i.*...`..z..F9.../9..-.......$6..G..S...........zB.,nw.64...e4.......HOt......f.....)..OX..C.eU.(.Qh.....T..<Q.Y.P.L.YxT....2........ji..3.^)zz..O.a..6 ...TZ........^...7.....>|P.....w$...k.ZF.\R.u....F.]Z.--(v+)[Y....=.!.W..+.]..]._.....&..../Ap...j...!..b.:...{.^.=.`...U.....@Hf..\?.(..Lq@.........0..L...a...&.!.....]#..]G \..q...A.H.X[...(.W......,...1a..B...W(.t.8.AdG.)..(P=...Uu.u..A.KM\...'r.R./.W..d2a.0..G...?...B......#H........1Q.0...R....%+...0.I..{.<......QV.tz'.yn.E.p..0i.I.g......L....%....K...A.l.ph.Q.1e...Z....g..2e...smU&d;.J..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\images\pwrdLogo175.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 113 x 175
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2981
                                                                                                                                                                                                                          Entropy (8bit):7.758793907956808
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:AmEwM8ioQoHJQBTThKVI7G78NLL120GFBBFXJRxlu+BmO/5lNqm7Eq:B57QoHJQt4II8BZ+jxluZO/5lNqm7Eq
                                                                                                                                                                                                                          MD5:DA5FB10F4215E9A1F4B162257972F9F3
                                                                                                                                                                                                                          SHA1:8DB7FB453B79B8F2B4E67AC30A4BA5B5BDDEBD3B
                                                                                                                                                                                                                          SHA-256:62866E95501C436B329A15432355743C6EFD64A37CFB65BCECE465AB63ECF240
                                                                                                                                                                                                                          SHA-512:990CF306F04A536E4F92257A07DA2D120877C00573BD0F7B17466D74E797D827F6C127E2BEAADB734A529254595918C3A5F54FDBD859BC325A162C8CD8F6F5BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89aq...............................f.................f...ff.f3.f..33.3............f..ff.f3.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3................................................................!.. -dl-.!.......,....q......@.pH,...r.l:....A}H...v..R......D.VF..,%M....^.....fyzU.P..f...i.....t..Uqe..N..Z..i......~....g......u.....g......\...h.....P...h.....Q..g....Z..h......]......\...M...[..s...c2.+R.$. ......#.....)v..4....MO.b.....9......[.M.........h'..<-..=.....HQD....D?.~......W7. ..V.W0..l....*0p}..KP?c.\@KW.S(..M..B.....-q...S2...*.,..P.{....F..._MAn ....i.Y3............zh.y.j@...a876...ui.i..;K.........p...`.,}w....tv.m...Y..........;.;.e).e&.......-.NC.*4..(........*..F........[,w....f......E....h..a3.T.^.........)...C.N8.h\T...+&.z....g]H..B..#.t6..Z.....j.-..N......TI....A........M?..Q&V'...Mb.f.x...h.$r.U .9..Ci. ].4.Zb..@...X....%..<..b)V!........Y)x......T.....h.p.d..h..(........]@.**J.M.U.Jf...Y.:....F..g:..d..6q.-..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\images\pwrdLogo200.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 130 x 200
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3491
                                                                                                                                                                                                                          Entropy (8bit):7.790611381196208
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ROGuxkQ9mcV7RXcECEtqCa+6GK8WseNXhewFIp9ZmL4u:ROGwpVOEbqCrWsUhtIk4u
                                                                                                                                                                                                                          MD5:A5E4284D75C457F7A33587E7CE0D1D99
                                                                                                                                                                                                                          SHA1:FA98A0FD8910DF2EFB14EDAEC038B4E391FEAB3C
                                                                                                                                                                                                                          SHA-256:BAD9116386343F4A4C394BDB87146E49F674F687D52BB847BD9E8198FDA382CC
                                                                                                                                                                                                                          SHA-512:4448664925D1C1D9269567905D044BBA48163745646344E08203FCEF5BA1524BA7E03A8903A53DAF7D73FE0D9D820CC9063D4DA2AA1E08EFBF58524B1D69D359
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a................................f.................f...ff.f3.f..33.3............f..ff.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,...........@.pH,...r.l:..T..F$XIe..V$.x..V.Z.z..F.pxd~..........{....o....l..{.b...hi[}P.k...y.....y.f.._R.\...............m.....y.....x......^.Q...j.....\S.....^.......l......]...[.......).....{....7...`..<...`..">..i.?/..@............>..Z.z@....0B..r...j.V.I.@..;%R...*...J.p.A.t.*..$A*...>`.....@g5BP.A..p.x.............q..8...... ...(.Q..#..@...F..YSK..M..#o.....D.m..-.....k}...BT..V......'.....`.d..~;..9+..6...<b.eZ..y^0]0..I...=.6.....}.0<.Z...M...Y1*35.e.....b...U0F~.-.HT......l2.s.q`-....y...e....dPZ....~.zT.M.... "r.E/k. ...*..Lj@'........Pcd&.(..mxF_w.."K..x!..--Y`..A.....Be.jH.A..\..j.....du#.....]^...>......].i.FMO..].9n1",Y...F...EW.9.....0TY.T...Cv!i`%...Hz@.]..U.!Y...#Dv&pi.z(.mn.A....@Q.0.%...&.4.v.cw(.`cd'|..M9..."...,*.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\images\pwrdLogo75.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 48 x 75
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1171
                                                                                                                                                                                                                          Entropy (8bit):7.289201491091023
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:DOfHIzP8hqiF+oyPOmp3XHhPBlMVvG0ffWLpfc:DGoPM+o0OmZXHhOv5WRc
                                                                                                                                                                                                                          MD5:7013CFC23ED23BFF3BDA4952266FA7F4
                                                                                                                                                                                                                          SHA1:E5B1DED49095332236439538ECD9DD0B1FD4934B
                                                                                                                                                                                                                          SHA-256:462A8FF8FD051A8100E8C6C086F497E4056ACE5B20B44791F4AAB964B010A448
                                                                                                                                                                                                                          SHA-512:A887A5EC33B82E4DE412564E86632D9A984E8498F02D8FE081CC4AC091A68DF6CC1A82F4BF99906CFB6EA9D0EF47ADAC2D1B0778DCB997FB24E62FC7A6D77D41
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a0.K.............................f.................f...ff.f3.f..33.3.........f..ff.f3.3f.33.3.f..ff.ff.f3ff333f.3f.33.33f.3......................................................................!.. -dl-.!.......,....0.K....@.pH,...GD.<:..%SR.Z......<.V.$l.....z......:.. .|v[D..f...z.W.G.Vr...NgsU.yl..qU..`.......`fe`.......Fg....(.&...g.Y.. .."..q.V.$.'.Ez.W....y...Y.U...(#Xrf.........Xux.U..........(U.4...X....G.B..t..1S...R..Y. ...l ..".>.h......,%K....A.....<s....#..8.iK.....a.y$h..DQh.PE)....6.....MyL.qzF..... ."..Y0..a......2..*t..Ma..b...M..R.....\..st..=....Q......,>s`....Qt.,..B.R.....!.$..%.....(...s...B.T...`,".h(. D....8..dC..\Q.p.......x.#A.....:..du..(D.XV......7....S.#n8a....2`...f.:G,...==(......`!..$...t....b..../N|...f..J.x... P&.|.d._!N...].1w.3D.0!....@o&H...N.B.J....pz8..w.i....=r.............@5.-!.......H."..[.j.AB<..p....h...V.D..6.h...ab1F.g...I !.V~.H..V.........:.G..|c...,.....TD5..c[.W.....LC.....FJ..71[..lH.M.....8.:$......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\images\tai-ku.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 100 x 100
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5473
                                                                                                                                                                                                                          Entropy (8bit):7.754239979431754
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:+EqG96vSGfyJZ26G6U1LI7nTD2enhjc+2VBnOqcUERVIim:+46KcyJI6G6uU7/LhjlkhQR7m
                                                                                                                                                                                                                          MD5:048AFE69735F6974D2CA7384B879820C
                                                                                                                                                                                                                          SHA1:267A9520C4390221DCE50177E789A4EBD590F484
                                                                                                                                                                                                                          SHA-256:E538F8F4934CA6E1CE29416D292171F28E67DA6C72ED9D236BA42F37445EA41E
                                                                                                                                                                                                                          SHA-512:201DA67A52DADA3AE7C533DE49D3C08A9465F7AA12317A0AE90A8C9C04AA69A85EC00AF2D0069023CD255DDA8768977C03C73516E4848376250E8D0D53D232CB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89ad.d...................RJJ...B99.......RBB..B11ZBB!....R991!!...)....{{B!!R)).JJ.ss.ZZ.BB.kk.RR.JJ.BB9...JJR!!.ZZ.BB.11.99.{s.sk.kc.cZ.ZR.JB.ZR.JB.JB.RJ.B9.91.B9...{.JB.91.B9.B9.1){)!.)!.9)..ZR.JB{91.cR{1).ZJ.ZJ.RB.J9.B1.B1.9).1!....{B9.{k.scc1).kZZ)!c)!.9).B1.9).9).1!.1!.1!.B).9!.9!.1..).....{.sZ1)R)!.B1.B1.ZBR!..9).ZB.9).R9.R9.1!.J1.J1.B).B).9!.9!.1..1..).....sZ.J9.ZB.cJJ!.{1!.B).9!{)..9!.J).B!.B!.9..R1).kJ)!.B1{9).R9.cB.Z9.Z9.B).Z9.B).R1.9!.R1.J).J).B!.1..9....{.s.J9.{Z.ZB.sR.kJk1!.cB.cB.R1.R).1..B!.J!.B.....R91.J1).c.kJ.J).Z1.B!.B!..9!..{R.sJ.Z9.R1{9!..s.R9.Z...J91Z9){B)...............B91..1)!..............................RJR............B)1......R19........BJ.9B..{..s{......!.......,....d.d.@............0@PHa....*.p...7.8.y...C.s6Z.%Q.#s.`:B.N....4jd.K.0..|y....F@.......1~ ......'Y.B"C&R.V.R.4$k.3...D.......Ef*Y3..M........BDV._.....\..).]..>s..$H\%y0WL...d.......D..'..v..1Kz.Zp$;S

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\license.terms

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2307
                                                                                                                                                                                                                          Entropy (8bit):5.135743409565932
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:XU/zAcKT6yOCaDBfsHLk32s3J5w83KDyP1BXy3JQz7yuC:XNc+92sg3A8uyDXy3JQnDC
                                                                                                                                                                                                                          MD5:F090D9B312C16489289FD39813412164
                                                                                                                                                                                                                          SHA1:1BEC6668F6549771DADC67D153B89B8F77DCD4B9
                                                                                                                                                                                                                          SHA-256:0D1E4405F6273F091732764ED89B57066BE63CE64869BE6C71EA337DC4F2F9B5
                                                                                                                                                                                                                          SHA-512:57B323589C5A8D9CBB224416731D8CE65C4B94146DF15CE30885DF63B1D0B3F709093B65390A911F84F20B7C5DE3C0AF9B4D7D531742BE046EDA6E8C3432EF6E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:This software is copyrighted by the Regents of the University of..California, Sun Microsystems, Inc., Scriptics Corporation, ActiveState..Corporation, Apple Inc. and other parties. The following terms apply to..all files associated with the software unless explicitly disclaimed in..individual files.....The authors hereby grant permission to use, copy, modify, distribute,..and license this software and its documentation for any purpose, provided..that existing copyright notices are retained in all copies and that this..notice is included verbatim in any distributions. No written agreement,..license, or royalty fee is required for any of the authorized uses...Modifications to this software may be copyrighted by their authors..and need not follow the licensing terms described here, provided that..the new terms are clearly indicated on the first page of each file where..they apply.....IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY..FOR DIRECT, INDIRECT, SPECIAL, INCI

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\listbox.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15255
                                                                                                                                                                                                                          Entropy (8bit):4.9510475386072095
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:apDYV5Yupn5OcckwBv3HCpg2J8JvJBfWeZhXkz+WkHGowv:aPPkevB2JuvJ9D3XmSc
                                                                                                                                                                                                                          MD5:804E6DCE549B2E541986C0CE9E75E2D1
                                                                                                                                                                                                                          SHA1:C44EE09421F127CF7F4070A9508F22709D06D043
                                                                                                                                                                                                                          SHA-256:47C75F9F8348BF8F2C086C57B97B73741218100CA38D10B8ABDF2051C95B9801
                                                                                                                                                                                                                          SHA-512:029426C4F659848772E6BB1D8182EB03D2B43ADF68FCFCC1EA1C2CC7C883685DEDA3FFFDA7E071912B9BDA616AD7AF2E1CB48CE359700C1A22E1E53E81CAE34B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# listbox.tcl --..#..# This file defines the default bindings for Tk listbox widgets..# and provides procedures that help in implementing those bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1995 Sun Microsystems, Inc...# Copyright (c) 1998 by Scriptics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....#--------------------------------------------------------------------------..# tk::Priv elements used in this file:..#..# afterId -..Token returned by "after" for autoscanning...# listboxPrev -.The last element to be selected or deselected..#...during a selection operation...# listboxSelection -.All of the items that were selected before the..#...current selection operation (such as a mouse..#...drag) started; used to cancel an operation...#--------------------------------------------------------------------------....#--------------

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\megawidget.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9862
                                                                                                                                                                                                                          Entropy (8bit):4.786615174847384
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:mvEEVwjVwqOpOLbkVAg/vyKEZ25YbKZbwrmQ:mvEEVwJwpALPgnyx25YGZkr3
                                                                                                                                                                                                                          MD5:D83ED6AC2912900040530528A0237AB3
                                                                                                                                                                                                                          SHA1:2D18E42A8B96C3D71C1C6701010FDF75C1E6D5D8
                                                                                                                                                                                                                          SHA-256:848258B946C002E2696CA3815A1589C8120AF5CC41FBC11BBD9A3F5754CC21AF
                                                                                                                                                                                                                          SHA-512:00B4CD0D58029FC37820C163A4AE1DEAD22FB5C767BDC118659EACE26D449C362189611DFB3FAB1AC129FABFEC2CE853EA2C10D418FAE5AEB91DDC9330FF782D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# megawidget.tcl..#..#.Basic megawidget support classes. Experimental for any use other than..#.the ::tk::IconList megawdget, which is itself only designed for use in..#.the Unix file dialogs...#..# Copyright (c) 2009-2010 Donal K. Fellows..#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#....package require Tk.....::oo::class create ::tk::Megawidget {.. superclass ::oo::class.. method unknown {w args} {...if {[string match .* $w]} {... [self] create $w {*}$args... return $w...}...next $w {*}$args.. }.. unexport new unknown.. self method create {name superclasses body} {...next $name [list \....superclass ::tk::MegawidgetClass {*}$superclasses]\;$body.. }..}....::oo::class create ::tk::MegawidgetClass {.. variable w hull options IdleCallbacks.. constructor args {...# Extract the "widget name" from the object name...set w [namespace tail [self]].....# Configure things...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\menu.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):39790
                                                                                                                                                                                                                          Entropy (8bit):4.915612301723047
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:NKJsO8O4IzOQjJwxzire5pKVjriecYyq4CpKgnP:NKJsO8iOQizire54lriecYf40
                                                                                                                                                                                                                          MD5:B7DAA21C1C192B8CB5B86CBD7B2CE068
                                                                                                                                                                                                                          SHA1:AE8ABF9017F37CCDF5D0D15DE66BB124A7482BA0
                                                                                                                                                                                                                          SHA-256:312AF944A276CDBF1EE00757EF141595670984F7F13E19922C25643A040F5339
                                                                                                                                                                                                                          SHA-512:B619E3B8BE5EC4545E97B7A7A7F7FECC2AAFA58438F9CA3819F644720CF5FF5C44DA12AC25988570E595D97CAD799F87D93C24D5E67A7A953B9F5312952FBEB6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# menu.tcl --..#..# This file defines the default bindings for Tk menus and menubuttons...# It also implements keyboard traversal of menus and implements a few..# other utility procedures related to menus...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1998-1999 Scriptics Corporation...# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# cursor -..Saves the -cursor option for the posted menubutton...# focus -..Saves the focus during a menu selection operation...#...Focus gets restored here when the menu is unposted...# grabGlobal -..Used in conjunction with tk::Priv(oldGrab): if..#...tk::Priv(oldGrab) is non

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\mkpsenc.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):30840
                                                                                                                                                                                                                          Entropy (8bit):5.142909056222569
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:+c4g8rSnBGzHsGK83Ch0x/0kmSq6O4+rNfPCpM2sEmqKys3pCJxi5dEaY:+c4g8OnBGzBK83Ch0x/0FSq6OnrGM2h3
                                                                                                                                                                                                                          MD5:983C7B78F1A0EBACAB8006D391A01FCD
                                                                                                                                                                                                                          SHA1:7EA37474EA039ED7A37BFDD7D76EAE673E666283
                                                                                                                                                                                                                          SHA-256:C5BDCA3ABA671F03DC4624AB5FD260490F5002491D6C619142CCF5A1A744528A
                                                                                                                                                                                                                          SHA-512:A006EF9B7213E572F6FC540D1512A52C52FEC44E3A07846DE09662AE32B7191C5CF639798531847B39E4076BF9DD6314B6F5373065C04F4FEF221185B39C3117
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# mkpsenc.tcl --..#..# This file generates the postscript prolog used by Tk.....namespace eval ::tk {.. # Creates Postscript encoding vector for ISO-8859-1 (could theoretically.. # handle any 8-bit encoding, but Tk never generates characters outside.. # ASCII)... #.. proc CreatePostscriptEncoding {} {...variable psglyphs...# Now check for known. Even if it is known, it can be other than we...# need. GhostScript seems to be happy with such approach...set result "\[\n"...for {set i 0} {$i<256} {incr i 8} {... for {set j 0} {$j<8} {incr j} {....set enc [encoding convertfrom "iso8859-1" \.....[format %c [expr {$i+$j}]]]....catch {.... set hexcode {}.... set hexcode [format %04X [scan $enc %c]]....}....if {[info exists psglyphs($hexcode)]} {.... append result "/$psglyphs($hexcode)"....} else {.... append result "/space"....}... }... append result "\n"...}...append result "\]"...return $result.. }.... # List of adobe glyph names. Converted from glyph

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgbox.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:xbm image (32x, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16786
                                                                                                                                                                                                                          Entropy (8bit):4.717927930017041
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:+haZOxBpK8uxGe4V88/wxY3Fxqipz4zz4zxxFzxT4OcErDxqdRRZeuC/Vj2CoopC:+hRWRG3FFjvsfCoopwITHzLHFHHAABs
                                                                                                                                                                                                                          MD5:217087AB6B2A8F9D7252E311D69C3769
                                                                                                                                                                                                                          SHA1:09AEB2BC5B7C7F4AB3DE4211D786C519AE0970F6
                                                                                                                                                                                                                          SHA-256:A07E3A3809CED3C6C9C1E171DCA5AD1F28357734CD41B2B9DD9F58085B3D2842
                                                                                                                                                                                                                          SHA-512:6E57633C924BFC16D380C014C20DD24D5727E70D4843FCEC4D7995B4DB21941EA8F2A5FD6E5386DF3364B6905D4D66B2B9595DC8FC70CFF40A2D49A92A1B6FBA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# msgbox.tcl --..#..#.Implements messageboxes for platforms that do not have native..#.messagebox support...#..# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# Ensure existence of ::tk::dialog namespace..#..namespace eval ::tk::dialog {}....image create bitmap ::tk::dialog::b1 -foreground black \..-data "#define b1_width 32\n#define b1_height 32..static unsigned char q1_bits[] = {.. 0x00, 0xf8, 0x1f, 0x00, 0x00, 0x07, 0xe0, 0x00, 0xc0, 0x00, 0x00, 0x03,.. 0x20, 0x00, 0x00, 0x04, 0x10, 0x00, 0x00, 0x08, 0x08, 0x00, 0x00, 0x10,.. 0x04, 0x00, 0x00, 0x20, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,.. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,.. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,.. 0x01, 0x00, 0x00, 0x80, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,.. 0x04, 0x00,

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\cs.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4235
                                                                                                                                                                                                                          Entropy (8bit):4.789130604359491
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:nlw9Twd+j3gLhokqwX+hTnJgNanPNcgRhgP+5QPwJJENL:nlw9TjjwI3hTnJgNaRhgP75L
                                                                                                                                                                                                                          MD5:5A8B46B85DCCBF74E2B5B820E1A7B9D1
                                                                                                                                                                                                                          SHA1:980F4FC5BABA82BA0FE02F9BD03A23DF6D565BB1
                                                                                                                                                                                                                          SHA-256:4DFFBEEDBF0D66D84B13088016D1A782CEAAD4DED27BE1E38842F8969C0E533F
                                                                                                                                                                                                                          SHA-512:2D81FC06CF3C20E4F6314BD13AF81FDE38A9B06510584C84C6A0C8C36314F980F77D02BD8056E7EE5DE599A0620E0C0349124147334B9C141145270046B19D90
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset cs "&Abort" "&P\u0159eru\u0161it".. ::msgcat::mcset cs "&About..." "&O programu...".. ::msgcat::mcset cs "All Files" "V\u0161echny soubory".. ::msgcat::mcset cs "Application Error" "Chyba programu".. ::msgcat::mcset cs "Bold Italic".. ::msgcat::mcset cs "&Blue" "&Modr\341".. ::msgcat::mcset cs "Cancel" "Zru\u0161it".. ::msgcat::mcset cs "&Cancel" "&Zru\u0161it".. ::msgcat::mcset cs "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nemohu zm\u011bnit atku\341ln\355 adres\341\u0159 na \"%1\$s\".\nP\u0159\355stup odm\355tnut.".. ::msgcat::mcset cs "Choose Directory" "V\375b\u011br adres\341\u0159e".. ::msgcat::mcset cs "Cl&ear" "Sma&zat".. ::msgcat::mcset cs "&Clear Console" "&Smazat konzolu".. ::msgcat::mcset cs "Color" "Barva".. ::msgcat::mcset cs "Console" "Konzole".. ::msgcat::mcset cs "&Copy" "&Kop\355rovat".. ::msgcat::mcset cs "Cu&t" "V&y\u0159\355znout".. ::msgcat::mcset cs "&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\da.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3987
                                                                                                                                                                                                                          Entropy (8bit):4.651948695787255
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:nRZ2uDMr05sIEzs2KkrT+XuTKN0FjDDP9:nRZzDy4kBKkrT+QpP9
                                                                                                                                                                                                                          MD5:227B0F255F854460E8E5146ED7A17B85
                                                                                                                                                                                                                          SHA1:99A080CAD631F21963C51A5B254BDAD3724DC866
                                                                                                                                                                                                                          SHA-256:FEEF8F8AD33BB3362C845A25D6ED273C398051047D899B31790474614C7AFD2D
                                                                                                                                                                                                                          SHA-512:36A4B48831316CC29686CC76DA00110EB078EC56F55A960D11AE427AA3D913C340C1E3805BF2AD40C1A8A92FC6587DA5D2C245E7501289FC3E228BE14FE49598
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset da "&Abort" "&Afbryd".. ::msgcat::mcset da "&About..." "&Om...".. ::msgcat::mcset da "All Files" "Alle filer".. ::msgcat::mcset da "Application Error" "Programfejl".. ::msgcat::mcset da "&Blue" "&Bl\u00E5".. ::msgcat::mcset da "Cancel" "Annuller".. ::msgcat::mcset da "&Cancel" "&Annuller".. ::msgcat::mcset da "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ikke skifte til katalog \"%1\$s\".\nIngen rettigheder.".. ::msgcat::mcset da "Choose Directory" "V\u00E6lg katalog".. ::msgcat::mcset da "Cl&ear" "&Ryd".. ::msgcat::mcset da "&Clear Console" "&Ryd konsolen".. ::msgcat::mcset da "Color" "Farve".. ::msgcat::mcset da "Console" "Konsol".. ::msgcat::mcset da "&Copy" "&Kopier".. ::msgcat::mcset da "Cu&t" "Kli&p".. ::msgcat::mcset da "&Delete" "&Slet".. ::msgcat::mcset da "Details >>" "Detailer".. ::msgcat::mcset da "Directory \"%1\$s\" does not exist." "Katalog \"%1\$s\" finde

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\de.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4914
                                                                                                                                                                                                                          Entropy (8bit):4.6221938909259475
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:nxLEpatioUqGBLbz4ME/XKKVN9R7S/0oYr9:epY3MkXKKxRu2r9
                                                                                                                                                                                                                          MD5:2203F65BCDA61BC15AEAC4F868C6D94A
                                                                                                                                                                                                                          SHA1:C4CC3975679D23892406E4E8971359A0775B1B86
                                                                                                                                                                                                                          SHA-256:C0F574B14068A049E93421C73873D750C98DE28B7B77AA42FE72CBE0270A4186
                                                                                                                                                                                                                          SHA-512:79F134FDAD3B12524D43BF9F59D3C04CAE30A95F591A51B82C8DF7CC8563BEA5D464AEECC457D9F60C04365E30459C447ED537AFC832BA25E1815DE06C2B81E5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset de "&Abort" "&Abbruch".. ::msgcat::mcset de "&About..." "&\u00dcber...".. ::msgcat::mcset de "All Files" "Alle Dateien".. ::msgcat::mcset de "Application Error" "Applikationsfehler".. ::msgcat::mcset de "&Apply" "&Anwenden".. ::msgcat::mcset de "Bold" "Fett".. ::msgcat::mcset de "Bold Italic" "Fett kursiv".. ::msgcat::mcset de "&Blue" "&Blau".. ::msgcat::mcset de "Cancel" "Abbruch".. ::msgcat::mcset de "&Cancel" "&Abbruch".. ::msgcat::mcset de "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kann nicht in das Verzeichnis \"%1\$s\" wechseln.\nKeine Rechte vorhanden.".. ::msgcat::mcset de "Choose Directory" "W\u00e4hle Verzeichnis".. ::msgcat::mcset de "Cl&ear" "&R\u00fccksetzen".. ::msgcat::mcset de "&Clear Console" "&Konsole l\u00f6schen".. ::msgcat::mcset de "Color" "Farbe".. ::msgcat::mcset de "Console" "Konsole".. ::msgcat::mcset de "&Copy" "&Kopieren".. ::msgcat::mcset de "

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\el.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (355), with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8784
                                                                                                                                                                                                                          Entropy (8bit):4.334043617395095
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:tVj/F+oxBHbkI8+xTqFt2zPJ0k63fRGIUvPXrfBNnzc+zIF7meUOT7GC8MO07S0g:fj9+AHlLoozHn7fBFrMVmehCAGb
                                                                                                                                                                                                                          MD5:780F863903BBDAA6C371EC0D3C7E6D59
                                                                                                                                                                                                                          SHA1:DF5D435E132BEE4C076A7FC577C8C275A8B68CD5
                                                                                                                                                                                                                          SHA-256:3F6F155864FE59A341BFD869735E54DD21CEE21BBD038433D9B271AD77BA3F7E
                                                                                                                                                                                                                          SHA-512:091965EE912513AE1943BE840A2E757188FBA6F760F7C47BE80D06313D59B051F183E3A29D4B1CEDE1F9E54CA3CA23D75FF2C3A3672A4E71FB56F0FA76F7FA0D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:## Messages for the Greek (Hellenic - "el") language...## Please report any changes/suggestions to:..## petasis@iit.demokritos.gr....namespace eval ::tk {.. ::msgcat::mcset el "&Abort" "\u03a4\u03b5\u03c1\u03bc\u03b1\u03c4\u03b9\u03c3\u03bc\u03cc\u03c2".. ::msgcat::mcset el "About..." "\u03a3\u03c7\u03b5\u03c4\u03b9\u03ba\u03ac...".. ::msgcat::mcset el "All Files" "\u038c\u03bb\u03b1 \u03c4\u03b1 \u0391\u03c1\u03c7\u03b5\u03af\u03b1".. ::msgcat::mcset el "Application Error" "\u039b\u03ac\u03b8\u03bf\u03c2 \u0395\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ae\u03c2".. ::msgcat::mcset el "&Blue" "\u039c\u03c0\u03bb\u03b5".. ::msgcat::mcset el "&Cancel" "\u0391\u03ba\u03cd\u03c1\u03c9\u03c3\u03b7".. ::msgcat::mcset el \.."Cannot change to the directory \"%1\$s\".\nPermission denied." \.."\u0394\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03c5\u03bd\u03b1\u03c4\u03ae \u03b7 \u03b1\u03bb\u03bb\u03b1\u03b3\u

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\en.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3377
                                                                                                                                                                                                                          Entropy (8bit):4.279601088621442
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:sQ7dw5bO0V3gqmCNyoKJ6iwp/uvENv4SKEcET2hsHFjr:n7dwNOc3RmOKJQcvEl4SK1ET2hYFjr
                                                                                                                                                                                                                          MD5:D48CFC9EC779085E8F6AAA7B1C40C89A
                                                                                                                                                                                                                          SHA1:0CF6253BFF39F40CA0991F9B06D3394BFEA21ED2
                                                                                                                                                                                                                          SHA-256:4A33B44B2E220E28EAAE7FAC407CAFE43D97C270DA58FA5F3B699A1760BFB2A4
                                                                                                                                                                                                                          SHA-512:C00EC0CFB48ABE621EF625C51952BCF177CE3BC7F0DEC5276EF84C9A97C7E014806B106EA8DEE202C43F8DD54ED7261A8D899E3EE12E3F37A90C387D864463AE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset en "&Abort".. ::msgcat::mcset en "&About...".. ::msgcat::mcset en "All Files".. ::msgcat::mcset en "Application Error".. ::msgcat::mcset en "&Apply".. ::msgcat::mcset en "Bold".. ::msgcat::mcset en "Bold Italic".. ::msgcat::mcset en "&Blue".. ::msgcat::mcset en "Cancel".. ::msgcat::mcset en "&Cancel".. ::msgcat::mcset en "Cannot change to the directory \"%1\$s\".\nPermission denied.".. ::msgcat::mcset en "Choose Directory".. ::msgcat::mcset en "Cl&ear".. ::msgcat::mcset en "&Clear Console".. ::msgcat::mcset en "Color".. ::msgcat::mcset en "Console".. ::msgcat::mcset en "&Copy".. ::msgcat::mcset en "Cu&t".. ::msgcat::mcset en "&Delete".. ::msgcat::mcset en "Details >>".. ::msgcat::mcset en "Directory \"%1\$s\" does not exist.".. ::msgcat::mcset en "&Directory:".. ::msgcat::mcset en "&Edit".. ::msgcat::mcset en "Effects".. ::msgcat::mcset en "Error: %1\$s".. ::msgcat::mcs

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\en_gb.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):66
                                                                                                                                                                                                                          Entropy (8bit):4.262228832346611
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:fEGp6fRyv//mGoW8vMKEQXyVn:sooyv//xoQOOn
                                                                                                                                                                                                                          MD5:3D41FC47CD9936F817EF9645D73A77ED
                                                                                                                                                                                                                          SHA1:E62BBE094B71CAF4A389DE3ECD84D2EEFBA33827
                                                                                                                                                                                                                          SHA-256:01238293356E82F1D298896491F8B299BB7DC9C34F299C9E756254C736DA612B
                                                                                                                                                                                                                          SHA-512:B92582C32C4D7CD9DE6571CBB6B93DD693A8B5A80645468E2D02B80C339BE2B95D5B4878A0DA9AFFE9E2F98A6C38AAE9CC1FF2440146D0ED128FE8C9A92EECDB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset en_gb Color Colour..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\eo.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4035
                                                                                                                                                                                                                          Entropy (8bit):4.614759526381991
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:n6oXunu4/LQmI+nl0WemQ+uISIKk/2nibN5My/uXcFSZHBohy:n6oXuu4jJtlPemVuISIKkuniJS1Gy
                                                                                                                                                                                                                          MD5:3704A08985B0AA3C521FDF9C2DA59D97
                                                                                                                                                                                                                          SHA1:3F1E42C5697504B4DEE1EE314CD361B4203BF686
                                                                                                                                                                                                                          SHA-256:84B117857674A2426290946053A61316C5C8C6808F2C6EDF0ECC5C4A9C5C72AC
                                                                                                                                                                                                                          SHA-512:99FE97B10B1CA59DDA0385161E7C05F7D22424B6B1FB844138921EF94B2E9809D73EBC0062897D0DDE040CF92C96A6E4916CC9F3F02442AE2C4162858434B6BA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset eo "&Abort" "&\u0108esigu".. ::msgcat::mcset eo "&About..." "Pri...".. ::msgcat::mcset eo "All Files" "\u0108iuj dosieroj".. ::msgcat::mcset eo "Application Error" "Aplikoeraro".. ::msgcat::mcset eo "&Blue" "&Blua".. ::msgcat::mcset eo "Cancel" "Rezignu".. ::msgcat::mcset eo "&Cancel" "&Rezignu".. ::msgcat::mcset eo "Cannot change to the directory \"%1\$s\".\nPermission denied." "Neeble \u015dan\u011di al dosierujo \"%1\$s\".\nVi ne rajtas tion.".. ::msgcat::mcset eo "Choose Directory" "Elektu Dosierujon".. ::msgcat::mcset eo "Cl&ear" "&Vakigu".. ::msgcat::mcset eo "&Clear Console" "&Vakigu konzolon".. ::msgcat::mcset eo "Color" "Koloro".. ::msgcat::mcset eo "Console" "Konzolo".. ::msgcat::mcset eo "&Copy" "&Kopiu".. ::msgcat::mcset eo "Cu&t" "&Eltondu".. ::msgcat::mcset eo "&Delete" "&Forigu".. ::msgcat::mcset eo "Details >>" "Detaloj >>".. ::msgcat::mcset eo "Directory \"%1\$s\" does not exi

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\es.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4024
                                                                                                                                                                                                                          Entropy (8bit):4.536517819515934
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:nN0T1Lt8ZYSih/aiik148aFscyTzoixccUTqjcg60Dx/H5:nN0BLSQUXy/o8re055
                                                                                                                                                                                                                          MD5:4765F3C055742530E4644771EBC6C69F
                                                                                                                                                                                                                          SHA1:8BEA722AC00522DEAA5B380AEEF4CA57D7A271BD
                                                                                                                                                                                                                          SHA-256:D2842B80F1B521EFF2D2656A69274B5F2A8F4F5831AF2E8EE73E3C37389F981F
                                                                                                                                                                                                                          SHA-512:9CA247F22797A1A1FCA42B5CDABF58262ED95EECDDD321CEB1440A60A4375923E0F511238F360D159EB5EED6F82CBBE0B8907A07CC77DB831BF97082932CD0FD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset es "&Abort" "&Abortar".. ::msgcat::mcset es "&About..." "&Acerca de ...".. ::msgcat::mcset es "All Files" "Todos los archivos".. ::msgcat::mcset es "Application Error" "Error de la aplicaci\u00f3n".. ::msgcat::mcset es "&Blue" "&Azul".. ::msgcat::mcset es "Cancel" "Cancelar".. ::msgcat::mcset es "&Cancel" "&Cancelar".. ::msgcat::mcset es "Cannot change to the directory \"%1\$s\".\nPermission denied." "No es posible acceder al directorio \"%1\$s\".\nPermiso denegado.".. ::msgcat::mcset es "Choose Directory" "Elegir directorio".. ::msgcat::mcset es "Cl&ear" "&Borrar".. ::msgcat::mcset es "&Clear Console" "&Borrar consola".. ::msgcat::mcset es "Color".. ::msgcat::mcset es "Console" "Consola".. ::msgcat::mcset es "&Copy" "&Copiar".. ::msgcat::mcset es "Cu&t" "Cor&tar".. ::msgcat::mcset es "&Delete" "&Borrar".. ::msgcat::mcset es "Details >>" "Detalles >>".. ::msgcat::mcset es "Directory \"%1\$s\"

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\fi.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4693
                                                                                                                                                                                                                          Entropy (8bit):4.640083757706223
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:najdLGoC0TXwqTwPRNQXfdHzAIX169ZZv6CpvgIPJupuupw6kWVVxn6/9Yv:nWdLGo2WiMn4t5pvbxuPtx6F6
                                                                                                                                                                                                                          MD5:BD795A1D95446BEE7AEB16FB6E346271
                                                                                                                                                                                                                          SHA1:38469DBD386C35B90EBE0A0FE2CE9F1AB5A5444A
                                                                                                                                                                                                                          SHA-256:893BEDCDAED4602898D988E6248B8BB0857DD66C06194B45F31340CA03D82369
                                                                                                                                                                                                                          SHA-512:B9BDDECB1DE2025C6C4027BF6228A14D5F573F5859ED3444298809266F06E6203F72004D589314C6529A2E198039355B4FD6160F87DA8F97B55E9F841B6C3F5A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset fi "&Abort" "&Keskeyt\u00e4".. ::msgcat::mcset fi "&About..." "&Tietoja...".. ::msgcat::mcset fi "All Files" "Kaikki tiedostot".. ::msgcat::mcset fi "Application Error" "Ohjelmavirhe".. ::msgcat::mcset fi "&Apply" "K\u00e4&yt\u00e4".. ::msgcat::mcset fi "Bold" "Lihavoitu".. ::msgcat::mcset fi "Bold Italic" "Lihavoitu, kursivoitu".. ::msgcat::mcset fi "&Blue" "&Sininen".. ::msgcat::mcset fi "Cancel" "Peruuta".. ::msgcat::mcset fi "&Cancel" "&Peruuta".. ::msgcat::mcset fi "Cannot change to the directory \"%1\$s\".\nPermission denied." "Ei voitu vaihtaa hakemistoon \"%1\$s\".\nLupa ev\u00e4tty.".. ::msgcat::mcset fi "Choose Directory" "Valitse hakemisto".. ::msgcat::mcset fi "Cl&ear" "&Tyhjenn\u00e4".. ::msgcat::mcset fi "&Clear Console" "&Tyhjenn\u00e4 konsoli".. ::msgcat::mcset fi "Color" "V\u00e4ri".. ::msgcat::mcset fi "Console" "Konsoli".. ::msgcat::mcset fi "&Copy" "K&opioi".. ::msgcat::mcs

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\fr.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3877
                                                                                                                                                                                                                          Entropy (8bit):4.630737553723335
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:nByEWs/3lHFB9FamsIfSAzZ2eaISAxh0BRc3jC:nByEWaRNzsSSWonMAv
                                                                                                                                                                                                                          MD5:E279E5FFF03E1B8E9063ABC8A499A6BD
                                                                                                                                                                                                                          SHA1:80910911F6B4830BA4DCBA9A9EAD12C9F802DDC9
                                                                                                                                                                                                                          SHA-256:3F2CEB4A33695AB6B56E27F61A4C60C029935BB026497D99CB2C246BCB4A63C4
                                                                                                                                                                                                                          SHA-512:8333388E421AC3F342317BEBE352809B0B190EF8B044A0BAE2FE4051974D86008BAFDCB7098E9DC39A8D9E1E08FB87F54B9D3388AF2D0185FF913DB6788C5AB5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset fr "&Abort" "&Annuler".. ::msgcat::mcset fr "About..." "\u00c0 propos...".. ::msgcat::mcset fr "All Files" "Tous les fichiers".. ::msgcat::mcset fr "Application Error" "Erreur d'application".. ::msgcat::mcset fr "&Blue" "&Bleu".. ::msgcat::mcset fr "Cancel" "Annuler".. ::msgcat::mcset fr "&Cancel" "&Annuler".. ::msgcat::mcset fr "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossible d'acc\u00e9der au r\u00e9pertoire \"%1\$s\".\nPermission refus\u00e9e.".. ::msgcat::mcset fr "Choose Directory" "Choisir r\u00e9pertoire".. ::msgcat::mcset fr "Cl&ear" "Effacer".. ::msgcat::mcset fr "Color" "Couleur".. ::msgcat::mcset fr "Console".. ::msgcat::mcset fr "Copy" "Copier".. ::msgcat::mcset fr "Cu&t" "Couper".. ::msgcat::mcset fr "Delete" "Effacer".. ::msgcat::mcset fr "Details >>" "D\u00e9tails >>".. ::msgcat::mcset fr "Directory \"%1\$s\" does not exist." "Le r\u00e9pertoire \"%1\$s\"

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\hu.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4678
                                                                                                                                                                                                                          Entropy (8bit):4.7955991577265245
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:nkCEz2TTrKmA17fzq/Hj+pUva+fQR/a5a/Thn5kU:kTqM17u/8NiMrhb
                                                                                                                                                                                                                          MD5:4F1610E0C73DAE668E3F9D9235631152
                                                                                                                                                                                                                          SHA1:63EE54A6C1A69B798C65C999D5F80A7AB252B6D8
                                                                                                                                                                                                                          SHA-256:E063AD7CA93F37728A65E4CD7C0433950F22607D307949F6CB056446AFEAA4FE
                                                                                                                                                                                                                          SHA-512:37F4B8A9CD020A77591C09AF40FBC2FA82107B2596D31B5F30CE6ECAA225417CF7A5C62FB7A93539B0D7E930D0A44F9BF2EE6BE113F831B0A72B229444672AFD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset hu "&Abort" "&Megszak\u00edt\u00e1s".. ::msgcat::mcset hu "&About..." "N\u00e9vjegy...".. ::msgcat::mcset hu "All Files" "Minden f\u00e1jl".. ::msgcat::mcset hu "Application Error" "Alkalmaz\u00e1s hiba".. ::msgcat::mcset hu "&Blue" "&K\u00e9k".. ::msgcat::mcset hu "Cancel" "M\u00e9gsem".. ::msgcat::mcset hu "&Cancel" "M\u00e9g&sem".. ::msgcat::mcset hu "Cannot change to the directory \"%1\$s\".\nPermission denied." "A k\u00f6nyvt\u00e1rv\u00e1lt\u00e1s nem siker\u00fclt: \"%1\$s\".\nHozz\u00e1f\u00e9r\u00e9s megtagadva.".. ::msgcat::mcset hu "Choose Directory" "K\u00f6nyvt\u00e1r kiv\u00e1laszt\u00e1sa".. ::msgcat::mcset hu "Cl&ear" "T\u00f6rl\u00e9s".. ::msgcat::mcset hu "&Clear Console" "&T\u00f6rl\u00e9s Konzol".. ::msgcat::mcset hu "Color" "Sz\u00edn".. ::msgcat::mcset hu "Console" "Konzol".. ::msgcat::mcset hu "&Copy" "&M\u00e1sol\u00e1s".. ::msgcat::mcset hu "Cu&t" "&Kiv\u00e1g\u00e1s".. ::ms

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\it.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3765
                                                                                                                                                                                                                          Entropy (8bit):4.49679862548805
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:nmU4xnonTjwUE5Xs6ZrT8BpXAg+Wr+u92C8t7mU9nUSs:nZ4FonFE58HBpXjr+fBJs
                                                                                                                                                                                                                          MD5:B74C54666A5A431A782DB691B4CA3315
                                                                                                                                                                                                                          SHA1:2BC63982C14BBA8A4C451CE31540181F40CE2216
                                                                                                                                                                                                                          SHA-256:806930F283FD097195C7850E3486B3815D1564529B4F8E5FA6D26F3175183BC1
                                                                                                                                                                                                                          SHA-512:8120E2FFD14E0A992E254796ADDC0DC995C921BE31688C0995D7A36FE82609D78791FEF73EAF5B14E2F0D40AD256AB8DAAA07C18E6950362B28E40B71E47C0B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset it "&Abort" "&Interrompi".. ::msgcat::mcset it "&About..." "Informazioni...".. ::msgcat::mcset it "All Files" "Tutti i file".. ::msgcat::mcset it "Application Error" "Errore dell' applicazione".. ::msgcat::mcset it "&Blue" "&Blu".. ::msgcat::mcset it "Cancel" "Annulla".. ::msgcat::mcset it "&Cancel" "&Annulla".. ::msgcat::mcset it "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossibile accedere alla directory \"%1\$s\".\nPermesso negato.".. ::msgcat::mcset it "Choose Directory" "Scegli una directory".. ::msgcat::mcset it "Cl&ear" "Azzera".. ::msgcat::mcset it "&Clear Console" "Azzera Console".. ::msgcat::mcset it "Color" "Colore".. ::msgcat::mcset it "Console".. ::msgcat::mcset it "&Copy" "Copia".. ::msgcat::mcset it "Cu&t" "Taglia".. ::msgcat::mcset it "Delete" "Cancella".. ::msgcat::mcset it "Details >>" "Dettagli >>".. ::msgcat::mcset it "Directory \"%1\$s\" does not ex

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\nl.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4557
                                                                                                                                                                                                                          Entropy (8bit):4.524344068436489
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:nucQswBju0x0M4U2z9KSSOzZL5KhWTqGGIrlxXvhYbL/ZO5NT+T4kiLzzdDf1SDM:nLGa0x0Mp2KSHKSv2bL/ZO5u6nRfAXU9
                                                                                                                                                                                                                          MD5:E56229BAC5A8ABB90C4DD8EE3F9FF9F8
                                                                                                                                                                                                                          SHA1:7527D6C3C6C84BFF0E683FFA86A21C58458EB55D
                                                                                                                                                                                                                          SHA-256:0914FBA42361227D14FA281E8A9CBF57C16200B4DA1E61CC3402EF0113A512C7
                                                                                                                                                                                                                          SHA-512:13649DDB06DB4BA9E39BEAF828211086A519444DA9AB5CBDD1B88B29208388189A5141F75AD94B56A348EDDE534FFADE8B19B557CB988EA4ECC9A84B135D36C1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset nl "&Abort" "&Afbreken".. ::msgcat::mcset nl "&About..." "Over...".. ::msgcat::mcset nl "All Files" "Alle Bestanden".. ::msgcat::mcset nl "Application Error" "Toepassingsfout".. ::msgcat::mcset nl "&Apply" "Toepassen".. ::msgcat::mcset nl "Bold" "Vet".. ::msgcat::mcset nl "Bold Italic" "Vet Cursief".. ::msgcat::mcset nl "&Blue" "&Blauw".. ::msgcat::mcset nl "Cancel" "Annuleren".. ::msgcat::mcset nl "&Cancel" "&Annuleren".. ::msgcat::mcset nl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan niet naar map \"%1\$s\" gaan.\nU heeft hiervoor geen toestemming.".. ::msgcat::mcset nl "Choose Directory" "Kies map".. ::msgcat::mcset nl "Cl&ear" "Wissen".. ::msgcat::mcset nl "&Clear Console" "&Wis Console".. ::msgcat::mcset nl "Color" "Kleur".. ::msgcat::mcset nl "Console".. ::msgcat::mcset nl "&Copy" "Kopi\u00ebren".. ::msgcat::mcset nl "Cu&t" "Knippen".. ::msgcat::mcset nl "&Dele

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\pl.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4932
                                                                                                                                                                                                                          Entropy (8bit):4.799369674927008
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:nXra9E310fwNCeVsvSmy6MZv8lWBTDGdZ3tojTyrEQmAUCIx4wBxZ:n7a9Q0fyw5MQWgP3uoZChB3
                                                                                                                                                                                                                          MD5:8CFA2E38822303FDCB55AE3277F0B81B
                                                                                                                                                                                                                          SHA1:447F28A5064FCEA019C60B3F9B6D50CD43C2D0E3
                                                                                                                                                                                                                          SHA-256:EACEB1F08DE0863CCF726881E07FE5B135EA09646C5253E0CBF7DDB987EB0D92
                                                                                                                                                                                                                          SHA-512:E38BA9059AFF55C2B22A4AE24D6A76149C76DBA8BF8646AE81D6E07D7ED490D0605034B29D9AC848E6685C8EC26A3DBE5B2EAF462B14D96376E80076FBE7082A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset pl "&Abort" "&Przerwij".. ::msgcat::mcset pl "&About..." "O programie...".. ::msgcat::mcset pl "All Files" "Wszystkie pliki".. ::msgcat::mcset pl "Application Error" "B\u0142\u0105d w programie".. ::msgcat::mcset pl "&Apply" "Zastosuj".. ::msgcat::mcset pl "Bold" "Pogrubienie".. ::msgcat::mcset pl "Bold Italic" "Pogrubiona kursywa".. ::msgcat::mcset pl "&Blue" "&Niebieski".. ::msgcat::mcset pl "Cancel" "Anuluj".. ::msgcat::mcset pl "&Cancel" "&Anuluj".. ::msgcat::mcset pl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nie mo\u017cna otworzy\u0107 katalogu \"%1\$s\".\nOdmowa dost\u0119pu.".. ::msgcat::mcset pl "Choose Directory" "Wybierz katalog".. ::msgcat::mcset pl "Cl&ear" "&Wyczy\u015b\u0107".. ::msgcat::mcset pl "&Clear Console" "&Wyczy\u015b\u0107 konsol\u0119".. ::msgcat::mcset pl "Color" "Kolor".. ::msgcat::mcset pl "Console" "Konsola".. ::msgcat::mcset pl "&Copy" "&Kopiu

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\pt.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3987
                                                                                                                                                                                                                          Entropy (8bit):4.63232183429232
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:nHOT1mM5qHHxiBHb3joTjtcp2UqMxweo6VvilCMKKXx9vjM:nHOT1mMQnwB/otcUUpGX6VPVoLjM
                                                                                                                                                                                                                          MD5:4018686F2A8E299D86BDB1478BC97896
                                                                                                                                                                                                                          SHA1:0EECE3D57F2EA5EECE8157B06F3AFB97E1F2551A
                                                                                                                                                                                                                          SHA-256:D687F71F0432BB0D02EFDF576E526D2C19D4136F76C41A3224A2F034168F3F34
                                                                                                                                                                                                                          SHA-512:4D730068B2A21E1D6004205B10A9D0D5EE9683FEB03B6FB673E8B9B94ED6BE468086A52DFE97C4DBF35A07CBB2C5E276DF0952A06C78E029D53D796CB6FCC8DF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset pt "&Abort" "&Abortar".. ::msgcat::mcset pt "About..." "Sobre ...".. ::msgcat::mcset pt "All Files" "Todos os arquivos".. ::msgcat::mcset pt "Application Error" "Erro de aplica\u00e7\u00e3o".. ::msgcat::mcset pt "&Blue" "&Azul".. ::msgcat::mcset pt "Cancel" "Cancelar".. ::msgcat::mcset pt "&Cancel" "&Cancelar".. ::msgcat::mcset pt "Cannot change to the directory \"%1\$s\".\nPermission denied." "N\u00e3o foi poss\u00edvel mudar para o diret\u00f3rio \"%1\$s\".\nPermiss\u00e3o negada.".. ::msgcat::mcset pt "Choose Directory" "Escolha um diret\u00f3rio".. ::msgcat::mcset pt "Cl&ear" "Apagar".. ::msgcat::mcset pt "&Clear Console" "Apagar Console".. ::msgcat::mcset pt "Color" "Cor".. ::msgcat::mcset pt "Console".. ::msgcat::mcset pt "&Copy" "Copiar".. ::msgcat::mcset pt "Cu&t" "Recortar".. ::msgcat::mcset pt "&Delete" "Excluir".. ::msgcat::mcset pt "Details >>" "Detalhes >>".. ::msgcat::mcset pt "D

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\ru.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8620
                                                                                                                                                                                                                          Entropy (8bit):4.477728981060218
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:n9MEBGkFKT4YHCDhxqEMk0yOC2xXLtSRoxwKl9zFAWx2yuV9cDcwRjnWNQuNFNfO:T0rm8IONoRkN1w+jRQ/FoxrRHRJP
                                                                                                                                                                                                                          MD5:C69A904A57FDC95520086E9DDFED362C
                                                                                                                                                                                                                          SHA1:F0220602ABE91FE563E5AA6A4EA4AB43818C0CFC
                                                                                                                                                                                                                          SHA-256:F0D310A2EE9C0AF928D822CBB39BCBE54FB2C1C95EE8167DFFD55EDC1B2FE040
                                                                                                                                                                                                                          SHA-512:808B82F29B7BA06AF5AE44C6C23EC8DD743E93B391F060C7586D6D3FF26C97294BD11AD215848EBA422491BD50C4509330DD24C83134C7A384E81304133CAADB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset ru "&Abort" "&\u041e\u0442\u043c\u0435\u043d\u0438\u0442\u044c".. ::msgcat::mcset ru "&About..." "\u041f\u0440\u043e...".. ::msgcat::mcset ru "All Files" "\u0412\u0441\u0435 \u0444\u0430\u0439\u043b\u044b".. ::msgcat::mcset ru "Application Error" "\u041e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435".. ::msgcat::mcset ru "&Apply" "&\u041f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c".. ::msgcat::mcset ru "Bold" "Bold".. ::msgcat::mcset ru "Bold Italic" "Bold Italic".. ::msgcat::mcset ru "&Blue" " &\u0413\u043e\u043b\u0443\u0431\u043e\u0439".. ::msgcat::mcset ru "Cancel" "\u041e\u0442\u043c\u0435\u043d\u0430".. ::msgcat::mcset ru "&Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430".. ::msgcat::mcset ru "Cannot change to the directory \"%1\$s\".\nPermission denied." \....."\u041d\u0435 \u043c\u043e\u0433\u0443 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u0432 \u043a\u043

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\sv.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3908
                                                                                                                                                                                                                          Entropy (8bit):4.658068191079967
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:nT8A5cbwKmtI1sE9xt6BDyepTr2iiK/yGqXZlBp9:nD5cb2extDepTCnVpJ9
                                                                                                                                                                                                                          MD5:1D085A672A6FCDECEF5D7D876E4C74A3
                                                                                                                                                                                                                          SHA1:1A40C03F15A6926359CA3E5C0A809485CAD28AEE
                                                                                                                                                                                                                          SHA-256:A6821A13D34FB31F1827294B82C4BF9586BB255CA14F78C3ACE11181F42EF211
                                                                                                                                                                                                                          SHA-512:981EDEEF5E4C915BB8F10044096B412D1855CAD08F98A448C6C0A49A54222945EBD102DDCB9525535E0FB19313C319155FA59384605B2C36CC8B4A58693D57E7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset sv "&Abort" "&Avsluta".. ::msgcat::mcset sv "&About..." "&Om...".. ::msgcat::mcset sv "All Files" "Samtliga filer".. ::msgcat::mcset sv "Application Error" "Programfel".. ::msgcat::mcset sv "&Blue" "&Bl\u00e5".. ::msgcat::mcset sv "Cancel" "Avbryt".. ::msgcat::mcset sv "&Cancel" "&Avbryt".. ::msgcat::mcset sv "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ej n\u00e5 mappen \"%1\$s\".\nSaknar r\u00e4ttigheter.".. ::msgcat::mcset sv "Choose Directory" "V\u00e4lj mapp".. ::msgcat::mcset sv "Cl&ear" "&Radera".. ::msgcat::mcset sv "&Clear Console" "&Radera konsollen".. ::msgcat::mcset sv "Color" "F\u00e4rg".. ::msgcat::mcset sv "Console" "Konsoll".. ::msgcat::mcset sv "&Copy" "&Kopiera".. ::msgcat::mcset sv "Cu&t" "Klipp u&t".. ::msgcat::mcset sv "&Delete" "&Radera".. ::msgcat::mcset sv "Details >>" "Detaljer >>".. ::msgcat::mcset sv "Directory \"%1\$s\" does not exist." "Mapp

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\msgs\zh_cn.msg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4951
                                                                                                                                                                                                                          Entropy (8bit):5.319678095131993
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:nnIoT3wHqLHQslojYhOvZSVGNUpi6Zz0qBAE9A+uiTrBsyqCgnPLz:nnIoT3wHU/osIAwNILt0HE2oV6CgPLz
                                                                                                                                                                                                                          MD5:1435107EB17A09E4AD7277FFA1C76913
                                                                                                                                                                                                                          SHA1:9990C26829275F16C6FC494D32C4298EC541E7D3
                                                                                                                                                                                                                          SHA-256:B6802B7B080A2D8BC3D81614EC55A609CB5EF673C7A81E93E07925D6710F90DD
                                                                                                                                                                                                                          SHA-512:4B2CAE4FA135411761D5B7CBFFABCE87D745A9B6496C7FD7C4AF10E76EE36E51CA62A1417CF6C27070EFF9539A305BE45C010AE4F8532C8C2D915FA101F5157E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset zh_cn "&Abort" "&..".. ::msgcat::mcset zh_cn "&About..." "&....".. ::msgcat::mcset zh_cn "All Files" "....".. ::msgcat::mcset zh_cn "Application Error" "......".. ::msgcat::mcset zh_cn "&Apply" "&..".. ::msgcat::mcset zh_cn "Bold" "..".. ::msgcat::mcset zh_cn "Bold Italic" "....".. ::msgcat::mcset zh_cn "&Blue" "&..".. ::msgcat::mcset zh_cn "Cancel" "..".. ::msgcat::mcset zh_cn "&Cancel" "&..".. ::msgcat::mcset zh_cn "Cannot change to the directory \"%1\$s\".\nPermission denied." "...... \"%1\$s\".\n......".. ::msgcat::mcset zh_cn "Choose Directory" ".....".. ::msgcat::mcset zh_cn "Cl&ear" ".&.".. ::msgcat::mcset zh_cn "&Clear Console" "&....".. ::msgcat::mcset zh_cn "Color" "..".. ::msgcat::mcset zh_cn "Console" "..".. ::msgcat::mcset zh_cn "&Copy" "&..".. ::msgcat::mcset zh

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\obsolete.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5772
                                                                                                                                                                                                                          Entropy (8bit):5.038729016734604
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:onzxtm7EMgdMjwPqeuAmz9LD1kFIQETZqoIK/RLf7w:ozxtm7qUwi79l0sZqoBJLDw
                                                                                                                                                                                                                          MD5:FC9E03823BEB08DAF7681C09D106DF7D
                                                                                                                                                                                                                          SHA1:7D06FC8F98140E0FFAA2571BD522FC772E58DE54
                                                                                                                                                                                                                          SHA-256:540EEECBA17207A56290BAFFDAE882BBD4F88364791204AD5D14C7BEDD022CCC
                                                                                                                                                                                                                          SHA-512:2B5BAD311A703A0FE2ED67ACE311BAD4C767BCD23DFC3D9ABDF5C3604146A6A15D6BD13A14BDEFCDB2B602C708AACFAB404E96FCBA7C546AD0DAECD4BE2EB34A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# obsolete.tcl --..#..# This file contains obsolete procedures that people really shouldn't..# be using anymore, but which are kept around for backward compatibility...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# The procedures below are here strictly for backward compatibility with..# Tk version 3.6 and earlier. The procedures are no longer needed, so..# they are no-ops. You should not use these procedures anymore, since..# they may be removed in some future release.....proc tk_menuBar args {}..proc tk_bindForTraversal args {}....# ::tk::classic::restore --..#..# Restore the pre-8.5 (Tk classic) look as the widget defaults for classic..# Tk widgets...#..# The value following an 'option add' call is the new 8.5 value...#..namespace eval ::tk::classic {.. # This may need t

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\optMenu.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1629
                                                                                                                                                                                                                          Entropy (8bit):4.784780799273752
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:g2hBuOrlkBytcqYXRE5fvvXq1EhJPqOj6Wf0cVlN:gQ6q4E5HCqhBqOhcaD
                                                                                                                                                                                                                          MD5:9B7A8FD2C6B538FF31BDC380452C6DE3
                                                                                                                                                                                                                          SHA1:3F915BFE85CED9F6C7E9A352718770E9F14F098E
                                                                                                                                                                                                                          SHA-256:40CA505C9784B0767D4854485C5C311829594A4FCBDFD7251E60E6BB7EA74FD1
                                                                                                                                                                                                                          SHA-512:43937152B844BE1E597E99DA1270E54AB1D572AE89CB759E6D41C18C9C8044CCC15A6925F9C5AF617AE9EC1404E78C2733231F4D5C6CFE4D23C546387B1FC328
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# optMenu.tcl --..#..# This file defines the procedure tk_optionMenu, which creates..# an option button and its associated menu...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_optionMenu --..# This procedure creates an option button named $w and an associated..# menu. Together they provide the functionality of Motif option menus:..# they can be used to select one of many values, and the current value..# appears in the global variable varName, as well as in the text of..# the option menubutton. The name of the menu is returned as the..# procedure's result, so that the caller can use it to change configuration..# options on the menu or otherwise manipulate it...#..# Arguments:..# w -...The name to use for the menubutton...# varName -..Global variable to hold the currently

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\palette.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8418
                                                                                                                                                                                                                          Entropy (8bit):4.964814946573677
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:HWh/x+hFMyTA/CTzxFoUuliRLDm8pQrQlENPyF3o48M6C:HWL+MyTA/CTzvAiRqyEw3ok
                                                                                                                                                                                                                          MD5:4CE08A10CD9AE941654B8C679DF669F3
                                                                                                                                                                                                                          SHA1:F1288BABCA698FD18C3BD221E6AE6C02F2975AAE
                                                                                                                                                                                                                          SHA-256:849B4C57E4644E51BEAEAEB3AE59B7FF067E582ECD10F1B2CAF6B6E72F11F506
                                                                                                                                                                                                                          SHA-512:0F37539DA3540E9B1DA7B0377E3BBB359B71DB4271D63BC9501E95931B4E609E8CB91DC2F7B08A6452598D4A0D58C6A2034049A215000EEF0F93A9963D003632
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# palette.tcl --..#..# This file contains procedures that change the color palette used..# by Tk...#..# Copyright (c) 1995-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_setPalette --..# Changes the default color scheme for a Tk application by setting..# default colors in the option database and by modifying all of the..# color options for existing widgets that have the default value...#..# Arguments:..# The arguments consist of either a single color name, which..# will be used as the new background color (all other colors will..# be computed from this) or an even number of values consisting of..# option names and values. The name for an option is the one used..# for the option database, such as activeForeground, not -activeforeground.....proc ::tk_setPalette {args} {.. if {[winfo depth .] == 1} {...# Just return on monochrome displays, otherwise errors

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\panedwindow.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5370
                                                                                                                                                                                                                          Entropy (8bit):4.979530133775421
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ssAXzkTQ9w5fLQYkJLZkRXKUXfwyZTq2sz8j2Em3YKhrYK:jAXgE0DQpJLGR6UXfpqnzG3m3YKhrYK
                                                                                                                                                                                                                          MD5:286C01A1B12261BC47F5659FD1627ABD
                                                                                                                                                                                                                          SHA1:4CA36795CAB6DFE0BBBA30BB88A2AB71A0896642
                                                                                                                                                                                                                          SHA-256:AA4F87E41AC8297F51150F2A9F787607690D01793456B93F0939C54D394731F9
                                                                                                                                                                                                                          SHA-512:D54D5A89B7408A9724A1CA1387F6473BDAD33885194B2EC5A524C7853A297FD65CE2A57F571C51DB718F6A00DCE845DE8CF5F51698F926E54ED72CDC81BCFE54
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# panedwindow.tcl --..#..# This file defines the default bindings for Tk panedwindow widgets and..# provides procedures that help in implementing those bindings.....bind Panedwindow <Button-1> { ::tk::panedwindow::MarkSash %W %x %y 1 }..bind Panedwindow <Button-2> { ::tk::panedwindow::MarkSash %W %x %y 0 }....bind Panedwindow <B1-Motion> { ::tk::panedwindow::DragSash %W %x %y 1 }..bind Panedwindow <B2-Motion> { ::tk::panedwindow::DragSash %W %x %y 0 }....bind Panedwindow <ButtonRelease-1> {::tk::panedwindow::ReleaseSash %W 1}..bind Panedwindow <ButtonRelease-2> {::tk::panedwindow::ReleaseSash %W 0}....bind Panedwindow <Motion> { ::tk::panedwindow::Motion %W %x %y }....bind Panedwindow <Leave> { ::tk::panedwindow::Leave %W }....# Initialize namespace..namespace eval ::tk::panedwindow {}....# ::tk::panedwindow::MarkSash --..#..# Handle marking the correct sash for possible dragging..#..# Arguments:..# w..the widget..# x..widget local x coord..# y..widget local y coord..# proxy.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\pkgIndex.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):376
                                                                                                                                                                                                                          Entropy (8bit):5.040809246948068
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:CsUgabAOgjDnzJNBc6ynID/cL4RpncleXN17MQ9PCSIBIQ08hof7MQ9PCSIBIQei:lGbyntNO6LYZliCNBIUhkCNBIFi
                                                                                                                                                                                                                          MD5:8A0517A7A4C70111080ED934329E2BC5
                                                                                                                                                                                                                          SHA1:5B465E0D3500A8F04EE1C705662032F44E2ED0D2
                                                                                                                                                                                                                          SHA-256:A5D208887A94832328C3A33928A80F3B46AA205C20DB4F050A47D940E94071B4
                                                                                                                                                                                                                          SHA-512:D9F502A006A5E0514FD61426818AD1F4168E449588F9D383D6B0BF87A18BE82C420863A9A28E1BEB441284A0B1BC2A0B3D3276A0FE3196341AEC15A27920DE5D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:if {![package vsatisfies [package provide Tcl] 8.6.0]} return..if {($::tcl_platform(platform) eq "unix") && ([info exists ::env(DISPLAY)]...|| ([info exists ::argv] && ("-display" in $::argv)))} {.. package ifneeded Tk 8.6.13 [list load [file join $dir .. .. bin libtk8.6.dll]]..} else {.. package ifneeded Tk 8.6.13 [list load [file join $dir .. .. bin tk86t.dll]]..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\safetk.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7632
                                                                                                                                                                                                                          Entropy (8bit):4.891666209090638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Eet0t8bm9Z+Yjo+j/YKOtOUOtk8XKUal320:EetG8biZZs+bIAUoxX0d
                                                                                                                                                                                                                          MD5:21A3AC11146EC26784C0E729D8D644D0
                                                                                                                                                                                                                          SHA1:C7E0918E8692C42C1D1DD1BBCBFFF22A85979B69
                                                                                                                                                                                                                          SHA-256:579701605669AADFFBCDB7E3545C68442495428EE6E93C2D3A3133583BCD3D33
                                                                                                                                                                                                                          SHA-512:724ED83B989AD9033BEC4211EE50E4C9E85B51054C518CDF7E02D0ED0416F636B9F38C0B0D29F8F4F7F465B77C7D2E01D0918D2C2C3FEC4C7739EA982302FA2E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# safetk.tcl --..#..# Support procs to use Tk in safe interpreters...#..# Copyright (c) 1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# see safetk.n for documentation....#..#..# Note: It is now ok to let untrusted code being executed..# between the creation of the interp and the actual loading..# of Tk in that interp because the C side Tk_Init will..# now look up the parent interp and ask its safe::TkInit..# for the actual parameters to use for it's initialization (if allowed),..# not relying on the child state...#....# We use opt (optional arguments parsing)..package require opt 0.4.1;....namespace eval ::safe {.... # counter for safe toplevels.. variable tkSafeId 0..}....#..# tkInterpInit : prepare the child interpreter for tk loading..# most of the real job is done by loadTk..# returns the child name (tkInterpInit

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\scale.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8693
                                                                                                                                                                                                                          Entropy (8bit):4.968450834020619
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:GSusE8YOdpO4aDtao+QYa6t2jooB6ajpaqa5xQGmLGKOC9dLrVx:KsbYQO48t+QYa+NkFjpagGmKKX9dLrVx
                                                                                                                                                                                                                          MD5:D45202D3D2D052D4C6BFE8D1322AAB39
                                                                                                                                                                                                                          SHA1:8CDF184AC2E9299B2B2A107A64E9D1803AA298DE
                                                                                                                                                                                                                          SHA-256:0747A387FDD1B2C7135ECEAE7B392ED52E1D1EBF3FFA90FEBE886DBC0981EB74
                                                                                                                                                                                                                          SHA-512:27B005F955BAE00D15C4492E7BD3EBDC5EE3BF9C164C418198B4BD185709C8810AA6CF76CBCC07EEB4C1D20F8C76EF8DF8B219563C18B88C94954C910BFF575D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# scale.tcl --..#..# This file defines the default bindings for Tk scale widgets and provides..# procedures that help in implementing the bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1995 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for entries...#-------------------------------------------------------------------------....# Standard Motif bindings:....bind Scale <Enter> {.. if {$tk_strictMotif} {...set tk::Priv(activeBg) [%W cget -activebackground]...%W configure -activebackground [%W cget -background].. }.. tk::ScaleActivate %W %x %y..}..bind Scale <Motion> {.. tk::ScaleActivate %W %x %y..}..bind Scale <Leave> {.. if {$tk_strictMotif} {...%W configure -activebackground

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\scrlbar.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13188
                                                                                                                                                                                                                          Entropy (8bit):5.063842571848725
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Gf7RV8ei32PHKT8H2wwucyRlXn+kl1nBKp4nu5FCyK:2mei3qHKT8WPurnXn+I1nBg4nu5MyK
                                                                                                                                                                                                                          MD5:5249CD1E97E48E3D6DEC15E70B9D7792
                                                                                                                                                                                                                          SHA1:612E021BA25B5E512A0DFD48B6E77FC72894A6B9
                                                                                                                                                                                                                          SHA-256:EEC90404F702D3CFBFAEC0F13BF5ED1EBEB736BEE12D7E69770181A25401C61F
                                                                                                                                                                                                                          SHA-512:E4E0AB15EB9B3118C30CD2FF8E5AF87C549EAA9B640FFD809A928D96B4ADDEFB9D25EFDD1090FBD0019129CDF355BB2F277BC7194001BA1D2ED4A581110CEAFC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# scrlbar.tcl --..#..# This file defines the default bindings for Tk scrollbar widgets...# It also provides procedures that help in implementing the bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for scrollbars...#-------------------------------------------------------------------------....# Standard Motif bindings:..if {[tk windowingsystem] eq "x11" || [tk windowingsystem] eq "aqua"} {....bind Scrollbar <Enter> {.. if {$tk_strictMotif} {...set tk::Priv(activeBg) [%W cget -activebackground]...%W configure -activebackground [%W cget -background].. }.. %W activate [%W identify %x %y]..}..bind Scrollbar <Motion> {.. %W activate [%

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\spinbox.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16543
                                                                                                                                                                                                                          Entropy (8bit):5.034958189335699
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:IMpfyeKu9TzD0E8+9T1wqBaQKpiqQr7E32fnzXfWJU:IMpfyeKu9Tx8WODTp2zPP
                                                                                                                                                                                                                          MD5:EAA36F0AA69AE19DDBDD0448FBAD9D4D
                                                                                                                                                                                                                          SHA1:EB0ADB4F4D937BAC2F17480ADAF6F948262E754D
                                                                                                                                                                                                                          SHA-256:747889C3086C917A34554A9DC495BC0C08A03FD3A5828353ED2A64B97F376835
                                                                                                                                                                                                                          SHA-512:C8368F19EC6842ED67073B9FC9C9274107E643324CB23B28C54DF63FB720F63B043281B30DBEA053D08481B0442A87465F715A8AA0711B01CE83FF7B9F8A4F4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# spinbox.tcl --..#..# This file defines the default bindings for Tk spinbox widgets and provides..# procedures that help in implementing those bindings. The spinbox builds..# off the entry widget, so it can reuse Entry bindings and procedures...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1999-2000 Jeffrey Hobbs..# Copyright (c) 2000 Ajuba Solutions..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button went down (so, for example,..#.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\tclIndex

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20523
                                                                                                                                                                                                                          Entropy (8bit):4.786929402401609
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:eeVL0UI9Ms++J7VT/hc+ISyNsATbOan/uW/UFQ1gs1gxtKZufe2SvdJcmq/YbhEB:eeF0UI9Ms++J7VT/hc+ISyCATbOan2W+
                                                                                                                                                                                                                          MD5:9378397DD3DCA9DFB181F6F512B15631
                                                                                                                                                                                                                          SHA1:4F95DD6B658B6A912725DC7D6226F8414020D6C7
                                                                                                                                                                                                                          SHA-256:B04B1A675572E6FCD12C5FE82C4FD0930395548436FF93D848BF340AE202E7E3
                                                                                                                                                                                                                          SHA-512:D28CC3C8F3D0B1B2371CBD9EE29AC6881BABD8A07C762FF8F3284449998EE44FA44752CC8AB0DE47A3492776CE1D13BC8EA18CFDBDF710639D2D62D02CB917A9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Tcl autoload index file, version 2.0..# This file is generated by the "auto_mkindex" command..# and sourced to set up indexing information for one or..# more commands. Typically each line is a command that..# sets an element in the auto_index array, where the..# element name is the name of a command and the value is..# a script that loads the command.....set auto_index(::tk::dialog::error::Return) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::Details) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::SaveToLog) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::Destroy) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::bgerror) [list source [file join $dir bgerror.tcl]]..set auto_index(bgerror) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::ButtonInvoke) [list source [file join $dir button.tcl]]..set auto_index(::tk::ButtonAutoInvoke) [list sou

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\tearoff.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5309
                                                                                                                                                                                                                          Entropy (8bit):4.74935501162253
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:wfQXIqAv6iEwYtKVlPBnXWASbvMsDjXKpQQkK2tTsSZQ7Fowqm2K5r:wf+IqI6iU43PJYbvMsDjXKpsK2tISyZV
                                                                                                                                                                                                                          MD5:5F042DE8AD8941C7B9EF6D7BE06C86E4
                                                                                                                                                                                                                          SHA1:A4DFCEA2ACCAC2E85EAAA186DC765086D1E3AA3C
                                                                                                                                                                                                                          SHA-256:A4A8568633F827B54326640E6D1C3FDE4978EDC9E9FA1FB1D7B58F189DF1B1DC
                                                                                                                                                                                                                          SHA-512:E92A00028696A1557666CAB1C25AE6B63F25D75A9811BFAC56DFC069ECC769CC751B71CC81FA85C9CDE8F7FB6D7121EB64B58548CEE8AFE3F6C4A5C243507216
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# tearoff.tcl --..#..# This file contains procedures that implement tear-off menus...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk::TearoffMenu --..# Given the name of a menu, this procedure creates a torn-off menu..# that is identical to the given menu (including nested submenus)...# The new torn-off menu exists as a toplevel window managed by the..# window manager. The return value is the name of the new menu...# The window is created at the point specified by x and y..#..# Arguments:..# w -...The menu to be torn-off (duplicated)...# x -...x coordinate where window is created..# y -...y coordinate where window is created....proc ::tk::TearOffMenu {w {x 0} {y 0}} {.. # Find a unique name to use for the torn-off menu. Find the first.. # ancestor of w that is a

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\text.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):34969
                                                                                                                                                                                                                          Entropy (8bit):4.95825801435303
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:Rp4LaQDlOrqquMwIMyv4Et8avJLgmTGXs1bYMeNnnZl8n6KRD:RYK8aymTGs1b0xncn6KR
                                                                                                                                                                                                                          MD5:9CA5094ED6FE46620ABF090BF8E2AE63
                                                                                                                                                                                                                          SHA1:60DC3C2E3F69CE5B6DB4F2B3A1F3C109D766BC63
                                                                                                                                                                                                                          SHA-256:AB88556E349F03BACA2D8DC2121071A4F299DB86F484CAB2D9249FF4C7007564
                                                                                                                                                                                                                          SHA-512:0B0C20A754BE744A7FA214BA06AB0744A9BC466D51F96310D97EA1E61119A8ACFEF24E6DC5C4EBDD2C126BF84ACE74FFE622E9641C87E5A240DD13D1F7B5E6AF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# text.tcl --..#..# This file defines the default bindings for Tk text widgets and provides..# procedures that help in implementing the bindings...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1998 by Scriptics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of ::tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# char -..Character position on the line; kept in order..#...to allow moving up or down past short lines while..#...still remembering the desired position...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button we

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\tk.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24102
                                                                                                                                                                                                                          Entropy (8bit):5.137459715823081
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:NJyxt+WaB9USY15gSgC3DbTbXLXKr3cIXyDAbK2LMGgtewT+3oFQRyH5bAy59HmD:NJItNe9USZblXysm7GgteoFQRYMESL
                                                                                                                                                                                                                          MD5:184D05201893B2042D3FA6140FCF277C
                                                                                                                                                                                                                          SHA1:AAD67797864456749ADF0C4A1C0BE52F563C8FB8
                                                                                                                                                                                                                          SHA-256:1D5E7518AFC1382E36BF13FC5196C8A7CD93A4E9D24ACF445522564245A489B0
                                                                                                                                                                                                                          SHA-512:291BDF793CABC5EC27E8265A8A313FE0F4ACAB4DB6CE507A46488A83EEF72CD43CF5815762B22D1C8D64A9EEDEA927E109F937E6573058E5493B1354DD449CB3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# tk.tcl --..#..# Initialization script normally executed in the interpreter for each Tk-based..# application. Arranges class bindings for widgets...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Ajuba Solutions...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....# Verify that we have Tk binary and script components from the same release..package require -exact Tk 8.6.13.....# Create a ::tk namespace..namespace eval ::tk {.. # Set up the msgcat commands.. namespace eval msgcat {...namespace export mc mcmax.. if {[interp issafe] || [catch {package require msgcat}]} {.. # The msgcat package is not available. Supply our own.. # minimal replacement... proc mc {src args} {.. return [format $src {*}$args].. }.. proc mc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\tkfbox.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):39557
                                                                                                                                                                                                                          Entropy (8bit):5.186073482848965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:+oj+AqE9cn9tJNgDt0/vsKulXgo65Eh6pQb:+6+Zv/ggEdio65Ehdb
                                                                                                                                                                                                                          MD5:670837EBC804E7B6E2F65F840BC508D6
                                                                                                                                                                                                                          SHA1:2DD316487F87DDE5D05F65F564CAE4E1306CE662
                                                                                                                                                                                                                          SHA-256:3AAA66AE8E74B94481C3F6642634E78BB5D7892771E7C27B54DFA56DED0B2F3C
                                                                                                                                                                                                                          SHA-512:BB8350ADDF1A25C037DFD60A4AFCBF401CACAD2A370B60BD0BA0981D938C46394BD8D40D1E9A66F4E3C46FCC2A41CF688E78C4F1FE918B45E70D3E92D8B3D116
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# tkfbox.tcl --..#..#.Implements the "TK" standard file selection dialog box. This dialog..#.box is used on the Unix platforms whenever the tk_strictMotif flag is..#.not set...#..#.The "TK" standard file selection dialog box is similar to the file..#.selection dialog box on Win95(TM). The user can navigate the..#.directories by clicking on the folder icons or by selecting the..#."Directory" option menu. The user can select files by clicking on the..#.file icons or by entering a filename in the "Filename:" entry...#..# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {.. namespace import -force ::tk::msgcat::*.. variable showHiddenBtn 0.. variable showHiddenVar 1.... # Create the images if they did not already exist... if {![info exists ::tk::Priv(updirImage)]} {...s

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\altTheme.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3713
                                                                                                                                                                                                                          Entropy (8bit):4.915055696129498
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:InrWdo3L7Fe5qusQGdrMNnQbfIxEOxE0kFgG0FgGouox9FrGVuwg3kNcT+z5UlEr:UWdsOBn/1i+pqxwNjKs
                                                                                                                                                                                                                          MD5:01F28512E10ACBDDF93AE2BB29E343BC
                                                                                                                                                                                                                          SHA1:C9CF23D6315218B464061F011E4A9DC8516C8F1F
                                                                                                                                                                                                                          SHA-256:AE0437FB4E0EBD31322E4EACA626C12ABDE602DA483BB39D0C5EE1BC00AB0AF4
                                                                                                                                                                                                                          SHA-512:FE3BAE36DDB67F6D7A90B7A91B6EC1A009CF26C0167C46635E5A9CEAEC9083E59DDF74447BF6F60399657EE9604A2314B170F78A921CF948B2985DDF02A89DA6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Ttk widget set: Alternate theme..#....namespace eval ttk::theme::alt {.... variable colors.. array set colors {...-frame .."#d9d9d9"...-window.."#ffffff"...-darker ."#c3c3c3"...-border.."#414141"...-activebg ."#ececec"...-disabledfg."#a3a3a3"...-selectbg."#4a6984"...-selectfg."#ffffff"...-altindicator."#aaaaaa".. }.... ttk::style theme settings alt {.....ttk::style configure "." \... -background .$colors(-frame) \... -foreground .black \... -troughcolor.$colors(-darker) \... -bordercolor.$colors(-border) \... -selectbackground .$colors(-selectbg) \... -selectforeground .$colors(-selectfg) \... -font ..TkDefaultFont \... ;.....ttk::style map "." -background \... [list disabled $colors(-frame) active $colors(-activebg)] ;...ttk::style map "." -foreground [list disabled $colors(-disabledfg)] ;.. ttk::style map "." -embossed [list disabled 1] ;.....ttk::style configure TButton \... -anchor center -width -11 -padding "1 1" \... -reli

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\aquaTheme.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3838
                                                                                                                                                                                                                          Entropy (8bit):4.940737732832436
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:WdbclJFvlyLi+8OWXgQahpvAdNutdHrFBlCFBK2tdHkFBlhKgY1geAWUWeFVvtdp:C8EQPNeWgFeqdXj
                                                                                                                                                                                                                          MD5:F07A3A86362E9E253BE91F59714FE134
                                                                                                                                                                                                                          SHA1:84DE1AB2EAE62E4B114F0E613BD94955AFA9E6C7
                                                                                                                                                                                                                          SHA-256:E199CC9C429B35A09721D0A22543C3729E2B8462E68DFA158C0CEC9C70A0D79D
                                                                                                                                                                                                                          SHA-512:324EAF9F857076CA4FECB26D8DF76F8BB1D3F15EAE55D6B6C9689BF1682B306AC7A3592B6A518D23F9FE4DC21EFB6ACF1ECA948F889FA1ADFFA0E12C0BEAB57F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Aqua theme (OSX native look and feel)..#....namespace eval ttk::theme::aqua {.. ttk::style theme settings aqua {.....ttk::style configure . \... -font TkDefaultFont \... -background systemWindowBackgroundColor \... -foreground systemLabelColor \... -selectbackground systemSelectedTextBackgroundColor \... -selectforeground systemSelectedTextColor \... -selectborderwidth 0 \... -insertwidth 1.....ttk::style map . \... -foreground {....disabled systemDisabledControlTextColor....background systemLabelColor} \... -selectbackground {....background systemSelectedTextBackgroundColor....!focus systemSelectedTextBackgroundColor} \... -selectforeground {....background systemSelectedTextColor....!focus systemSelectedTextColor}.....# Button...ttk::style configure TButton -anchor center -width -6 \... -foreground systemControlTextColor...ttk::style map TButton \... -foreground {....pressed white... {alternate !pressed !background} white}...ttk::styl

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\button.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3014
                                                                                                                                                                                                                          Entropy (8bit):4.917794267131833
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:A5N+EqJWR1eTC01cG61ELLgrDgk1JgQ6TQGvhV5giT6TUP+3JWMHTeJ:kN+RQfccG61ooDgQ6dNT6TUP+PHO
                                                                                                                                                                                                                          MD5:D4BF1AF5DCDD85E3BD11DBF52EB2C146
                                                                                                                                                                                                                          SHA1:B1691578041319E671D31473A1DD404855D2038B
                                                                                                                                                                                                                          SHA-256:E38A9D1F437981AA6BF0BDD074D57B769A4140C0F7D9AFF51743FE4ECC6DFDDF
                                                                                                                                                                                                                          SHA-512:25834B4B231F4FF1A88EEF67E1A102D1D0546EC3B0D46856258A6BE6BBC4B381389C28E2EB60A01FF895DF24D6450CD16CA449C71F82BA53BA438A4867A47DCD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Bindings for Buttons, Checkbuttons, and Radiobuttons...#..# Notes: <Button1-Leave>, <Button1-Enter> only control the "pressed"..# state; widgets remain "active" if the pointer is dragged out...# This doesn't seem to be conventional, but it's a nice way..# to provide extra feedback while the grab is active...# (If the button is released off the widget, the grab deactivates and..# we get a <Leave> event then, which turns off the "active" state)..#..# Normally, <ButtonRelease> and <ButtonN-Enter/Leave> events are..# delivered to the widget which received the initial <Button>..# event. However, Tk [grab]s (#1223103) and menu interactions..# (#1222605) can interfere with this. To guard against spurious..# <Button1-Enter> events, the <Button1-Enter> binding only sets..# the pressed state if the button is currently active...#....namespace eval ttk::button {}....bind TButton <Enter> ..{ %W instate !disabled {%W state active} }..bind TButton <Leave>..{ %W state !active }..bind TButton <s

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\clamTheme.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4809
                                                                                                                                                                                                                          Entropy (8bit):4.905115353394083
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:KrS4se/XhW03cC7TxPp/uo1ZUb0WZvSoetCgV+tMWG3xT3xgNB4x76FAuoxVYuIJ:oS4sSjWwFAGkhiP3xT3xL6B2bbe
                                                                                                                                                                                                                          MD5:2B20E7B2E6BDDBEB14F5F63BF38DBF24
                                                                                                                                                                                                                          SHA1:43DB48094C4BD7DE3B76AFBC051D887FEFE9887E
                                                                                                                                                                                                                          SHA-256:CFFC59931FDD1683AD23895E92522CF49B099128753FCDFF34374024E42CF995
                                                                                                                                                                                                                          SHA-512:1EB5EA78D26D18EAD6563AFBF1798F71723001DCC945E7DB3E4368564D0563029BE3565876AD8CB97331CFE34B2A0A313FA1BF252B87049160FE5DCD65434775
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# "Clam" theme...#..# Inspired by the XFCE family of Gnome themes...#....namespace eval ttk::theme::clam {.. variable colors.. array set colors {...-disabledfg.."#999999"...-frame .."#dcdad5"...-window .."#ffffff"...-dark..."#cfcdc8"...-darker .."#bab5ab"...-darkest.."#9e9a91"...-lighter.."#eeebe7"...-lightest .."#ffffff"...-selectbg.."#4a6984"...-selectfg.."#ffffff"...-altindicator.."#5895bc"...-disabledaltindicator."#a0a0a0".. }.... ttk::style theme settings clam {.....ttk::style configure "." \... -background $colors(-frame) \... -foreground black \... -bordercolor $colors(-darkest) \... -darkcolor $colors(-dark) \... -lightcolor $colors(-lighter) \... -troughcolor $colors(-darker) \... -selectbackground $colors(-selectbg) \... -selectforeground $colors(-selectfg) \... -selectborderwidth 0 \... -font TkDefaultFont \... ;.....ttk::style map "." \... -background [list disabled $colors(-frame) \..... active $colors(-lighter)] \..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\classicTheme.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3864
                                                                                                                                                                                                                          Entropy (8bit):4.935603001745302
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:zcJZjdWs+WVB4ULsMF7tnvnuSuqo5DKxiFgG0FgGHx9FrGTtu/3Kt+iW2PbuAk38:zcJZEstB4UoituSm+VtYErY
                                                                                                                                                                                                                          MD5:0205663142775F4EF2EB104661D30979
                                                                                                                                                                                                                          SHA1:452A0D613288A1CC8A1181C3CC1167E02AA69A73
                                                                                                                                                                                                                          SHA-256:424BBA4FB6836FEEBE34F6C176ED666DCE51D2FBA9A8D7AA756ABCBBAD3FC1E3
                                                                                                                                                                                                                          SHA-512:FB4D212A73A6F5A8D2774F43D310328B029B52B35BEE133584D8326363B385AB7AA4AE25E98126324CC716962888321E0006E5F6EF8563919A1D719019B2D117
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# "classic" Tk theme...#..# Implements Tk's traditional Motif-like look and feel...#....namespace eval ttk::theme::classic {.... variable colors; array set colors {...-frame.."#d9d9d9"...-window.."#ffffff"...-activebg."#ececec"...-troughbg."#c3c3c3"...-selectbg."#c3c3c3"...-selectfg."#000000"...-disabledfg."#a3a3a3"...-indicator."#b03060"...-altindicator."#b05e5e".. }.... ttk::style theme settings classic {...ttk::style configure "." \... -font..TkDefaultFont \... -background..$colors(-frame) \... -foreground..black \... -selectbackground.$colors(-selectbg) \... -selectforeground.$colors(-selectfg) \... -troughcolor.$colors(-troughbg) \... -indicatorcolor.$colors(-frame) \... -highlightcolor.$colors(-frame) \... -highlightthickness.1 \... -selectborderwidth.1 \... -insertwidth.2 \... ;.....# To match pre-Xft X11 appearance, use:...#.ttk::style configure . -font {Helvetica 12 bold}.....ttk::style map "." -background \... [list disabled

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\combobox.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12718
                                                                                                                                                                                                                          Entropy (8bit):5.063548300335668
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:otLzBJ9SfinaXUBLPYXlk7fKiLH+AzIoJdJwGknmyLsxoVEQGITse8g5sarkT32e:wB5aXmLPYXmrKxLL7A
                                                                                                                                                                                                                          MD5:F7065D345A4BFB3127C3689BF1947C30
                                                                                                                                                                                                                          SHA1:9631C05365B0F5A36E4CA5CBA83628CCD7FCBDE1
                                                                                                                                                                                                                          SHA-256:68EED4AF6D2EC5B3EA24B1122A704B040366CBE2F458103137479352FFA1475A
                                                                                                                                                                                                                          SHA-512:74B99B9E326680150DD5EC7263192691BCD8A71B2A4EE7F3177DEDDD43E924A7925085C6D372731A70570F96B3924450255B2F54CA3B9C44D1160CA37E715B00
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Combobox bindings...#..# <<NOTE-WM-TRANSIENT>>:..#..#.Need to set [wm transient] just before mapping the popdown..#.instead of when it's created, in case a containing frame..#.has been reparented [#1818441]...#..#.On Windows: setting [wm transient] prevents the parent..#.toplevel from becoming inactive when the popdown is posted..#.(Tk 8.4.8+)..#..#.On X11: WM_TRANSIENT_FOR on override-redirect windows..#.may be used by compositing managers and by EWMH-aware..#.window managers (even though the older ICCCM spec says..#.it's meaningless)...#..#.On OSX: [wm transient] does utterly the wrong thing...#.Instead, we use [MacWindowStyle "help" "noActivates hideOnSuspend"]...#.The "noActivates" attribute prevents the parent toplevel..#.from deactivating when the popdown is posted, and is also..#.necessary for "help" windows to receive mouse events...#."hideOnSuspend" makes the popdown disappear (resp. reappear)..#.when the parent toplevel is deactivated (resp. reactivated)...#.(see [#18147

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\cursors.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4674
                                                                                                                                                                                                                          Entropy (8bit):4.836935825704301
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:DRYEqfLDxGmxGUetobPT6t6brv0q3O4Uxz0:DWEqTDbxdKobPqe5PUxw
                                                                                                                                                                                                                          MD5:1A799FE3754307A5AADE98C367E2F5D7
                                                                                                                                                                                                                          SHA1:C64BE4B77F0D298610F4EE20FCEBBAEE3C8B5F22
                                                                                                                                                                                                                          SHA-256:5B33F32B0139663347D6CF70A5A838F8E4554E0E881E97C8478B77733162EA73
                                                                                                                                                                                                                          SHA-512:89F367F9A59730BCDFC5ABDE0E35A10B72A1F19C68A768BA4524C938EF5C5CAF094C1BFA8FC74173F65201F6617544223C2143252A9F691EE9AAA7543315179F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Map symbolic cursor names to platform-appropriate cursors...#..# The following cursors are defined:..#..#.standard.-- default cursor for most controls..#.""..-- inherit cursor from parent window..#.none..-- no cursor..#..#.text..-- editable widgets (entry, text)..#.link..-- hyperlinks within text..#.crosshair.-- graphic selection, fine control..#.busy..-- operation in progress..#.forbidden.-- action not allowed..#..#.hresize..-- horizontal resizing..#.vresize..-- vertical resizing..#..# Also resize cursors for each of the compass points,..# {nw,n,ne,w,e,sw,s,se}resize...#..# Platform notes:..#..# Windows doesn't distinguish resizing at the 8 compass points,..# only horizontal, vertical, and the two diagonals...#..# OSX doesn't have resize cursors for nw, ne, sw, or se corners...# We use the Tk-defined X11 fallbacks for these...#..# X11 doesn't have a "forbidden" cursor (usually a slashed circle);..# "pirate" seems to be the conventional cursor for this purpose...#..# Windows has a

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\defaults.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4553
                                                                                                                                                                                                                          Entropy (8bit):4.933885986949396
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:lNl3u3lCFUeuMGN3xbVJU+N3xbVJh3IwxkxlBqatUrtY:zl3ZUe9GN3NVC+N3NVjqntUZY
                                                                                                                                                                                                                          MD5:FC79F42761D63172163C08F0F5C94436
                                                                                                                                                                                                                          SHA1:AABAB4061597D0D6DC371F46D14AAA1A859096DF
                                                                                                                                                                                                                          SHA-256:49AE8FAF169165BDDAF01D50B52943EBAB3656E9468292B7890BE143D0FCBC91
                                                                                                                                                                                                                          SHA-512:F619834A95C9DEB93F8184BCC437D701A961C77E24A831ADBD5C145556D26986BFDA2A6ACB9E8784F8B2380E122D12AC893EB1B6ACF03098922889497E1FF9EA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Settings for default theme...#....namespace eval ttk::theme::default {.. variable colors.. array set colors {...-frame..."#d9d9d9"...-foreground.."#000000"...-window..."#ffffff"...-text .."#000000"...-activebg.."#ececec"...-selectbg.."#4a6984"...-selectfg.."#ffffff"...-darker .."#c3c3c3"...-disabledfg.."#a3a3a3"...-indicator.."#4a6984"...-disabledindicator."#a3a3a3"...-altindicator.."#9fbdd8"...-disabledaltindicator."#c0c0c0".. }.... ttk::style theme settings default {.....ttk::style configure "." \... -borderwidth .1 \... -background .$colors(-frame) \... -foreground .$colors(-foreground) \... -troughcolor .$colors(-darker) \... -font ..TkDefaultFont \... -selectborderwidth.1 \... -selectbackground.$colors(-selectbg) \... -selectforeground.$colors(-selectfg) \... -insertwidth .1 \... -indicatordiameter.10 \... ;.....ttk::style map "." -background \... [list disabled $colors(-frame) active $colors(-activebg)]...ttk::style map "."

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\entry.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17658
                                                                                                                                                                                                                          Entropy (8bit):5.026830367336785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:sca9Jzcyzf6yzwO+v+iPT3vKof8q3YIuR13a:sT9Jzcy76wiV3YNa
                                                                                                                                                                                                                          MD5:7FFD7A32C7F8E234763E99E3357DB624
                                                                                                                                                                                                                          SHA1:67C67557F3A6DC8B240E85D46F6B733FEE45A013
                                                                                                                                                                                                                          SHA-256:266553EB9EED333DD836BA96204AE008F10686F4F12C404187F1E01CAB65D246
                                                                                                                                                                                                                          SHA-512:D18B73E44F37ED92B9FD7C1F6510285D1280EB5BC665B46996E538924E9D1CAD63337279BF92587132C3AEA497325A17CCE671EA59537B350F6D921C25346F39
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# DERIVED FROM: tk/library/entry.tcl r1.22..#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 2004, Joe English..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval ttk {.. namespace eval entry {...variable State.....set State(x) 0...set State(selectMode) none...set State(anchor) 0...set State(scanX) 0...set State(scanIndex) 0...set State(scanMoved) 0.....# Button-2 scan speed is (scanNum/scanDen) characters...# per pixel of mouse movement....# The standard Tk entry widget uses the equivalent of...# scanNum = 10, scanDen = average character width....# I don't know why that was chosen....#...set State(scanNum) 1...set State(scanDen) 1...set State(deadband) 3.;# #pixels for mouse-moved deadband... }..}....### Option database settings...#..option add *TEntry.cursor [ttk::cursor text] widg

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\fonts.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5732
                                                                                                                                                                                                                          Entropy (8bit):5.001928619185109
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:NzEh94ntnVU8Z/1LkAKgW22SeLMQR8hzcksejmOF4ytZm:Sh9ahV3ZWAKgWDfktm
                                                                                                                                                                                                                          MD5:80331FCBE4C049FF1A0D0B879CB208DE
                                                                                                                                                                                                                          SHA1:4EB3EFDFE3731BD1AE9FD52CE32B1359241F13CF
                                                                                                                                                                                                                          SHA-256:B94C319E5A557A5665B1676D602B6495C0887C5BACF7FA5B776200112978BB7B
                                                                                                                                                                                                                          SHA-512:A4BD2D91801C121A880225F1F3D0C4E30BF127190CF375F6F7A49EB4239A35C49C44F453D6D3610DF0D6A7B3CB15F4E79BD9C129025CC496CEB856FCC4B6DE87
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Font specifications...#..# This file, [source]d at initialization time, sets up the following..# symbolic fonts based on the current platform:..#..# TkDefaultFont.-- default for GUI items not otherwise specified..# TkTextFont.-- font for user text (entry, listbox, others)..# TkFixedFont.-- standard fixed width font..# TkHeadingFont.-- headings (column headings, etc)..# TkCaptionFont -- dialog captions (primary text in alert dialogs, etc.)..# TkTooltipFont.-- font to use for tooltip windows..# TkIconFont.-- font to use for icon captions..# TkMenuFont.-- used to use for menu items..#..# In Tk 8.5, some of these fonts may be provided by the TIP#145 implementation..# (On Windows and Mac OS X as of Oct 2007)...#..# +++ Platform notes:..#..# Windows:..#.The default system font changed from "MS Sans Serif" to "Tahoma"..# .in Windows XP/Windows 2000...#..#.MS documentation says to use "Tahoma 8" in Windows 2000/XP,..#.although many MS programs still use "MS Sans Serif 8"..#..#.Should use

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\menubutton.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6443
                                                                                                                                                                                                                          Entropy (8bit):4.9213750923402735
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:toMcJQkmcE6fNuLyiCzSLSRwgppdT3kXdpK3dpKkSH2tOTjvAG:tRc6kFbcH2pyXz+zO2y
                                                                                                                                                                                                                          MD5:F11A76FBABF35E446A1200A5A7A6730A
                                                                                                                                                                                                                          SHA1:4CBAB3507C1EF275691C98620D2B5CEEB9043B3E
                                                                                                                                                                                                                          SHA-256:54663FBF524CAD9D74AB1EC44B7FDDE0B87F06E5347191962C97F51F714E29BB
                                                                                                                                                                                                                          SHA-512:95471D1519AE663EC7EB4639D847019E0C9F70DEA2B0680D81FB8BBE7CD1FF643A3DF5E06CA2CC54385BE094BDCC64AB0F1AA1652F91D16C4EF7B68CB670371E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Bindings for Menubuttons...#..# Menubuttons have three interaction modes:..#..# Pulldown: Press menubutton, drag over menu, release to activate menu entry..# Popdown: Click menubutton to post menu..# Keyboard: <space> or accelerator key to post menu..#..# (In addition, when menu system is active, "dropdown" -- menu posts..# on mouse-over. Ttk menubuttons don't implement this)...#..# For keyboard and popdown mode, we hand off to tk_popup and let..# the built-in Tk bindings handle the rest of the interaction...#..# ON X11:..#..# Standard Tk menubuttons use a global grab on the menubutton...# This won't work for Ttk menubuttons in pulldown mode,..# since we need to process the final <ButtonRelease> event,..# and this might be delivered to the menu. So instead we..# rely on the passive grab that occurs on <Button> events,..# and transition to popdown mode when the mouse is released..# or dragged outside the menubutton...#..# ON WINDOWS:..#..# I'm not sure what the hell is going on h

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\notebook.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5825
                                                                                                                                                                                                                          Entropy (8bit):4.96378772387536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:RErUhyi5JeUQBWdz6eP8ClR6/u6AsBmPNNiREUkheLY1EVL23sN2JJjQdD:6uyiyDQBP8q6/u6AUREUsNEVq3y2jkdD
                                                                                                                                                                                                                          MD5:F811F3E46A4EFA73292F40D1CDDD265D
                                                                                                                                                                                                                          SHA1:7FC70A1984555672653A0840499954B854F27920
                                                                                                                                                                                                                          SHA-256:22264D8D138E2C0E9A950305B4F08557C5A73F054F8215C0D8CE03854042BE76
                                                                                                                                                                                                                          SHA-512:4424B7C687EB9B1804ED3B1C685F19D4D349753B374D9046240F937785C9713E8A760ADA46CB628C15F9C7983CE4A7987691C968330478C9C1A9B74E953E40AC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Bindings for TNotebook widget..#....namespace eval ttk::notebook {.. variable TLNotebooks ;# See enableTraversal..}....bind TNotebook <Button-1>..{ ttk::notebook::Press %W %x %y }..bind TNotebook <Right>...{ ttk::notebook::CycleTab %W 1; break }..bind TNotebook <Left>...{ ttk::notebook::CycleTab %W -1; break }..bind TNotebook <Control-Tab>..{ ttk::notebook::CycleTab %W 1; break }..bind TNotebook <Control-Shift-Tab>.{ ttk::notebook::CycleTab %W -1; break }..catch {..bind TNotebook <Control-ISO_Left_Tab>.{ ttk::notebook::CycleTab %W -1; break }..}..bind TNotebook <Destroy>..{ ttk::notebook::Cleanup %W }....# ActivateTab $nb $tab --..#.Select the specified tab and set focus...#..# Desired behavior:..#.+ take focus when reselecting the currently-selected tab;..#.+ keep focus if the notebook already has it;..#.+ otherwise set focus to the first traversable widget..#. in the newly-selected tab;..#.+ do not leave the focus in a deselected tab...#..proc ttk::notebook::ActivateTab {

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\panedwindow.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2274
                                                                                                                                                                                                                          Entropy (8bit):4.951790637542993
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:zVAqE3ZF8b4rXzsqAOAXsmCLFeNqkFeNXez:zLeU4bzSs1M
                                                                                                                                                                                                                          MD5:848A62BCF6ED3C16A8CFD26C43E1BC4E
                                                                                                                                                                                                                          SHA1:6F5E3EDF62716B511CF575BE2C6C997AFA2FA1E7
                                                                                                                                                                                                                          SHA-256:20EE6AD9D701709724292A926AF93C93784B254B48A656ECC140EF3A0FE10A11
                                                                                                                                                                                                                          SHA-512:AE78028EAF96E5B77DEFF0CD655360DB3A8058AC98B6753D9B77D629EDFFC582999A22A7075B9F5BA83EE65DA093E2CCB0EEAA4049898910D7AF517FDE60B28E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Bindings for ttk::panedwindow widget...#....namespace eval ttk::panedwindow {.. variable State.. array set State {...pressed 0.. .pressX.-...pressY.-...sash .-...sashPos -.. }..}....## Bindings:..#..bind TPanedwindow <Button-1> ..{ ttk::panedwindow::Press %W %x %y }..bind TPanedwindow <B1-Motion>..{ ttk::panedwindow::Drag %W %x %y }..bind TPanedwindow <ButtonRelease-1> .{ ttk::panedwindow::Release %W %x %y }....bind TPanedwindow <Motion> ..{ ttk::panedwindow::SetCursor %W %x %y }..bind TPanedwindow <Enter> ..{ ttk::panedwindow::SetCursor %W %x %y }..bind TPanedwindow <Leave> ..{ ttk::panedwindow::ResetCursor %W }..# See <<NOTE-PW-LEAVE-NOTIFYINFERIOR>>..bind TPanedwindow <<EnteredChild>>.{ ttk::panedwindow::ResetCursor %W }....## Sash movement:..#..proc ttk::panedwindow::Press {w x y} {.. variable State.... set sash [$w identify $x $y].. if {$sash eq ""} {.. .set State(pressed) 0...return.. }.. set State(pressed) .1.. set State(pressX) .$x.. set

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\progress.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1138
                                                                                                                                                                                                                          Entropy (8bit):4.763501917862434
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:nJ8v3O0NSiio0pNFVkIks0ImxlnINgDImSgGINSyWghT:JFqS/o03fkxs0Rn+gD4v+S2F
                                                                                                                                                                                                                          MD5:DBF3BF0E8F04E9435E9561F740DFC700
                                                                                                                                                                                                                          SHA1:C7619A05A834EFB901C57DCFEC2C9E625F42428F
                                                                                                                                                                                                                          SHA-256:697CC0A75AE31FE9C2D85FB25DCA0AFA5D0DF9C523A2DFAD2E4A36893BE75FBA
                                                                                                                                                                                                                          SHA-512:D3B323DFB3EAC4A78DA2381405925C131A99C6806AF6FD8041102162A44E48BF166982A4AE4AA142A14601736716F1A628D9587E292FA8E4842BE984374CC192
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Ttk widget set: progress bar utilities...#....namespace eval ttk::progressbar {.. variable Timers.;# Map: widget name -> after ID..}....# Autoincrement --..#.Periodic callback procedure for autoincrement mode..#..proc ttk::progressbar::Autoincrement {pb steptime stepsize} {.. variable Timers.... if {![winfo exists $pb]} {.. .# widget has been destroyed -- cancel timer...unset -nocomplain Timers($pb)...return.. }.... set Timers($pb) [after $steptime \.. .[list ttk::progressbar::Autoincrement $pb $steptime $stepsize] ].... $pb step $stepsize..}....# ttk::progressbar::start --..#.Start autoincrement mode. Invoked by [$pb start] widget code...#..proc ttk::progressbar::start {pb {steptime 50} {stepsize 1}} {.. variable Timers.. if {![info exists Timers($pb)]} {...Autoincrement $pb $steptime $stepsize.. }..}....# ttk::progressbar::stop --..#.Cancel autoincrement mode. Invoked by [$pb stop] widget code...#..proc ttk::progressbar::stop {pb} {.. variabl

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\scale.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2787
                                                                                                                                                                                                                          Entropy (8bit):4.795451191784129
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:IKADAzizZIcAlRqucObmn4AzyVN2AJyhAzukPNP:IHIBRqupmLSZkklP
                                                                                                                                                                                                                          MD5:F1C33CC2D47115BBECD2E7C2FCB631A7
                                                                                                                                                                                                                          SHA1:0123A961242ED8049B37C77C726DB8DBD94C1023
                                                                                                                                                                                                                          SHA-256:B909ADD0B87FA8EE08FD731041907212A8A0939D37D2FF9B2F600CD67DABD4BB
                                                                                                                                                                                                                          SHA-512:96587A8C3555DA1D810010C10C516CE5CCAB071557A3C8D9BD65C647C7D4AD0E35CBED0788F1D72BAFAC8C84C7E2703FC747F70D9C95F720745A1FC4A701C544
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# scale.tcl - Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>..#..# Bindings for the TScale widget....namespace eval ttk::scale {.. variable State.. array set State {...dragging 0.. }..}....bind TScale <Button-1> { ttk::scale::Press %W %x %y }..bind TScale <B1-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-1> { ttk::scale::Release %W %x %y }....bind TScale <Button-2> { ttk::scale::Jump %W %x %y }..bind TScale <B2-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-2> { ttk::scale::Release %W %x %y }....bind TScale <Button-3> { ttk::scale::Jump %W %x %y }..bind TScale <B3-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-3> { ttk::scale::Release %W %x %y }....## Keyboard navigation bindings:..#..bind TScale <<LineStart>> { %W set [%W cget -from] }..bind TScale <<LineEnd>> { %W set [%W cget -to] }....bind TScale <<PrevChar>> { ttk::scale::Increment %W -1 }..bin

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\scrollbar.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3285
                                                                                                                                                                                                                          Entropy (8bit):4.979174619784594
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:tyASEji8RYQ8FGD7BDos9Q1TBfvq/HKTh9lkHv8T/mAezeLEAAFULxZh4x:eIi8qFu2d11XlhfkPcczeLS4Zm
                                                                                                                                                                                                                          MD5:3FB31A225CEC64B720B8E579582F2749
                                                                                                                                                                                                                          SHA1:9C0151D9E2543C217CF8699FF5D4299A72E8F13C
                                                                                                                                                                                                                          SHA-256:6EAA336B13815A7FC18BCD6B9ADF722E794DA2888D053C229044784C8C8E9DE8
                                                                                                                                                                                                                          SHA-512:E6865655585E3D2D6839B56811F3FD86B454E8CD44E258BB1AC576AD245FF8A4D49FBB7F43458BA8A6C9DAAC8DFA923A176F0DD8A9976A11BEA09E6E2D17BF45
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Bindings for TScrollbar widget..#....namespace eval ttk::scrollbar {.. variable State.. # State(xPress).--.. # State(yPress).-- initial position of mouse at start of drag... # State(first).-- value of -first at start of drag...}....bind TScrollbar <Button-1> ..{ ttk::scrollbar::Press %W %x %y }..bind TScrollbar <B1-Motion>..{ ttk::scrollbar::Drag %W %x %y }..bind TScrollbar <ButtonRelease-1>.{ ttk::scrollbar::Release %W %x %y }....bind TScrollbar <Button-2> ..{ ttk::scrollbar::Jump %W %x %y }..bind TScrollbar <B2-Motion>..{ ttk::scrollbar::Drag %W %x %y }..bind TScrollbar <ButtonRelease-2>.{ ttk::scrollbar::Release %W %x %y }....# Redirect scrollwheel bindings to the scrollbar widget..#..# The shift-bindings scroll left/right (not up/down)..# if a widget has both possibilities..set eventList [list <MouseWheel> <Shift-MouseWheel>]..switch [tk windowingsystem] {.. aqua {.. lappend eventList <Option-MouseWheel> <Shift-Option-MouseWheel>.. }.. x11 {..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\sizegrip.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2503
                                                                                                                                                                                                                          Entropy (8bit):4.830288003879418
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:naLvMnAqeYQWYh7FvBrrbnMCfY/aVAbAigWAuFM0PfWAX20:nWQapprPnJY/8A8iRFdPtj
                                                                                                                                                                                                                          MD5:DD6A1737B14D3F7B2A0B4F8BE99C30AF
                                                                                                                                                                                                                          SHA1:E6B06895317E73CD3DC78234DD74C74F3DB8C105
                                                                                                                                                                                                                          SHA-256:E92D77B5CDCA2206376DB2129E87E3D744B3D5E31FDE6C0BBD44A494A6845CE1
                                                                                                                                                                                                                          SHA-512:B74AE92EDD53652F8A3DB0D84C18F9CE9069805BCAB0D3C2DBB537D7C241AA2681DA69B699D88A10029798D7B5BC015682F64699BA475AE6A379EEF23B48DAAF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Sizegrip widget bindings...#..# Dragging a sizegrip widget resizes the containing toplevel...#..# NOTE: the sizegrip widget must be in the lower right hand corner...#....switch -- [tk windowingsystem] {.. x11 -.. win32 {...option add *TSizegrip.cursor [ttk::cursor seresize] widgetDefault.. }.. aqua {.. .# Aqua sizegrips use default Arrow cursor... }..}....namespace eval ttk::sizegrip {.. variable State.. array set State {...pressed .0...pressX ..0...pressY ..0...width ..0...height ..0...widthInc.1...heightInc.1.. resizeX 1.. resizeY 1...toplevel .{}.. }..}....bind TSizegrip <Button-1> ..{ ttk::sizegrip::Press.%W %X %Y }..bind TSizegrip <B1-Motion> ..{ ttk::sizegrip::Drag .%W %X %Y }..bind TSizegrip <ButtonRelease-1> .{ ttk::sizegrip::Release %W %X %Y }....proc ttk::sizegrip::Press {W X Y} {.. variable State.... if {[$W instate disabled]} { return }.... set top [winfo toplevel $W].... # If the toplevel is not resi

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\spinbox.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5003
                                                                                                                                                                                                                          Entropy (8bit):5.055050310142795
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:1qg/+yrjqA/K5ytxm1J1Ve6J1yQLUAzz/S76hrwxGGe2F:N/+yr2Gk1J1Ve6fxUAzDS76hrwxs2F
                                                                                                                                                                                                                          MD5:9C2833FAA9248F09BC2E6AB1BA326D59
                                                                                                                                                                                                                          SHA1:F13CF048FD706BBB1581DC80E33D1AAD910D93E8
                                                                                                                                                                                                                          SHA-256:DF286BB59F471AA1E19DF39AF0EF7AA84DF9F04DC4A439A747DD8BA43C300150
                                                                                                                                                                                                                          SHA-512:5FF3BE1E3D651C145950C3FC5B8C2E842211C937D1042173964383D4D59ECF5DD0EC39FF7771D029716F2D895F0B1A72591EF3BF7947FE64D4D6DB5F0B8ABFFB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# ttk::spinbox bindings..#....namespace eval ttk::spinbox { }....### Spinbox bindings...#..# Duplicate the Entry bindings, override if needed:..#....ttk::copyBindings TEntry TSpinbox....bind TSpinbox <Motion>...{ ttk::spinbox::Motion %W %x %y }..bind TSpinbox <Button-1> ..{ ttk::spinbox::Press %W %x %y }..bind TSpinbox <ButtonRelease-1> .{ ttk::spinbox::Release %W }..bind TSpinbox <Double-Button-1> .{ ttk::spinbox::DoubleClick %W %x %y }..bind TSpinbox <Triple-Button-1> .{} ;# disable TEntry triple-click....bind TSpinbox <Up>...{ event generate %W <<Increment>> }..bind TSpinbox <Down> ...{ event generate %W <<Decrement>> }....bind TSpinbox <<Increment>>..{ ttk::spinbox::Spin %W +1 }..bind TSpinbox <<Decrement>> ..{ ttk::spinbox::Spin %W -1 }....ttk::bindMouseWheel TSpinbox ..[list ttk::spinbox::MouseWheel %W]....## Motion --..#.Sets cursor...#..proc ttk::spinbox::Motion {w x y} {.. variable State.. ttk::saveCursor $w State(userConfCursor) [ttk::cursor text].. if { [$w ide

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\treeview.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10180
                                                                                                                                                                                                                          Entropy (8bit):4.886259798213254
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:FoTvMxHZZ1u2xj7+ZBHxjiXJv9IfwW+vr3UxjXEJDTF/MyLF3JcMzlsra2tYGa5P:mImAkRKYXMH59o4UbS30LWb
                                                                                                                                                                                                                          MD5:F705B3A292D02061DA0ABB4A8DD24077
                                                                                                                                                                                                                          SHA1:FD75C2250F6F66435444F7DEEF383C6397ED2368
                                                                                                                                                                                                                          SHA-256:C88B60FFB0F72E095F6FC9786930ADD7F9ED049EABC713F889F9A7DA516E188C
                                                                                                                                                                                                                          SHA-512:09817638DD3D3D5C57FA630C7EDF2F19C3956C9BD264DBF07627FA14A03AECD22D5A5319806E49EF1030204FADEF17C57CE8EAE4378A319AD2093321D9151C8F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# ttk::treeview widget bindings and utilities...#....namespace eval ttk::treeview {.. variable State.... # Enter/Leave/Motion.. #.. set State(activeWidget) .{}.. set State(activeHeading) .{}.... # Press/drag/release:.. #.. set State(pressMode) .none.. set State(pressX)..0.... # For pressMode == "resize".. set State(resizeColumn).#0.... # For pressmode == "heading".. set State(heading) .{}..}....### Widget bindings...#....bind Treeview.<Motion> ..{ ttk::treeview::Motion %W %x %y }..bind Treeview.<B1-Leave>..{ #nothing }..bind Treeview.<Leave>...{ ttk::treeview::ActivateHeading {} {}}..bind Treeview.<Button-1> ..{ ttk::treeview::Press %W %x %y }..bind Treeview.<Double-Button-1> .{ ttk::treeview::DoubleClick %W %x %y }..bind Treeview.<ButtonRelease-1> .{ ttk::treeview::Release %W %x %y }..bind Treeview.<B1-Motion> ..{ ttk::treeview::Drag %W %x %y }..bind Treeview .<Up> ..{ ttk::treeview::Keynav %W up }..bind Treeview .<Down> ..{ ttk::treeview

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\ttk.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4993
                                                                                                                                                                                                                          Entropy (8bit):4.954034141173847
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:lfxukTy5jPTq8LIgF2diyNTNR6nkrn4ijSSvNigyJ5612HtZG835MSvWOTRsHWU:BM+y5jrq8G/2nkEijSSvNigyJ5612Htw
                                                                                                                                                                                                                          MD5:AF45B2C8B43596D1BDECA5233126BD14
                                                                                                                                                                                                                          SHA1:A99E75D299C4579E10FCDD59389B98C662281A26
                                                                                                                                                                                                                          SHA-256:2C48343B1A47F472D1A6B9EE8D670CE7FB428DB0DB7244DC323FF4C7A8B4F64B
                                                                                                                                                                                                                          SHA-512:C8A8D01C61774321778AB149F6CA8DDA68DB69133CB5BA7C91938E4FD564160ECDCEC473222AFFB241304A9ACC73A36B134B3A602FD3587C711F2ADBB64AFA80
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Ttk widget set initialization script...#....### Source library scripts...#....namespace eval ::ttk {.. variable library.. if {![info exists library]} {...set library [file dirname [info script]].. }..}....source -encoding utf-8 [file join $::ttk::library fonts.tcl]..source -encoding utf-8 [file join $::ttk::library cursors.tcl]..source -encoding utf-8 [file join $::ttk::library utils.tcl]....## ttk::deprecated $old $new --..#.Define $old command as a deprecated alias for $new command..#.$old and $new must be fully namespace-qualified...#..proc ttk::deprecated {old new} {.. interp alias {} $old {} ttk::do'deprecate $old $new..}..## do'deprecate --..#.Implementation procedure for deprecated commands --..#.issue a warning (once), then re-alias old to new...#..proc ttk::do'deprecate {old new args} {.. deprecated'warning $old $new.. interp alias {} $old {} $new.. uplevel 1 [linsert $args 0 $new]..}....## deprecated'warning --..#.Gripe about use of deprecated comman

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\utils.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8624
                                                                                                                                                                                                                          Entropy (8bit):5.001791071900077
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:e0ebpSp+IZwnmTmpx8xzaHfw8K7LlJWQl8p7M+R5:rw0+WmpWxa/w9nlJHu
                                                                                                                                                                                                                          MD5:51086BC3315A4AE4A8591A654CFC3CEA
                                                                                                                                                                                                                          SHA1:2AC08309C63575B7A01FA62D3C262643CD8C823A
                                                                                                                                                                                                                          SHA-256:4AA041C050758B3331DC395381F7FBCE81E387908FC7A3C6107C4E7140F56F2E
                                                                                                                                                                                                                          SHA-512:6D69F7EAC9D5AF3B3EA85AE3E74BDFA6278789502D5E35EFE94349BFC543503BE7540D783D2632E349DD53F21074C702AC1FC487EE70C74234A08397F7238723
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Utilities for widget implementations...#....### Focus management...#..# See also: #1516479..#....## ttk::takefocus --..#.This is the default value of the "-takefocus" option..#.for ttk::* widgets that participate in keyboard navigation...#..# NOTES:..#.tk::FocusOK (called by tk_focusNext) tests [winfo viewable]..#.if -takefocus is 1, empty, or missing; but not if it's a..#.script prefix, so we have to check that here as well...#..#..proc ttk::takefocus {w} {.. expr {[$w instate !disabled] && [winfo viewable $w]}..}....## ttk::GuessTakeFocus --..#.This routine is called as a fallback for widgets..#.with a missing or empty -takefocus option...#..#.It implements the same heuristics as tk::FocusOK...#..proc ttk::GuessTakeFocus {w} {.. # Don't traverse to widgets with '-state disabled':.. #.. if {![catch {$w cget -state} state] && $state eq "disabled"} {...return 0.. }.... # Allow traversal to widgets with explicit key or focus bindings:.. #.. if {[regexp {Key|F

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\vistaTheme.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9710
                                                                                                                                                                                                                          Entropy (8bit):4.6639701588183895
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:BktY1F+qXd95WSZaHFHRE3GRKFh2oaoT/ezKpqvYMHab:V1F+cd95WSZuhRE34KbPmKmY2ab
                                                                                                                                                                                                                          MD5:0AA7F8B43C3E07F3A4DA07FC6DF9A1B0
                                                                                                                                                                                                                          SHA1:153AFB735B10BBA16CFBE161777232F983845D90
                                                                                                                                                                                                                          SHA-256:EC5F203C69DF390E9B99944CF3526D6E77DC6F68E9B1A029F326A41AFED1EF81
                                                                                                                                                                                                                          SHA-512:5406553211CD6714C98EF7765ABD46424CCB013343EFF693FDD3AE6E0AAE9B5983446E0E1CC706D6B2C285084BF83D397306D3D52028CBBCFB8F369857C5B69C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Settings for Microsoft Windows Vista and Server 2008..#....# The Vista theme can only be defined on Windows Vista and above. The theme..# is created in C due to the need to assign a theme-enabled function for..# detecting when themeing is disabled. On systems that cannot support the..# Vista theme, there will be no such theme created and we must not..# evaluate this script.....if {"vista" ni [ttk::style theme names]} {.. return..}....namespace eval ttk::theme::vista {.... ttk::style theme settings vista {.... .ttk::style configure . \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -insertcolor SystemWindowText \... -font TkDefaultFont \... ;.....ttk::style map "." \... -foreground [list disabled SystemGrayText] \... ;.....ttk::style configure TButton -anchor center -padding {1 1} -width -11...ttk::style configure TRadiobutton -padding 2...ttk::

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\winTheme.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2865
                                                                                                                                                                                                                          Entropy (8bit):4.917847108902527
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:b69VhW2gL5FPVWRzQsVqrEuF3yYrf7rfJF8xUqBgLt6g3ktO5jo4+iZ6O2htYtCW:bbXl+CEqZNNSxU0Ht2MR7W
                                                                                                                                                                                                                          MD5:769C0719A4044F91E7D132A25291E473
                                                                                                                                                                                                                          SHA1:6FB07B0C887D443A43FB15D5728920B578171219
                                                                                                                                                                                                                          SHA-256:AE82BCCCE708FF9C303CBCB3D4CC3FF5577A60D5B23822EA79E3E07CCE3CBBD1
                                                                                                                                                                                                                          SHA-512:47FED061DDC6B4EB63EF77901D0094FF2EBB1BAFACB3F44FBF13FB59DEA1EC83985B2862086ECF1A7957819A88A0FAA144B35F16BEA9356BBD9775070D42E636
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Settings for 'winnative' theme...#....namespace eval ttk::theme::winnative {.. ttk::style theme settings winnative {.....ttk::style configure "." \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -fieldbackground SystemWindow \... -insertcolor SystemWindowText \... -troughcolor SystemScrollbar \... -font TkDefaultFont \... ;.....ttk::style map "." -foreground [list disabled SystemGrayText] ;.. ttk::style map "." -embossed [list disabled 1] ;.....ttk::style configure TButton \... -anchor center -width -11 -relief raised -shiftrelief 1...ttk::style configure TCheckbutton -padding "2 4"...ttk::style configure TRadiobutton -padding "2 4"...ttk::style configure TMenubutton \... -padding "8 4" -arrowsize 3 -relief raised.....ttk::style map TButton -relief {{!disabled pressed} sunken}.....ttk::style configure TEntry \... -padding 2 -select

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\ttk\xpTheme.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2103
                                                                                                                                                                                                                          Entropy (8bit):4.9805308941424355
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:aaiIu89VhW2gLRWJyO514rf+rfzxTrf/MW+iZ6O2htYtCp:XoXAk21nxQ7p
                                                                                                                                                                                                                          MD5:162F30D2716438C75EA16B57E6F63088
                                                                                                                                                                                                                          SHA1:3F626FF0496BB16B27106BED7E38D1C72D1E3E27
                                                                                                                                                                                                                          SHA-256:AEDB21C6B2909A4BB4686837D2126E521A8CC2B38414A4540387B801EBD75466
                                                                                                                                                                                                                          SHA-512:6EBF9648F1381D04F351BB469B6E3A38F3D002189C92EAF80A18D65632037FF37D34EC8814BBF7FAE34553645BFC13985212F24684EE8C4E205729B975C88C97
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#..# Settings for 'xpnative' theme..#....namespace eval ttk::theme::xpnative {.... ttk::style theme settings xpnative {.....ttk::style configure . \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -insertcolor SystemWindowText \... -font TkDefaultFont \... ;.....ttk::style map "." \... -foreground [list disabled SystemGrayText] \... ;.....ttk::style configure TButton -anchor center -padding {1 1} -width -11...ttk::style configure TRadiobutton -padding 2...ttk::style configure TCheckbutton -padding 2...ttk::style configure TMenubutton -padding {8 4}.....ttk::style configure TNotebook -tabmargins {2 2 2 0}...ttk::style map TNotebook.Tab \... -expand [list selected {2 2 2 2}].....ttk::style configure TLabelframe.Label -foreground "#0046d5".....# OR: -padding {3 3 3 6}, which some apps seem to use....ttk::style configure TEntry -padding {2 2 2 4}...ttk::

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\unsupported.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10521
                                                                                                                                                                                                                          Entropy (8bit):5.0647027375963996
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:1Y3uWEXm/swEePmJhRAXd1hTHsHG2ML/9Lm2daM0Hu:8hodMiM0Hu
                                                                                                                                                                                                                          MD5:508F7E258C04970FAE526990168CB773
                                                                                                                                                                                                                          SHA1:33785204B18C0E0F5CDCB5B49399B5907351FDB8
                                                                                                                                                                                                                          SHA-256:B463B366F139DDF7FED31F34C6D2341F9F27845A1A358011DFC801E1333B1828
                                                                                                                                                                                                                          SHA-512:A12985B58DD1D46297119CED47B7F44EF4139CED6C36FD028E66DD657E5ED0663B744C679A5BF7A39B39D17A32E1280D2945F6B9AD59AEF20436F68040F6070C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# unsupported.tcl --..#..# Commands provided by Tk without official support. Use them at your..# own risk. They may change or go away without notice...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# ----------------------------------------------------------------------..# Unsupported compatibility interface for folks accessing Tk's private..# commands and variable against recommended usage...# ----------------------------------------------------------------------....namespace eval ::tk::unsupported {.... # Map from the old global names of Tk private commands to their.. # new namespace-encapsulated names..... variable PrivateCommands.. array set PrivateCommands {...tkButtonAutoInvoke..::tk::ButtonAutoInvoke...tkButtonDown...::tk::ButtonDown...tkButtonEnter...::tk::ButtonEnter...tkButtonInvoke...::tk::ButtonInvoke...tkButtonLeave...::tk::ButtonLeave...tkButtonUp...::tk::ButtonUp...tk

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\tk\xmfbox.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):26991
                                                                                                                                                                                                                          Entropy (8bit):4.974180990171971
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:0BLzjXhss64XKNFXm39QJ63nwFiHLgRIdNPCRE5phLtffsNP4XWdxWk+I5oP9jNR:0BvjXoFCB3flLCRE5phLCP3xWq8vWTod
                                                                                                                                                                                                                          MD5:FA99EF44FAA88A6BA1967A1257DEB97B
                                                                                                                                                                                                                          SHA1:CC99DBF678F4169A90ACC5A89C6F8DAB48052EC6
                                                                                                                                                                                                                          SHA-256:C4722EADEDE763FA52E7937D40067B0F8EB86B7A4B707F90212ED3E5289690D0
                                                                                                                                                                                                                          SHA-512:3AF16095784908A444CD61EEF178A30B9FED9C20AA91D94044A3AECB6047267FB80BCE790FC1F28FB19AEF664A6618FD832612F541FDADCC34B6C01E92E5EA40
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# xmfbox.tcl --..#..#.Implements the "Motif" style file selection dialog for the..#.Unix platform. This implementation is used only if the..#."::tk_strictMotif" flag is set...#..# Copyright (c) 1996 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Scriptics Corporation..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {}......# ::tk::MotifFDialog --..#..#.Implements a file dialog similar to the standard Motif file..#.selection box...#..# Arguments:..#.type.."open" or "save"..#.args..Options parsed by the procedure...#..# Results:..#.When -multiple is set to 0, this returns the absolute pathname..#.of the selected file. (NOTE: This is not the same as a single..#.element list.)..#..#.When -multiple is set to > 0, this returns a Tcl list of absolute..# pathnames. The argument for -multiple is ignored, but for consistency..#

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\advanced\pkgIndex.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):256
                                                                                                                                                                                                                          Entropy (8bit):4.9645158152432876
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SZi010tvk7QUlt8MJ0BFaXogMQ9NfrQ+pBFar7v:Ai010qABFDYrQ+pBFAv
                                                                                                                                                                                                                          MD5:13BCDA472E1BA74350209748EC811E9D
                                                                                                                                                                                                                          SHA1:28C8A9E807BB8D7C87DCF287F591BBB6D1ECE8D2
                                                                                                                                                                                                                          SHA-256:4C2FFC43FA5F37DCE7F90BA7CCDAC7E3A603BB57702753D9DE8A53591A45B250
                                                                                                                                                                                                                          SHA-512:86A655E7ECCB2A46178C3882DB961D292DAE60F9C69ECB9757F1029BF413AC911F601400CB95E8BFA3B8F10BEAB4A60FBE7D42DE636A0F6871E9F915F3EBB623
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Author: RedFantom.# License: GNU GPLv3.# Copyright (c) 2017-2019 RedFantom..package require Tk 8.6..if {[file isdirectory [file join $dir advanced]]} {. package ifneeded ttk::theme::advanced 1.0 \. [list source [file join $dir advanced.tcl]].}.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\advanced\pkgIndex_package.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):171
                                                                                                                                                                                                                          Entropy (8bit):4.464255782720757
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:NNtzUdJwEVDgIkeeR1iOq1TmNAIyuKVhneT4Ijul7RN+OEToeTq2v:NNFUx2QTmS5uKjneT3qpRN+OaTrv
                                                                                                                                                                                                                          MD5:6FCA6FFBCF512F36D8A8321B56A567CB
                                                                                                                                                                                                                          SHA1:814F4318D6701CF3337FDB9E1F2241EBC503BDEF
                                                                                                                                                                                                                          SHA-256:99711ABBDB07F592947E4078B8B6D29D08A222EEE3F4C4F79B4E7D5BA599B575
                                                                                                                                                                                                                          SHA-512:E4257367C80947DE75D876E868630F17B2D10F120224D3168CABE535E5BE19B35FCF1BE04DA76BAB356978C6D3E008735CC6298B1894944ED0935EB12EB37EC9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:set themesdir [file join [pwd] [file dirname [info script]]].lappend auto_path $themesdir.package provide advanced 1.0.source [file join $themesdir advanced advanced.tcl].

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\LICENSE.md

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-8 text, with very long lines (1112)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19482
                                                                                                                                                                                                                          Entropy (8bit):4.573165866148044
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:jgkHgUm2NEHUhwdP45WKHXHIaktMsxql6+ROLclEViD4pX5//2bbXHb+UyYf:jpA4CHUhwdiWKH3IaOqFNl6xX53+1
                                                                                                                                                                                                                          MD5:BA2707BD5065BC93A0FAAE79377CD703
                                                                                                                                                                                                                          SHA1:6974CECCE2417ED51CE83500ECE85E0F51478FA8
                                                                                                                                                                                                                          SHA-256:F2715D0C0881A12A0FC08C8D8FBB7F8DCE01C4B458D46731D633D9D64427CC44
                                                                                                                                                                                                                          SHA-512:FA72F05C45D7D1EE8CB4BA5E5F039AB91574F54F4B487148ECAA04EFD7AA6D05607C65817323CEDCE06CAFC0906B055DA435B9A43D1FEC684A808CF2610EDB65
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# SVG Image License..This License applies to the PNG images, built from the SVG images in the.adapta theme using `tool/svg.py`, ONLY! This License does not cover.`adapta.tcl`, which is covered by GNU GPLv3 as it is derived from.`equilux.tcl`, which is derived from `arc.tcl`...[CC BY-SA is one-way compatible with GNU GPLv3](https://wiki.creativecommons.org/wiki/ShareAlike_compatibility:_GPLv3),.and thus theme `adapta` can be used as if it were licensed under .`GNU GPLv3`...Note that the `adapta`-theme code/markup files are licensed under GNU.GPLv2, which is incompatible with GNU GPLv3 (as it does not specify.`Or at your option, any later version`), but no files covered by only.GPLv2 from the `adapta` theme are included, so it does NOT apply. ..Original Theme [`adapta-gtk-theme`](https://github.com/adapta-project/adapta-gtk-theme)..**Authors**: `@tista500` and others ...# Attribution-ShareAlike 4.0 International..Creative Commons Corporation (.Creative Commons.) is not a law firm and

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14693
                                                                                                                                                                                                                          Entropy (8bit):4.1696817328292095
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:AVH5blqSC38SC3u3D3uSC3CBC3NIiSCCLfoaVlYEOJCqVt7VKGOffky:AVZhusGziR2foaVlYEOJCqj7VKF
                                                                                                                                                                                                                          MD5:7940D47B6A82F0490F928010D6E80C06
                                                                                                                                                                                                                          SHA1:D04608B9E9E00B800406DC36704B4A87DCCAB0EC
                                                                                                                                                                                                                          SHA-256:10113BF18EB0F81A4C84F531F165FACC99A86311EDCB927E83FC5B4F3FA80043
                                                                                                                                                                                                                          SHA-512:4B5E82D5CC84CEA7341482124A385618E3FF2B7E1C5E83A66C144806579C8A41C8372255F2DC1AB6BDD4CA30C4780279F93BF28A645C4EED6BB148D7B46D14E0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Copyright (C) 2018 RedFantom.# Derived from https://github.com/adapta-project/adapta-gtk-theme (GNU GPLv2).# Based on /ttkthemes/ttkthemes/themes/arc/arc.tcl (GNU GPLv3).# Available under the GNU GPLv3, or at your option any later version..# Theme Adapta.namespace eval ttk::theme::adapta {.. # Widget colors. variable colors. array set colors {. -foreground "#000000". -background "#fafbfc". -disabledbg "#fafbfc". -disabledfg "#c3c5d6". -selectbg "#00bcd4". -selectfg "#ffffff". -window "#fafbfc". -focuscolor "#1ee9b7". -checklight "#1ee9b7". }.. # Function to load images from subdirectory. variable directory. # Subdirectory /adapta. set directory [file join [file dirname [info script]] adapta]. variable images. # Load the images. foreach file [glob -directory $directory *.gif] {. set img [file tail [file rootname $file]]. set images($

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-down-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):82
                                                                                                                                                                                                                          Entropy (8bit):4.892826448398319
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CExXzt1ylHrWX9+mbY1Xc8W:HxXz31+Xq
                                                                                                                                                                                                                          MD5:F334627DA35595DB9FC3597F445BE757
                                                                                                                                                                                                                          SHA1:6BC2EBF0E469D7011E15E31AC486EBCAD1ED09B6
                                                                                                                                                                                                                          SHA-256:C2B113A61026025FD6EA3C43ADB9DC1563E350947817C99B82E9F5CFC2598D02
                                                                                                                                                                                                                          SHA-512:6A530C9DA04A3C20A77BC42BE32FDE855AE3878B15AC36281066457AC714B19521A2FB4224C47FF540CCE9A6DEFB0C1304343A148AD5BC241BB52E96736AE5E0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......,..........#..........3....L....gVcj.....L..U..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-down-pressed.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):82
                                                                                                                                                                                                                          Entropy (8bit):5.062181300230826
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CE+WqB/wl0xlm3uXrwW3jiXpVW:HOpjm3KEW3eXpc
                                                                                                                                                                                                                          MD5:3BB7D892B8AB4384B0D929874ADE96CC
                                                                                                                                                                                                                          SHA1:19B1067D345C67540D218C51077E3EB1453B0CB7
                                                                                                                                                                                                                          SHA-256:580C43027EF7B93CD35889B845911CE53FCD9CB5E5887C1B805A8CFB40217A55
                                                                                                                                                                                                                          SHA-512:CA0206E066D3987E1490B11EDBF6ECEBAC8BB563EDA90CB25EAF6044895A27038AD2612F2300CD93AF6580FBC488887EE3BB1B878197CDF23AFF4F5DBFFF6E51
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......,..........#..........3....L.'..gVcj.....L..U..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-down.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):70
                                                                                                                                                                                                                          Entropy (8bit):4.708347156122229
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CE9/ecylaJd1chX:H92clJkhX
                                                                                                                                                                                                                          MD5:F0F5BE8DC7B2E37DB5646CC89FB9B595
                                                                                                                                                                                                                          SHA1:CB4565623C5F3EAB30CDA220C0E853F4C9776131
                                                                                                                                                                                                                          SHA-256:60F4C75F54C43FDD6FEE30A8C9FB1FC75571B1D8BE4F437777FD25C975A03939
                                                                                                                                                                                                                          SHA-512:4C860805C980E22B6956FA7BCA5010C5EBAC9584B555AAE8DE33FD224509203E7A4D14162586BC4604E432723EF9AAA23ECC40EB640211FB68407DAAB91CDC2B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,.....................s.......}.....U..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-left-alt-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):91
                                                                                                                                                                                                                          Entropy (8bit):4.6815792432458885
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cs4Sudf7l/Fzl7/lGvA92ROZTBlen:N4Sudf7l/BlLBZun
                                                                                                                                                                                                                          MD5:D844F759AC19C6AE82F6C7EDBEBC10D5
                                                                                                                                                                                                                          SHA1:DB66D46CED3284A650302B4ED1A4C7BBB1366D17
                                                                                                                                                                                                                          SHA-256:1F7E81BBC91A5C59DE66CF4F25DD8C224545C5814C4C861649F5C0E321AEEE5A
                                                                                                                                                                                                                          SHA-512:292F1967F6068686EFF1FF610347E6797AB84DFA19BA15706FCB283AED0676789E5FF952823FA7354B713BC2385E3C16416B6E536F6DD0E3E97C6703A8356F85
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......4434448879:8:;9.........!.......,.......... H...0J%............I~....f.t.$.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-left-alt-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.639229361620968
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cs+Nctlrll7/lcQ81/bH7en:Na0lrllSQ81/bH7e
                                                                                                                                                                                                                          MD5:BE8A6F4AB5C47BE86EB90E75BDBA5401
                                                                                                                                                                                                                          SHA1:0C553C375B28FBEBEB3D32D189E880F6B0D32016
                                                                                                                                                                                                                          SHA-256:1BC064D4A39FC4871EA9C7FA741306A5C88D4301A77AB31C9165F70DEBB07D74
                                                                                                                                                                                                                          SHA-512:A0300C5E25CF90D29E2B4863EA6CE1AE174438DFE6FEA39CA66F53E348B1F0624B24CF9D34C416B5FE9337AFF833012F8466FC3641B82DB54E73FC07BA5C4850
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......8979:8:;9...!.......,...................@.Z..ms.I..Y......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-left-alt.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.721421142442887
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cs+/sD/9ll7/lcQ81/bH7en:NbDlllSQ81/bH7e
                                                                                                                                                                                                                          MD5:769BCB589F74AFB060504C92EA172FF7
                                                                                                                                                                                                                          SHA1:73CAE73688E0A30C40766A7B89568A40EC1C6FBE
                                                                                                                                                                                                                          SHA-256:67D5066219C7C12E9ECFF9E694F15AD35A1E2B2FCD2D1F1D6004230C362A410C
                                                                                                                                                                                                                          SHA-512:8C0CEBDEBFCC0F52670AC67D4D38A5459CD52A2EF423515C84B151E11B085ADD09DDD8BED1B8443F6648A495496E220CD3AB85AA797D66997FAA42A0A9948174
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......565887:;9...!.......,...................@.Z..ms.I..Y......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-left-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.6940238821689135
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cs+Fcfd7/lrll7/lcQ81/bH7en:NZ7/lrllSQ81/bH7e
                                                                                                                                                                                                                          MD5:4BDE9798936D9834C822DAD54BE5B45B
                                                                                                                                                                                                                          SHA1:55FFC797309F456D267050DD4C02A52332C5760B
                                                                                                                                                                                                                          SHA-256:84FA288D116601C1AE41AA7D002E00BE58F6C8F4AB0A4A00333A56DC55C1CE56
                                                                                                                                                                                                                          SHA-512:75A5CE3F931454A42876244EC7298AE48D2340F58008C2C787CC9585A6E8DB1763EC992435B252D786931E03C6F18CC36DD0E3ABF136F61A3B657130142AEBF2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......7769:8:;9...!.......,...................@.Z..ms.I..Y......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-left.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.935530113088117
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cs+nhtEchtB/liMs3FPE:N2ht1ret3FPE
                                                                                                                                                                                                                          MD5:E1803EBDE16B15B7DC15381A9D7461F3
                                                                                                                                                                                                                          SHA1:BC6FE45BFC5CBCA3ED06435C9F0A489E80B29B3E
                                                                                                                                                                                                                          SHA-256:63E4EAF658781F407E0C78379E0767CDFA8D56CD0EB693ADC6D60EB962652CE3
                                                                                                                                                                                                                          SHA-512:422236FD6F91E411BEFEFA09E262E899D6B740FF4E937B4F837BB26421A51E33A66A26D44D5997447A891CE8F99991258E5F8CE7DB7BE51B20AD124B6C952EDC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......3337769:8:;9!.......,...................@HZ..ms.Y.&..g...n..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-right-alt-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):89
                                                                                                                                                                                                                          Entropy (8bit):4.578647777542142
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CskfSs7l/Fzl7/lelF+/Prz5LHsE:NESs7l/Blb/v5gE
                                                                                                                                                                                                                          MD5:389E46FF4170FCAFAC5CD5D3C78B28EF
                                                                                                                                                                                                                          SHA1:EF47D1BF1508F712E4C01DFF6C05AE3227D788F6
                                                                                                                                                                                                                          SHA-256:A72C7BDA59AA11BF14C67B8D55617FC08D1799C22BD58153EAC7C91645998A8A
                                                                                                                                                                                                                          SHA-512:BCDE7E5E8FAE94C6EBAD2D47F39D03842E4E6BEC90FC7D2EFDFC90BDBDA0D3ADCF9C65B92B1C5F035638D710DBE40BEA962A3D870A2E77E0445746D918FAC010
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......4437878879:8:;9.........!.......,...........H...0. ..U......F"Fn.+4.],...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-right-alt-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):74
                                                                                                                                                                                                                          Entropy (8bit):4.687181368872384
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cs+Ncg1wB/lDl8XAUhSe:NaxiGXA4Se
                                                                                                                                                                                                                          MD5:495B71F8C8D30A3ED7F63F4ECA4BAD6C
                                                                                                                                                                                                                          SHA1:C08FB3289CC12ABE957CF6E976655798BF16C805
                                                                                                                                                                                                                          SHA-256:48A33EDFDE46582E3A8860624F15B381B880A877B4A9872613AF55207D605FA4
                                                                                                                                                                                                                          SHA-512:0F88D4B72522F33EF8B462405D8769E24117A38FB1C9470820F13833B91C8C1EA5DF10437761C426B64D8373532F5FC330860C4C361FDB7CD18C98D862A16B19
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......8979:89:9:;9!.......,....................Y..q..U[ve.9...6..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-right-alt.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.838928613116962
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cs+/u/ZB/lixU9vve:NZ/ZexUlve
                                                                                                                                                                                                                          MD5:82F8B97F478917B0874CE5F8420A2ADD
                                                                                                                                                                                                                          SHA1:54E5DEBD6DEB534437961F6DC3D3E8CC11C743B0
                                                                                                                                                                                                                          SHA-256:C403A1FFE5729ADCCFB4F2FAC9A5AFE1DAC660FC4E600BAC82782893BE64CE70
                                                                                                                                                                                                                          SHA-512:9020795339E219CB3B3F01541EC82076890CF5221D152AF15FC2D698EE35669409E7DF64D73FD279D430BED6B2F2A5B3E26AF718D8438C2064F7E5CC932CAE86
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......565887897:;9!.......,....................Y..q....%.ewFT.Y..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-right-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.82886344642145
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cs+FdjSAchtB/lix8O4Tni:NajS5rex8O4e
                                                                                                                                                                                                                          MD5:9D687F9EC87684CDC0EA6C5A0A4BC795
                                                                                                                                                                                                                          SHA1:AF1A55617FED9B00D10B1713737F44371A00EDF9
                                                                                                                                                                                                                          SHA-256:57C1EE569E1C3767F1089E251E06BD25EB03648CE575A310E4FD70C4208836CD
                                                                                                                                                                                                                          SHA-512:F87D01E31FB29A48EE46CC78851C7E79A4C988E1B62A95E27A3AABD728D9164959FA78E4ED764EE75CC32609697687DF43AFF6148A7F19FF3BDE6DEA38C7E602
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......7768979:8:;9!.......,....................Y..q..Q.%.%x6B.m..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-right-selected.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):92
                                                                                                                                                                                                                          Entropy (8bit):5.260296763016203
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cs1QcZWGd5lxl7/lJfJGFZZ20rfcE:NloGPlrfIFnRTcE
                                                                                                                                                                                                                          MD5:149C0534C030C37C32C659DBA654DEDE
                                                                                                                                                                                                                          SHA1:EC38007C952FCCF85B5675B700AB8DDC273D9913
                                                                                                                                                                                                                          SHA-256:C5566A3051EC7FD11FF352747E4A9FAECEF2A98B667050CC037A6A7A564BD66D
                                                                                                                                                                                                                          SHA-512:BC22AEEB5C40FAEEC081501CF4D2784CABEA64148C34E22656E47BF2D9670FE021D1846AB9B0F3A5574789E3B3E7B6DC414BD1015CE67FEB126A31FB64D5F87F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......&28.....................!.......,..........!h...0B.$#.Z......`..x.*..[1ltm/..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-right.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):77
                                                                                                                                                                                                                          Entropy (8bit):4.882781020821024
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cs+nhtEchtB/lpuo37kO5eNEbn:N2ht1rJLkIn
                                                                                                                                                                                                                          MD5:D535DB2556798AFB159257F77C7573AA
                                                                                                                                                                                                                          SHA1:C60DCB2C6524F76458809708E61D7F41E87349E3
                                                                                                                                                                                                                          SHA-256:30B0D23D7EE41E6045287CF2C7F221FB6E49FBA5821F5F271E1CBB2305BCF41A
                                                                                                                                                                                                                          SHA-512:24EE92D09A4A37EEC69F22D71162CE71D35EB0C3ED03D8BCA74AE6C5F86C2CA6D2A6C7B5F01879A3A037AC9438D7D7F92EF50D55856639808F26F91A7F3618E1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......3337769:8:;9!.......,................... .A......".pV..(......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-up-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):82
                                                                                                                                                                                                                          Entropy (8bit):4.844845602309408
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CExXzt1ylHrWX9zQZFq5yv:HxXz3VQvv
                                                                                                                                                                                                                          MD5:DF8AD2FE4AB974BB0DD1458E76C057DB
                                                                                                                                                                                                                          SHA1:961DBC7731E1422C17D5D875AE7AAD90853E643B
                                                                                                                                                                                                                          SHA-256:9B8680474C6A85B0997904DB54DE4B156BD71FBD568BA027497ECB5956E0B7EB
                                                                                                                                                                                                                          SHA-512:5DAD10A695E1E98A9211F53AEC523A0E4EBFD83AD4A9198E1A6D828F30C75D8F3939C35E23EA382D431A05AE15B2229C2C9DFC64F1D16CE3A816A56F471D3E93
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......,..........#..........+....Y..j$.F.......L..U..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-up-pressed.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):82
                                                                                                                                                                                                                          Entropy (8bit):5.022606757574282
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CE+WqB/wl0xlm3uXm1qsdq5yv:HOpjm3Kmc+v
                                                                                                                                                                                                                          MD5:5C826B2067B97596FCEEC16690536E29
                                                                                                                                                                                                                          SHA1:E2E9623CB1E29E39DE9CE5C952A98F688E1DBF41
                                                                                                                                                                                                                          SHA-256:FA04FD62799BC3DA48678E07E356BDD699E85933A0D8E3BB4753A68DBD1B433D
                                                                                                                                                                                                                          SHA-512:0DC948EACEC873DCCE5860212ACF659FB8DCE8C4731952AB4C64D7919B510C1E5A3705418AFD4D2D966FCA3F09D7B05BDD733BA911B4791EF4AC73B85CABB7F8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......,..........#..........+....Y..j$.F.......L..U..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\arrow-up.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):70
                                                                                                                                                                                                                          Entropy (8bit):4.804845549010279
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CE9/ecylaJdwFcUaxllen:H92clJCFZagn
                                                                                                                                                                                                                          MD5:564888A7E3EB3915C43E5C06885B0B9C
                                                                                                                                                                                                                          SHA1:6B956FF0C64814FB6B3CF19E05A352E52B770220
                                                                                                                                                                                                                          SHA-256:0FC545D050F637750E6AA5D82645F0923EADD5594C73125260961226EDAB1D26
                                                                                                                                                                                                                          SHA-512:0F7A0CA03DFEF59649F409B50327D0138EB4C7603CCED4F79AB1DD323E47D7BEAF426679A7A97B8449CBDAA51969EAD4A1036D7741A3C761547DEF3F03CA0AB1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,.....................3. s~}_%......T..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\button-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):192
                                                                                                                                                                                                                          Entropy (8bit):5.9102554067225075
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CMXsNuuuri5111LylCxll0ss8oLV67M0kz2NBAcifZNoq5l42q1le:o8ukkrjCss8O6kzeifHlxCe
                                                                                                                                                                                                                          MD5:D831EDE985CE7457573DA0FEED5B09DE
                                                                                                                                                                                                                          SHA1:C627D05509AFC77F3A1F72E410D7ECBF67A7285B
                                                                                                                                                                                                                          SHA-256:9A82AD1EFFC3EE51F1A1DE4130097815AB5AF3EA4E4555F1BEADC2832667E205
                                                                                                                                                                                                                          SHA-512:3A3A65B07E311B489EC021074E5B9631681ED86F3D5BEF60D5420855171FF04447594FADFF72ECBF00B215D2A8E2250689A88D39F5F79CAC18672C20F77743ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(.(....yyyzzz..........................................!.......,....(.(...m0.I..8..A`(.d)....eA.p..9.xx.....,(\......\..N#4..P..k5..vKGm.:...ggz.F..oa.7..s.......L..|!...............;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\button-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):193
                                                                                                                                                                                                                          Entropy (8bit):5.883799126464574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C2mAs/wF2/tylVrtestHR88XI3Tz6VNvRsTPaP20tFpXo3j7junnInvgnunE:PsymPC88XI3ivKTPE20fpXminInvguE
                                                                                                                                                                                                                          MD5:5E2D1D34539A1A25786797722E0BF23D
                                                                                                                                                                                                                          SHA1:9555CE3B10F3575D68576132F0011E931DD8B25A
                                                                                                                                                                                                                          SHA-256:4DF4742365934921D56C17FFC1C064DE404DBC66E87444055342332B349C9C88
                                                                                                                                                                                                                          SHA-512:7D2D93381046EE17B419F6B39CEA93FA4F978F011BBBA89B1AC0D81A16CB6395AECCF20DBC8CE2C63AC264D8A8B23C43BDE051ACC1E2C8C18E8A8FF6CA33C524
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(.(....................................................!.......,....(.(...n..I..8..9`(.d).Ua.lYPm,.rm.v..z....0&.....$.\2...1*UJ..+..r.%.V.%W.R.S.d'.F.P....:.....m.M..}!...............;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\button-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):80
                                                                                                                                                                                                                          Entropy (8bit):4.970584399762101
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUll7yltxlKuE1C9crVe:h11Hw
                                                                                                                                                                                                                          MD5:550BBF2C4A6139DF5C6C8C378B744B36
                                                                                                                                                                                                                          SHA1:A77EC3099BD811427B8A4994B232F22EF8109D17
                                                                                                                                                                                                                          SHA-256:65B387FA85B9CB128B7EBDD570441CC5581E07B2A1D50CE4D67AA4C55CB48EEF
                                                                                                                                                                                                                          SHA-512:5BD09A8B4360A2A229B88A8ECB846C26BFD34EF796888988BDD43386B646A5E5E065C55141868AACA46FF4EDC1B9C061D2D39BFCB4432D43CE59235A4D659C99
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(.(..........!.......,....(.(...'................H........L......#..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\button-unshade-prelight.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):95
                                                                                                                                                                                                                          Entropy (8bit):4.787110078649091
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEvqZ08+vtylhJgt5KM8JE6J2Ee:HyZFHgtAJEs4
                                                                                                                                                                                                                          MD5:04115F1735A4BE85954F8B5F624F89CC
                                                                                                                                                                                                                          SHA1:322C11A8D73E92A8F0900C0EC102F162D2CE9B7B
                                                                                                                                                                                                                          SHA-256:EC1434FE1076EA104B63E52998A0E43D00EE9413CF1EEC004B9A05FC0BD49892
                                                                                                                                                                                                                          SHA-512:38B7DB7AD01E6C77EE292CD4932F919B4931753845AB450026DF38C783C857CEA627056C920BA9B1DB479F2770713089AA4A8990B99429C14A90F361E9319A7C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......,..........$H...0.I..8..;.A(....A..jv...xtm.x....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\button-unshade-pressed.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):95
                                                                                                                                                                                                                          Entropy (8bit):4.923729686663435
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEv7T5iLE19ylhJgt5KMr/zSEe:H5iLEigtvzM
                                                                                                                                                                                                                          MD5:D5705F6FA7A1126CECD399177C85BE34
                                                                                                                                                                                                                          SHA1:489EFCFC5DD8E7D302BC84513A863CD5B3C796D9
                                                                                                                                                                                                                          SHA-256:80ECAE2C175A50CACDC002E4825A479DD24A9FCD09F67CC45B039C1C936EFC48
                                                                                                                                                                                                                          SHA-512:7F0635C1B3FE7400423517D92D8AA2E1718319587DABB10D1BFAFCFA279B7608A8E87F26B15777302A4D18489BA2EB7A7C77FC2D328DFDCA8D0E12D2B1AD7919
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.........m..n..o..............!.......,..........$H...0.I..8..;.@(....@..jv.. xtm.x....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\button-unshade.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):70
                                                                                                                                                                                                                          Entropy (8bit):4.708347156122229
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CE9/ecylaJd1chX:H92clJkhX
                                                                                                                                                                                                                          MD5:F0F5BE8DC7B2E37DB5646CC89FB9B595
                                                                                                                                                                                                                          SHA1:CB4565623C5F3EAB30CDA220C0E853F4C9776131
                                                                                                                                                                                                                          SHA-256:60F4C75F54C43FDD6FEE30A8C9FB1FC75571B1D8BE4F437777FD25C975A03939
                                                                                                                                                                                                                          SHA-512:4C860805C980E22B6956FA7BCA5010C5EBAC9584B555AAE8DE33FD224509203E7A4D14162586BC4604E432723EF9AAA23ECC40EB640211FB68407DAAB91CDC2B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,.....................s.......}.....U..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\button.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):163
                                                                                                                                                                                                                          Entropy (8bit):6.151629714852719
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C8Wgpd3l7yl7xluRxHcBSBP6XpDPA9IfPA44fbA5XdafHE/ZbVt:uCdNP4DoGfP7/b5t
                                                                                                                                                                                                                          MD5:845A322BA604E1A8CFA3599098B926F1
                                                                                                                                                                                                                          SHA1:93EB6FDC3A8D3071DBB7223537433A24F11F9CB6
                                                                                                                                                                                                                          SHA-256:EF8064A57FD2ABF82D81A8FEA035F8801096EA6E3EFCE8E4E72AB50825B77C4B
                                                                                                                                                                                                                          SHA-512:241C13489421A18F9947DF2D1A7B16AEABB1B29350D977CFE161488833A7AF53988DB3A0FEDF388D565335906CD5F413FE7E39EA4A7B9218C04CD9505E5FBCE2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(.(............................!.......,....(.(...hh...0.I.)8......d'0e..j.n..rL...N..."...y../..*..'.i.R...T..6.J.QL$..>.N.c..2.....].."P...|u.........;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\button_shade_prelight.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):82
                                                                                                                                                                                                                          Entropy (8bit):5.001534329009416
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEOn5twl0xlm3uXTW8uq5yv:HSpjm3Kiv
                                                                                                                                                                                                                          MD5:D3E34C690F66995746532A17E7283A69
                                                                                                                                                                                                                          SHA1:E3E274C3DF7F269C7E9F4FED5ABFBE52E2B3B476
                                                                                                                                                                                                                          SHA-256:CC34AE25AE597D33AAA37BA6BB8C68497D7F033AD7A6BF42F258C53817BFBF5C
                                                                                                                                                                                                                          SHA-512:40BB8D43C53DF48D3790929613C35395E696D0614FFAC2ADD434E72809DB24B30730A4CC9D369517B82BFF94AE76F853F50D9E8D075B82B51D877FC31F28AAA7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......,..........#..........k.9..Y..j$.F.......L..U..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\button_shade_pressed.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):82
                                                                                                                                                                                                                          Entropy (8bit):5.022606757574282
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEBjRB/wl0xlm3uXm1qsdq5yv:HBLpjm3Kmc+v
                                                                                                                                                                                                                          MD5:1C8C8F0545743165453094177AF965FC
                                                                                                                                                                                                                          SHA1:80A5A15D5C8CA1A9551AF21D64B5A563B8B58CBB
                                                                                                                                                                                                                          SHA-256:7A85FEB51384C80154726E9585B5A1576215CEC0F86FE734FFE4B73E9B08D061
                                                                                                                                                                                                                          SHA-512:0E1813ECA67096BF1F9D870954686C45F2F4583D35980B7026C191A19243E3758EE53CBC4433DCE041F9E1363308002481949EFF1F4EFA96B6CC0A6EFBD6416F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......,..........#..........+....Y..j$.F.......L..U..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\check-off-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):147
                                                                                                                                                                                                                          Entropy (8bit):5.33036027309773
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEo2sNuuuri5111LylCxllwAd+oaDtLLM9Yb9LTR1cm5htE:Ho8ukkrj6A8HZLLM9od1cm5I
                                                                                                                                                                                                                          MD5:B1B376295411366BD7F719F8945CDA2B
                                                                                                                                                                                                                          SHA1:BE8A6666612E27C7B626CCD4BB72334FAC1ACA37
                                                                                                                                                                                                                          SHA-256:A39B6FEA2885D74FEF5AFB90D5A1E40B2BB6F387B9990F80347597E7AE6EDC03
                                                                                                                                                                                                                          SHA-512:51A64FBFE003DCA6EE28AC1FBF86961563B8E7BF5AD3EF50136F3F7FED37E73A6A9FA3213B0F9134AC13E92A9EA33C6587F7A472DBD5D68E1A9A7146BDCEC713
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......yyyzzz..........................................!.......,..........@0.I..8[... rT\h~.u....k.2H.....ZP6|.YG.n.I......!P......z....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\check-off-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):147
                                                                                                                                                                                                                          Entropy (8bit):5.1901046658671435
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEPs/wF2/tylVrtQ0rcjM9Yb9LTR1cm5htE:HPsymx3M9od1cm5I
                                                                                                                                                                                                                          MD5:084B6D3BEA7CD91F7B7603578FC8A990
                                                                                                                                                                                                                          SHA1:EFE112E5DFD1E56C9C96C908D3CE0082F9102B3B
                                                                                                                                                                                                                          SHA-256:05BC514E0177E314F76622562AACD3BCACAE0D4A49B8F210E96EAE3F8160CC92
                                                                                                                                                                                                                          SHA-512:F0F66566D3F5D6BB07C388982024D032EAB2EA6CCEB106E8B0EA68A46FF7E5E1B5483BC67D2D79656FEAFD1163F879D5AA9BB025460B2043DFF155867DE28C5B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................!.......,..........@..I..8[s...aTEh..u....k.2H.....ZP6|.YG.n.I......!P......z....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\check-off-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):63
                                                                                                                                                                                                                          Entropy (8bit):4.229541897944033
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CE/7yltxl4U1en:HBU1e
                                                                                                                                                                                                                          MD5:31E364B43CBF9100C40F36F7D8323047
                                                                                                                                                                                                                          SHA1:38F545EB60BFA418B1F3E385CB4B7823F1D3E4A2
                                                                                                                                                                                                                          SHA-256:196EE8DFDEB3C1D86DA8C37D8890D74918967FE2C5FA9F3932BA6F01410CE5D6
                                                                                                                                                                                                                          SHA-512:9718538FB925A6763F0039ED7B9199801391214622F43F1FB12B9E6069EFF8AD1B2B0F91E6ECD042766955383D4E34EA4288C46D68045ED2AB8737C08425D907
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........................H.S..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\check-off.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):118
                                                                                                                                                                                                                          Entropy (8bit):5.6007937621838035
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEvXXXWgpd3l7yl7xlR1Yd9X2Z5TBoJd6p/9uVen:HuCdnd9GZ5TBoJc9oen
                                                                                                                                                                                                                          MD5:289ED96F154411C2006120ADF41B5FA7
                                                                                                                                                                                                                          SHA1:088F273B4EE1750640E876F75F59FD8ACB665304
                                                                                                                                                                                                                          SHA-256:C46D85D674F32DEFCC97ECB1AFECE4C9EF1EF8B922F2E3C1AEEFE0183419D3A6
                                                                                                                                                                                                                          SHA-512:469F682FA013746E90F9713EC3CB5B6D976CE31074AF5AA454618DFA2B4E0EB986B04BFC19B05E962A594A96FD83EA1AD92AB06F3141BA5E7FAF3EF2F5B50D57
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......,..........;h...0:R....6....H...*...g.\.w....?.lv.~..E.X.4.3.dJ.6..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\check-on-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):179
                                                                                                                                                                                                                          Entropy (8bit):6.450113802974723
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEV8tJ/xVtyKDpo8BvzDyljrWYaMjFs919tqAmhC30W5gey/KXqtL2e:HV81VAKDm8lGaMhs919tqZhC3XJyyX05
                                                                                                                                                                                                                          MD5:A0712B3FB6598FBC453144BA74019306
                                                                                                                                                                                                                          SHA1:04F1FA02D4DF6AEEBA003B04679AA7BB2B2B9C07
                                                                                                                                                                                                                          SHA-256:7E27AD5A4794862FC617A5FBAA669B21A07F8996FE957B4CAA2EDBE712F83EB0
                                                                                                                                                                                                                          SHA-512:14F3CE564119EFEF341D04AA682714049B18498C972EE03490049C305D68BB156E65469EC853823E1857C49E47C451154EB5398BACCAADF9FD190B50FE3C3696
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........r}.s~/../../..0..0..0..1..3.................!.......,..........`..I..8[...`.TFh..u....k.2H..cO..4.....->.D.Sl..COq.|B% .o.E=.u....d..J...Z\F!.?.J`pO.........;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\check-on-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178
                                                                                                                                                                                                                          Entropy (8bit):6.244636448772041
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEMH+mhs9JURtfaBhPtt/GlQxldZMjFs9VqXGdOZhCfC00OzK+D+ueLpLe:HMeRJUDghVt/jdZMhs9VqXGsZhCfC00u
                                                                                                                                                                                                                          MD5:DD508FC5721464D1CAC0F6CB3A57637B
                                                                                                                                                                                                                          SHA1:0B54CAD3671647FA672E399A81AFFCEE9F423086
                                                                                                                                                                                                                          SHA-256:61786536AFDE1BD4E17A3C9F1ADF1793189341C96BFD5756D953860A1A2E2CA0
                                                                                                                                                                                                                          SHA-512:998B352E70EF2C025369643853E23245DBBB8C6BD3FD316D6EABC154732AFFFAA74A7BD5D9920A629A9560434B8E3E673CEDE653802B4DAE16B12096889FBBBD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........bo.cp........................w...............!.......,.........._..I..8[...`.TFh..u....k.2H.LcO2.8.....->.D.St..CO..d.n...9.z.....5..R.YR..7\().;.J`0..4......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\check-on-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):63
                                                                                                                                                                                                                          Entropy (8bit):4.229541897944033
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CE/7yltxl4U1en:HBU1e
                                                                                                                                                                                                                          MD5:31E364B43CBF9100C40F36F7D8323047
                                                                                                                                                                                                                          SHA1:38F545EB60BFA418B1F3E385CB4B7823F1D3E4A2
                                                                                                                                                                                                                          SHA-256:196EE8DFDEB3C1D86DA8C37D8890D74918967FE2C5FA9F3932BA6F01410CE5D6
                                                                                                                                                                                                                          SHA-512:9718538FB925A6763F0039ED7B9199801391214622F43F1FB12B9E6069EFF8AD1B2B0F91E6ECD042766955383D4E34EA4288C46D68045ED2AB8737C08425D907
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........................H.S..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\check-on.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):176
                                                                                                                                                                                                                          Entropy (8bit):6.0398345508868285
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CERT09lc3FCq+NaBhPtt/trylJxl/vY8/O4hNnPHM9apbaem0zphLi6zcufXK+DI:HRT09lGF5+NghVt1Gz/O6HM92U0zp/zG
                                                                                                                                                                                                                          MD5:FF44AC11447A12A3D94299A3A977AE62
                                                                                                                                                                                                                          SHA1:3D1DBC34C42BF39D48089A352D5FBC1FD579B1BC
                                                                                                                                                                                                                          SHA-256:3E5F250AA793FA806BA9EF873EBF025479A3A20F407733E80B6F89E7A9D892ED
                                                                                                                                                                                                                          SHA-512:C6A6107A1F23D802A9ABE6E50B7028BC00CC1076DA9244BF69A94C64C66F19CBCFC2E38D588846BC96D09638A9D5F192F885041C4DC47BC25C6F8D11E496FFD0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a............................w........................!.......,..........]..I..8.b...ATDh..u....k.2H..bOr.,.....!>7C.S\..CO1.L.n...9.z.....5..R.YR..7\(..;...........;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\combo-button-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):139
                                                                                                                                                                                                                          Entropy (8bit):5.981195780440577
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CmltcGh/h/F11yl7xlLllm/FHO4kFU2Y/ErBpKXhkGdONpc8e:bhl/FufFUzMYOi
                                                                                                                                                                                                                          MD5:B2F269389D4363E73FC8971965232B70
                                                                                                                                                                                                                          SHA1:7A55D8581E64D96A8C07903C4E4DE37C412FBCCD
                                                                                                                                                                                                                          SHA-256:4DFA614B8190722FF16A6FC63D497804D0458DC2428A717639B69E54CC0934BB
                                                                                                                                                                                                                          SHA-512:707F915F52D2130F6312712FE7E12EEFB9B3ED5FC67819F240C1DACE53F4D2FB9504FA58025743C292893D3AF0B3E448D76FF68FD85DD548CE1D908FA6522780
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..(....yyy.....................!.......,......(...Ph.....I.-d.]..`..HZ.I..h....'M.!..._....2D......\-[M.s6.Uo.\v..u.Ai.5....@d.n'..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\combo-button-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):139
                                                                                                                                                                                                                          Entropy (8bit):5.9578496473626155
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CmlAhCG2/Fyl7xlLllm/FHO4kFU2Y/ErBpKXhkGdONpc8e:+7mV/FufFUzMYOi
                                                                                                                                                                                                                          MD5:CBA768D97C6029DF2B7CAF4461B7E903
                                                                                                                                                                                                                          SHA1:B3139F804A3D6B863DCED37FD41D5003158943DC
                                                                                                                                                                                                                          SHA-256:2823407CE1CD38B53149B29CF4CB8F430CC2ADB8051B3BFF00945B2182613423
                                                                                                                                                                                                                          SHA-512:F9399280EA683D6D14F7A9AE35770A6A548007120A2E3758511CA7AA93CF700A0B7DB139EA2D542C29A950CB14077FDAF7A564231658E7F23D7BA6AE793D7278
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..(............................!.......,......(...Ph.....I.-d.]..`..HZ.I..h....'M.!..._....2D......\-[M.s6.Uo.\v..u.Ai.5....@d.n'..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\combo-button-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67
                                                                                                                                                                                                                          Entropy (8bit):4.512245972397761
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CA/ll7yltxlLllnEMuE1y:N81y
                                                                                                                                                                                                                          MD5:EA7F040C433A0B94B8CA38E49CB22B52
                                                                                                                                                                                                                          SHA1:EA0737F872C759950393CA4F8AA8383081029A38
                                                                                                                                                                                                                          SHA-256:D85DCE020926D83402863768EAF48EED1D312E3146875365E4EFA0324C0E5281
                                                                                                                                                                                                                          SHA-512:A3C9BB2087C560E10C659C2F6FCD98E4A2CEA944D67B0122CA3A0CFF9AC9D172C72B78D9F4359926E9C31AF151E776863C065C0838E3AF2C19D83C1324C58FEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..(..........!.......,......(....................H.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\combo-button.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):139
                                                                                                                                                                                                                          Entropy (8bit):5.9112371716070715
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cml3Wg5jylOrTllmvMYF5vArErBpKXhkGdONp4uB/e:CwrSvMYvYQYOAuw
                                                                                                                                                                                                                          MD5:3AE6E45FAE4B67437991482F88426336
                                                                                                                                                                                                                          SHA1:0C0B0809F98D0C043002C53A7B186885410B11B2
                                                                                                                                                                                                                          SHA-256:84C298623FA70046FE660F15261D65973D516CAF706EB87A4E6B66593283ADDB
                                                                                                                                                                                                                          SHA-512:44704A210555EDBAADE7D2D3BE83F5358FDA63659C9BDE0A4445BB20BDBD7399AAB8DFF1A1E81798387DFC6AE9716D9AFD869E5356C9A5EED727D781BA78E4A4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..(............................!.......,......(...PX.....I.%c.].. ..HZ.I..X....'M.!..._....2D......\-[M.s6.Uo.\v..u.Ai.5.....z..$..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\combo-entry-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):367
                                                                                                                                                                                                                          Entropy (8bit):6.025416678077624
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DU4zKoLfDA4BWgp1Atpl5FZbgiThuvM/04zOm7s24NmoTRkle:D8aA4BWgp1AtpnThgeb7s24dTCE
                                                                                                                                                                                                                          MD5:E492C3C445123B918C93C95662FFBD16
                                                                                                                                                                                                                          SHA1:CB63BBB6A010855CDADA75DE679E6A7FC3785824
                                                                                                                                                                                                                          SHA-256:30BA1967B51884C9A2D32C7D3C25523F22C2562C6DC5A65E9B2D98A22BCBA2B5
                                                                                                                                                                                                                          SHA-512:257DBD6015F652417BE7A323B76F872370086DE2F3F2F17A03EE2CE838D21EEBF7D9B80C27E1BC64D252B3BDFF3D675A48C57FEA76D534FBB969C3556E664717
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..(..&.................................................................................................................................................................................................!.......,......(....@S.D"......`...t:.m*".v..>..w..<.h...&S..1%..N.u.=...M{..~|.....y...u...q...m...i...h...d...c...v.]..........................!...........A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\combo-entry-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):240
                                                                                                                                                                                                                          Entropy (8bit):6.240627789194435
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:cCDO8tLaGttxlyuBGxx6G6/uLd9jra6g+f:/S6LaGttxtG71jjra6g+f
                                                                                                                                                                                                                          MD5:7DB5285C75C8791FCAEEE12E8EC8614B
                                                                                                                                                                                                                          SHA1:829E0DF72847BC6F3C20BFDF3D5EFFC8E453F736
                                                                                                                                                                                                                          SHA-256:6BC70609CA6B693DF5E2D82AA4781E502F2F93020120BF4F1A47713DAFD6B5F3
                                                                                                                                                                                                                          SHA-512:470343DA8E5665E0B2E56DFC78B3DC0003EDA78D1F8AF02AD47A0D439690C9B3213DD80B79A10CD9B3EF7331EF3F77C498226FF201164A9FD59D2F9707133FEC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..(....................................................................................................!.......,......(...m .]di.%fU...p,_S..\1N.....I..../..1..'.%.V..fV.=v._.4:...ej.r...LNN...]_.....eA..S.....................!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\combo-entry.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):252
                                                                                                                                                                                                                          Entropy (8bit):6.2715574382765436
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Camh1fqqk4ctE81+UUFQfTkABGnoS5ttzl7/lLllgc6001bdj/0w16cQ2c24pyII:c1CnR8T7aGttplybbcRd2IJup+m1fn
                                                                                                                                                                                                                          MD5:1F5F09FE9CAF7ACC8716B6F306FE7ABA
                                                                                                                                                                                                                          SHA1:E2E82D3963A4A2ABA4CDE60EA1250E8A41A88426
                                                                                                                                                                                                                          SHA-256:22FF06BFF07B1AA6ABBC3D2F34425E7A5097639C8FF0B510AC0E51F655ECAAFC
                                                                                                                                                                                                                          SHA-512:A7CBE6E5F6EFA531F82DDCF813BA6612E7617E7470C257CF1643EB3F6A60DD01CF7E0FD0EE295CFCA30FE4DFE47B99F1D3EBAC665A17382989DC4C067A67CBF1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..(....................................................................................................!.......,......(...y.eUdi..EM..p,WQC.x...3...D.,Z..c.qP....4..RE.k...v._e.8....+6.>?.Z8W..b<Yo..k..nR~o..:.U...C..W.....................!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\entry-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):441
                                                                                                                                                                                                                          Entropy (8bit):6.593569409688625
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:+wQ8Co2gEgDoE7BlANQ+yeReiupqCfkJpGSg8PPCbx1NvEAW:+OE2l7BiNQwjYqxpGFuYRC
                                                                                                                                                                                                                          MD5:D7E6CBFD5BCD37FDF6B89A689A94F717
                                                                                                                                                                                                                          SHA1:F24C2090376B676ED6E30AF46B94D6474F305E05
                                                                                                                                                                                                                          SHA-256:6C8CD6928F2D8E3104D43FE789443C1B79E5B1BAE2B507CF7026FB65D4071E90
                                                                                                                                                                                                                          SHA-512:5422AC2699943CACDEFC4863E6427F649F134072EB985950762F61775BC66F9DB56CA7270F104C4D7C2DA3E29FB61BE3DB91DBC5519717BB57685B822C4B4574
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(.(..,.................................................................................................................................................................................................!.......,....(.(......pH,..H"i..l4.tJ.B7..$.pV..xL...*NG.....9U.q".>..4.p......d......,..............z.........q...g........e.....b...............................(.,(.....'.&........................!......8`....#B\.....!...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\entry-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):315
                                                                                                                                                                                                                          Entropy (8bit):6.8035621355509965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:IKYlUAUA1vYlxlKAY8HwLy6LTqTdmhAgLDKaL1J1OAsv:IhWAUA1vYHk78QOgyALDKi1J1Q
                                                                                                                                                                                                                          MD5:2598F79300209E2D8EEDB75F5E32C9B3
                                                                                                                                                                                                                          SHA1:3B3C7E7026213B397EEC078E9FDB944FDC010638
                                                                                                                                                                                                                          SHA-256:87A630D20B72AAC781BE57A2038FDCD672F8089CC86E7B6F8F151AC6724C6E0F
                                                                                                                                                                                                                          SHA-512:C845BAC5D9E2ACE6AE61E5059E042D4F29A55D84B768383E23E69C92441BFC688344D6150B427269520725D52ED544944870A91252B460B82C5AD948E1870EF8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(.(....................................................................................................!.......,....(.(.... %.di.h)E..p,...<.DM-....pH.^n...Rl:..F.xZ...#q.6...w,<....N..mw.....^:...?.~M..D..ew.E..?...........~.{.x.u.r.n.j...l.C.d.v..Ak...?...T.....Y.....................................!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\entry.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 10 x 10
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):196
                                                                                                                                                                                                                          Entropy (8bit):5.6014719267242254
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C8PY809eFeBNxmo9LrX7zl7/lX7ekjVUjHnquBgxEXb0rM0Wlen:tPYl9UAvX/l96kSLnJBgCrUn
                                                                                                                                                                                                                          MD5:483F6973B6C62A6DD391CF257B28DD42
                                                                                                                                                                                                                          SHA1:0104A87347A9BB3F981D4BA3805F9B0A1951E948
                                                                                                                                                                                                                          SHA-256:E4A4AD398C73FC2613211EEF8F429CD52CC16A1D885048033A9B7D1228AC6642
                                                                                                                                                                                                                          SHA-512:5CA6F1CAFC4FEEAA35851E7F2446465C771769CBBC80ECEC13AA9A2314165FE4F4E1B2898CFF83C25EBADFE1649B0CEE99EE85DB6E9599914E0B1F598D6112DF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........A`$.d.8.0..ALc]W.0..T4M%...;..D.a.0L...BHx^$.c.!....A..X ..,b....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\notebook-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 36 x 10
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):791
                                                                                                                                                                                                                          Entropy (8bit):4.457195179281824
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:RB8faClATK/QAKlAsNDx0TGXlxDzOOBlxDTCe5/3QHTyYIIWb3gI6olxDfEktlxm:RiRlATIKl7DOKmTpHTybpEo1A7qmN
                                                                                                                                                                                                                          MD5:105217DFAFF079D3A2CA74E4FBEB3A84
                                                                                                                                                                                                                          SHA1:F77B42802D0866DFF8C2E85BA7537A75E94F86F3
                                                                                                                                                                                                                          SHA-256:5B204D5247D427D7D01D996CCD5537B20C86CAB64D76997405261BEAC8FD7C6E
                                                                                                                                                                                                                          SHA-512:D70318DF9152F6AFCA0DD781BE53890180A9C3BE06CB5514E1A05D066A25996E87BE90B9E6DA85EF0FC084C19BF347D1EEACC317322A426DEBFE56E7D780393C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a$..............................!.......!..ICCRGBG1012.....lcms.0..mntrRGB XYZ ............acspAPPL...................................-lcms................................................desc... ...@cprt...`...6wtpt........chad.......,rXYZ........bXYZ........gXYZ........rTRC....... gTRC....... bTRC....... chr.m...4...$dmnd...X...$dmdd...|...$mluc............enUS...$.....G.I.M.P. .b.u.i.l.t.-.i.n. .s.R.G.Bmluc............enUS.........P.u.b.l.i.c. .D.o.m.a.i.n..XYZ ...............-sf32.......B.......%.......................nXYZ ......o...8.....XYZ ......$..........XYZ ......b.........para..........ff......Y.......[chrm..............T|..L.......&g...\mluc............enUS.........G.I.M.Pmluc............enUS.........s.R.G.B.,....$.....*h.....I...Z|_.`(.$!Hd.......L.....+..!..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\notebook.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 38 x 9
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):770
                                                                                                                                                                                                                          Entropy (8bit):4.388967248943471
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:U5TzdfaClATK/QAKlAsNDx0TGXlxDzOOBlxDTCe5/3QHTyYIIWb3gI6olxDfEktB:ozVRlATIKl7DOKmTpHTybpEo1QK
                                                                                                                                                                                                                          MD5:00E8E06F4EF2DBFA11D127D0AE844290
                                                                                                                                                                                                                          SHA1:91A3BB4BED0EAAA21BA2771A6A46376FA35DF88E
                                                                                                                                                                                                                          SHA-256:06CAE7A023B89F156C3167C020BBB43D2DB4722CEC08CEB37ADAC0D5C02D1121
                                                                                                                                                                                                                          SHA-512:C9D192DD36B5508CEAA20AC841C7D763E7B942698B8D88D1001FFDEAF1F5C192825C8EAB96FF162B96DF22067B9EDF9401F37742AF041E9685648C21E92AA26D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a&..................!.......!..ICCRGBG1012.....lcms.0..mntrRGB XYZ ............acspAPPL...................................-lcms................................................desc... ...@cprt...`...6wtpt........chad.......,rXYZ........bXYZ........gXYZ........rTRC....... gTRC....... bTRC....... chr.m...4...$dmnd...X...$dmdd...|...$mluc............enUS...$.....G.I.M.P. .b.u.i.l.t.-.i.n. .s.R.G.Bmluc............enUS.........P.u.b.l.i.c. .D.o.m.a.i.n..XYZ ...............-sf32.......B.......%.......................nXYZ ......o...8.....XYZ ......$..........XYZ ......b.........para..........ff......Y.......[chrm..............T|..L.......&g...\mluc............enUS.........G.I.M.Pmluc............enUS.........s.R.G.B.,....&.....!......G...3....^...!i......p\...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\progress-bar.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 4 x 4
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):45
                                                                                                                                                                                                                          Entropy (8bit):3.0974432989367675
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CMlZfll7/lysgE:tTll8S
                                                                                                                                                                                                                          MD5:66F724D16D2008986C3DD9D5394B596A
                                                                                                                                                                                                                          SHA1:40F1CCD5BD8656861BD664AF606226D1209AF7E2
                                                                                                                                                                                                                          SHA-256:1376F6BD059B3A6C01F437692EDB9CD3E55CC4118160D19B4E9C52C22655A10A
                                                                                                                                                                                                                          SHA-512:F42EFE4AB0B5E206B5866DF457865333633578481B8D8677D241446EE20A2D17545F1B7DBE3A274CF614F0BD39BA4AAF3D8C2F9F8CC13CB3BF510B320A64AFC5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,................;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\progress-bg.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 4 x 4
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):45
                                                                                                                                                                                                                          Entropy (8bit):2.967024860455288
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CMlll7yltxlysgE:ttS
                                                                                                                                                                                                                          MD5:0A764DE0719BBB53D59EA3FF57F5F975
                                                                                                                                                                                                                          SHA1:053F614D3F11A0A8706FE8E207734430560B4296
                                                                                                                                                                                                                          SHA-256:1F74B263100C2AF5D117D3A274EF30A2022FA987CEA22A83F3AADF06C497677A
                                                                                                                                                                                                                          SHA-512:F764B581CA6C47EF7323C733BB6B970088E645EA81E3666796C0E38D16626C636EF3DFE3418478CAD2DC2643A8713AC5A2C875DD2B7DCD37B67F0B9A266CE2D6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,................;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\radio-off-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):341
                                                                                                                                                                                                                          Entropy (8bit):5.481403613863121
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:H3H2xbcvzgdf2B62Hv2hkMOfxjzhYGvtQZbHX62A7XnK4Rn:HX2Fcrgd2B62P2hkMOflIZRwjR
                                                                                                                                                                                                                          MD5:708D221FBF0D5C3B3F910B44F56C0FEE
                                                                                                                                                                                                                          SHA1:0BAD7B2E761E888DB8F71551990CA47EA63B04BC
                                                                                                                                                                                                                          SHA-256:F40299B42B92C5C0D229BAC3DF0AD8A50C6072C61D552A46816F26C6FA3189C8
                                                                                                                                                                                                                          SHA-512:3C35B6D373FE8CCCAB5D50BFA4D3B5DF7CF20A0B92C99C1F8C90420F21E2156C002554A64E4EC3A79051EB5008305A1E4FFA1FA81D445618CA434C2B5F6F9AB7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......qqqrrrtttuuuxxx|||..............................................................................................................................................................................!.....!.,..........r..pH,...Rh.|>....Y.....^'.w.. ...=...l2.(..%..!z.].~.X.D..W.D..V.D.. .E..}E...G...I.v.K..c..SB............A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\radio-off-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):339
                                                                                                                                                                                                                          Entropy (8bit):5.33602238722395
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HyIAUsOcjWW3yPC77UgGWR4+qqsQVTknSNE:HympW3yNgGWq+VVAWE
                                                                                                                                                                                                                          MD5:A4B2011567948BEDBF2E7757CB102487
                                                                                                                                                                                                                          SHA1:160B46E70F5853A235EBF3DA57140073E83D5465
                                                                                                                                                                                                                          SHA-256:66FCFED02EFFDFEFFEB62B32353963FD114ADC9328223D3D40A458E70EE65E11
                                                                                                                                                                                                                          SHA-512:4124BE5312E26567B377611B369D61BCEEEC5396F328388861F9E581EDEAA8AA04C0B18771687B8BEEA52CF4BC3C9BA3D15BF367BF020321F88A1B13BDA27D2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......{{{|||..........................................................................................................................................................................................!..... .,..........p@.pH,...R8.x<....X.V.4..^#.w.q ..#.=...i".../t....w;|~X.D..W.D..V.D....E...F...G.~.I.t.K..d..SB............A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\radio-off-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):63
                                                                                                                                                                                                                          Entropy (8bit):4.229541897944033
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CE/7yltxl4U1en:HBU1e
                                                                                                                                                                                                                          MD5:31E364B43CBF9100C40F36F7D8323047
                                                                                                                                                                                                                          SHA1:38F545EB60BFA418B1F3E385CB4B7823F1D3E4A2
                                                                                                                                                                                                                          SHA-256:196EE8DFDEB3C1D86DA8C37D8890D74918967FE2C5FA9F3932BA6F01410CE5D6
                                                                                                                                                                                                                          SHA-512:9718538FB925A6763F0039ED7B9199801391214622F43F1FB12B9E6069EFF8AD1B2B0F91E6ECD042766955383D4E34EA4288C46D68045ED2AB8737C08425D907
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........................H.S..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\radio-off.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):227
                                                                                                                                                                                                                          Entropy (8bit):5.792907275917992
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEhj219nC7fU/R+UU4XRW3RFQtylxrtukmPPj44cd8Kqth2r6G0AZgO9RM9WBt/z:Hk19CuA4BW3YkmPrId8h6Xz1L/z
                                                                                                                                                                                                                          MD5:BE24AAE442AC3DC36E2E13754ED72854
                                                                                                                                                                                                                          SHA1:C7EDAFCEC90E0DD7965C059B772C790BEB9116BD
                                                                                                                                                                                                                          SHA-256:9AF8CAF1A811E2F6FAE4FBAB35E482CC733AB9F5A75A9579FDE79079CE42DFAB
                                                                                                                                                                                                                          SHA-512:A0460BC05E3A60FB2F6BBAAA3647D4513996BDA61B58ED021D3AC0F6A529D304B03E9EFCFCA587AE2C1EEDD07BEEC65D882EB1751617A6C7E2262731996151AE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........` %.di.h..J$I....d.v4.x....o8)....9|..I..:4..T..T..t..7GZ.o...l......}.Q./ ...W.D.3$..........!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\radio-on-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):367
                                                                                                                                                                                                                          Entropy (8bit):6.691420737827592
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HCiibUSaySrPbKPWsT/hcyUpQazhjcs9NlBE7NHbGzAKocqeNBYCkE:HCAyMOusT/hcyCQazhosvTIN7nzcIC/
                                                                                                                                                                                                                          MD5:F0EF29C4EDD9813B3A79C4A8C892ED13
                                                                                                                                                                                                                          SHA1:16464AADFE86A1CCB371B3D51F6924DF558FAEF3
                                                                                                                                                                                                                          SHA-256:792C979F234C7B4071227005761C8CAD4D66D3F6D97FA386B236460884731C29
                                                                                                                                                                                                                          SHA-512:51306B94FD6AD7C4229FCF9FCDF5ABFCD1EDB106C99DAE87D358C385A0CB27D2A40FEE8B437796D567344EBCE1AB48390A2D0D561417F3F977A6F35EEA48DA64
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....2..lx.my.pz.q{.r..t..|..}.!..!.."..#..$..$..'..)..(..(..)..*..*..*..*..,...../......../../../..0..0..0..0..0..0..1..2..2..2..3..8..............................................................!.....3.,.............pH,...Rx..P..HJY.....^-I.w.. ..#.=...lr.H.Z..K..?^,2.2,^.D'^0.21^'.^/..^%D...+^.D.v,/z|].D.qc.E..X.F..W.G...I...K..d..SB...&&.......A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\radio-on-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):366
                                                                                                                                                                                                                          Entropy (8bit):5.84030908638099
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HjFnMJ8YcE9gjv23oloENXgAlys4dn6cjsBU7c69hN7qNQXzxVM:HJ3Yz823ol9XgXs4dn4ODN7qNMzxS
                                                                                                                                                                                                                          MD5:D0DD22E4BF4801B41440301FB4913127
                                                                                                                                                                                                                          SHA1:B3C7AA0D757B45AF80E08349BBBDAEB2AF0BAFC8
                                                                                                                                                                                                                          SHA-256:B36925CEB0823E651D3F960D1AAF0BBC13A591CF98E9D9A65443AEEB6DEC4A52
                                                                                                                                                                                                                          SHA-512:4F3C512E0D66F009CA19D0C6EA96CA31B186753C78D0C4F3026092A64433CDF0A9D3D4586A9F21F22D640316A19526718AE3B38DE640118DC490286352F7456B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....-..\i.^k.`l.am.cp.es.ly.mz.....................................................................................................................................................................!.......,...........@.pH,...RX.F...!Y.V.T..^'I.wLz ..#.=...i".[B.T..7B.xO-.-'^.D"^+.-,^".^*.)^!D...&^.D.^%'*xz].D.pc.E..X.F..W.G...I...K..d..SB... .......A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\radio-on-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):63
                                                                                                                                                                                                                          Entropy (8bit):4.229541897944033
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CE/7yltxl4U1en:HBU1e
                                                                                                                                                                                                                          MD5:31E364B43CBF9100C40F36F7D8323047
                                                                                                                                                                                                                          SHA1:38F545EB60BFA418B1F3E385CB4B7823F1D3E4A2
                                                                                                                                                                                                                          SHA-256:196EE8DFDEB3C1D86DA8C37D8890D74918967FE2C5FA9F3932BA6F01410CE5D6
                                                                                                                                                                                                                          SHA-512:9718538FB925A6763F0039ED7B9199801391214622F43F1FB12B9E6069EFF8AD1B2B0F91E6ECD042766955383D4E34EA4288C46D68045ED2AB8737C08425D907
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........................H.S..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\radio-on.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):356
                                                                                                                                                                                                                          Entropy (8bit):5.27305524977306
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:H9Vl5tzghYAENXhNuG2ht6vod8uybb7PxGqT2CgFJB:H9VJz3XhghtUoUbbbxGqSCgt
                                                                                                                                                                                                                          MD5:5FEE2CE7DD79FB6FD2B9C129C5E24E50
                                                                                                                                                                                                                          SHA1:085395EBD8868F670CAB1276522ECF992F93E55F
                                                                                                                                                                                                                          SHA-256:8D0FEDEB1EF73C655E281E8E910589C8C87D32BFDBC59BDDEC73FABA270080D9
                                                                                                                                                                                                                          SHA-512:D1A6DBBB75FD5F012BAF916D32BC115A27C8A0F611198E5E44706B66D92436751D08E69BFB3842805BAA032B42C43EF49D5F49CC7F2BF5591B5EB1891791AB38
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a....................................................................................................................................................................................................!..... .,...........@.pH,...R.T*..8.X.V....^.I.wl1 ..#.=...i..{.t8...<tx3....^.DU]....^..^....D....^.D.t..xz].EpcF..W.o.VH...I...K.d.SD..........A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scale-horiz-bg-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67
                                                                                                                                                                                                                          Entropy (8bit):4.512245972397761
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CgX7yltxlpuE1y:G1y
                                                                                                                                                                                                                          MD5:D0DC762FF250D0A4D3561BA4107B94A2
                                                                                                                                                                                                                          SHA1:E4E6E8E1247E46B5A0CB3BA1F8740DEF39B5FECD
                                                                                                                                                                                                                          SHA-256:310A327C538BCE3E994DFBF4F2D75D5C46FDEF6659DC68C753CFE253FA0DF6DD
                                                                                                                                                                                                                          SHA-512:52F50BB94D9994D0A4631115D67C7B76FF8A03EB233E1DA0AD2DB8D75EBF48EB536B45EBAB9817784DEFA6C5E6942E60CCB5D0F828F44FEA1C4E97299CBFD138
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(............!.......,....(......................H.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scale-horiz-bg.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67
                                                                                                                                                                                                                          Entropy (8bit):4.512245972397761
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CgX7yltxlpuE1y:G1y
                                                                                                                                                                                                                          MD5:D0DC762FF250D0A4D3561BA4107B94A2
                                                                                                                                                                                                                          SHA1:E4E6E8E1247E46B5A0CB3BA1F8740DEF39B5FECD
                                                                                                                                                                                                                          SHA-256:310A327C538BCE3E994DFBF4F2D75D5C46FDEF6659DC68C753CFE253FA0DF6DD
                                                                                                                                                                                                                          SHA-512:52F50BB94D9994D0A4631115D67C7B76FF8A03EB233E1DA0AD2DB8D75EBF48EB536B45EBAB9817784DEFA6C5E6942E60CCB5D0F828F44FEA1C4E97299CBFD138
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(............!.......,....(......................H.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scale-slider-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):116
                                                                                                                                                                                                                          Entropy (8bit):5.503087737791811
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CLMMt0MT7SQ/GloJdlt1K9xi9uNwV5WF7+lVNa9rUECn:ENtZzJvGez6FHCn
                                                                                                                                                                                                                          MD5:CE579E1D5B4CDE946E413BAC3BA55718
                                                                                                                                                                                                                          SHA1:DD762A3FEF2007EAC106CA54CBF3687DFC8D0A94
                                                                                                                                                                                                                          SHA-256:E3C29A48CD558EB5A7B9D7E7DEB6F0D59ABDCCA3A44A155F3646F05C28A0E1D9
                                                                                                                                                                                                                          SHA-512:6168A3AA3800FDEA71FCF70FCF188F11F368FBB1F7E877009F46B06EE43D9B7F16C3D98691E46420CC1351AEB133895FD595410122CDDF4554D90EAC3977047D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........................!.......,..........9x..E..F...T...^X0ah..t...z...rm.@pC.s?`.T.P..............;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scale-slider-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):116
                                                                                                                                                                                                                          Entropy (8bit):5.503087737791811
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CLMMt0MT7SQ/GloJdlt1K9xi9uNwV5WF7+lVNa9rUECn:ENtZzJvGez6FHCn
                                                                                                                                                                                                                          MD5:CE579E1D5B4CDE946E413BAC3BA55718
                                                                                                                                                                                                                          SHA1:DD762A3FEF2007EAC106CA54CBF3687DFC8D0A94
                                                                                                                                                                                                                          SHA-256:E3C29A48CD558EB5A7B9D7E7DEB6F0D59ABDCCA3A44A155F3646F05C28A0E1D9
                                                                                                                                                                                                                          SHA-512:6168A3AA3800FDEA71FCF70FCF188F11F368FBB1F7E877009F46B06EE43D9B7F16C3D98691E46420CC1351AEB133895FD595410122CDDF4554D90EAC3977047D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........................!.......,..........9x..E..F...T...^X0ah..t...z...rm.@pC.s?`.T.P..............;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scale-slider-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):146
                                                                                                                                                                                                                          Entropy (8bit):5.218140271114418
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C30PLS46XWl7ylCxllNleKYsl0mZMck3Bth2ggkIwJe:jDS46mrjkYl0UQ3Bth2g1ZQ
                                                                                                                                                                                                                          MD5:5B53AABD847CCAA8AD8B92700255FA08
                                                                                                                                                                                                                          SHA1:DA2A0ACF76278425F7B434A7097F6E8B1DFE3498
                                                                                                                                                                                                                          SHA-256:3C2FC2FE35592A25FB4AC450663D16FBB8676A7C7B31D8CD44680B9FC0835E4A
                                                                                                                                                                                                                          SHA-512:4D7596CFC97808682BDAE771D767F3AF1F04AD425376068963C8F5DB4CD8B4C342AEA478C646B044A8F5F5B21DFE4C2AF793B4E13B8F300AACFBE2E6CDF6364D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..............................................!.......,..........?0.I..8K@:9..].!$9\i+Xm[q1.P.<.A.........0h)...A.....H..z3..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scale-slider.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):146
                                                                                                                                                                                                                          Entropy (8bit):5.218140271114418
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C30PLS46XWl7ylCxllNleKYsl0mZMck3Bth2ggkIwJe:jDS46mrjkYl0UQ3Bth2g1ZQ
                                                                                                                                                                                                                          MD5:5B53AABD847CCAA8AD8B92700255FA08
                                                                                                                                                                                                                          SHA1:DA2A0ACF76278425F7B434A7097F6E8B1DFE3498
                                                                                                                                                                                                                          SHA-256:3C2FC2FE35592A25FB4AC450663D16FBB8676A7C7B31D8CD44680B9FC0835E4A
                                                                                                                                                                                                                          SHA-512:4D7596CFC97808682BDAE771D767F3AF1F04AD425376068963C8F5DB4CD8B4C342AEA478C646B044A8F5F5B21DFE4C2AF793B4E13B8F300AACFBE2E6CDF6364D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..............................................!.......,..........?0.I..8K@:9..].!$9\i+Xm[q1.P.<.A.........0h)...A.....H..z3..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scale-vert-bg-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67
                                                                                                                                                                                                                          Entropy (8bit):4.512245972397761
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CA/ll7yltxlLllnEMuE1y:N81y
                                                                                                                                                                                                                          MD5:EA7F040C433A0B94B8CA38E49CB22B52
                                                                                                                                                                                                                          SHA1:EA0737F872C759950393CA4F8AA8383081029A38
                                                                                                                                                                                                                          SHA-256:D85DCE020926D83402863768EAF48EED1D312E3146875365E4EFA0324C0E5281
                                                                                                                                                                                                                          SHA-512:A3C9BB2087C560E10C659C2F6FCD98E4A2CEA944D67B0122CA3A0CFF9AC9D172C72B78D9F4359926E9C31AF151E776863C065C0838E3AF2C19D83C1324C58FEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..(..........!.......,......(....................H.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scale-vert-bg.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67
                                                                                                                                                                                                                          Entropy (8bit):4.512245972397761
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CA/ll7yltxlLllnEMuE1y:N81y
                                                                                                                                                                                                                          MD5:EA7F040C433A0B94B8CA38E49CB22B52
                                                                                                                                                                                                                          SHA1:EA0737F872C759950393CA4F8AA8383081029A38
                                                                                                                                                                                                                          SHA-256:D85DCE020926D83402863768EAF48EED1D312E3146875365E4EFA0324C0E5281
                                                                                                                                                                                                                          SHA-512:A3C9BB2087C560E10C659C2F6FCD98E4A2CEA944D67B0122CA3A0CFF9AC9D172C72B78D9F4359926E9C31AF151E776863C065C0838E3AF2C19D83C1324C58FEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..(..........!.......,......(....................H.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scroll-horiz-bg-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 17
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.397416845103709
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CNPStwlaJenm0Zj1cE:6aJ4m0Z1H
                                                                                                                                                                                                                          MD5:E43F54F22B312916F66BEBC1941D0ED8
                                                                                                                                                                                                                          SHA1:388E8BC7EBECDB0CBC31C5AB9970C44506C2178F
                                                                                                                                                                                                                          SHA-256:3F1CD32D46FF8342895ECDACB19478EF316E66DBD91F408F07A866B207036349
                                                                                                                                                                                                                          SHA-512:F7A3CAEB4DE37AA3F69197E93E3107A29EBF4E280F9C7670825C44D783A5F9F0AC45C1E0A704A6309A4242FF73BC2861504684C6CD446FC5837C50F16595D634
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,.............y............V..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scroll-horiz-bg.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 17
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.397416845103709
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CNPStwlaJenm0Zj1cE:6aJ4m0Z1H
                                                                                                                                                                                                                          MD5:E43F54F22B312916F66BEBC1941D0ED8
                                                                                                                                                                                                                          SHA1:388E8BC7EBECDB0CBC31C5AB9970C44506C2178F
                                                                                                                                                                                                                          SHA-256:3F1CD32D46FF8342895ECDACB19478EF316E66DBD91F408F07A866B207036349
                                                                                                                                                                                                                          SHA-512:F7A3CAEB4DE37AA3F69197E93E3107A29EBF4E280F9C7670825C44D783A5F9F0AC45C1E0A704A6309A4242FF73BC2861504684C6CD446FC5837C50F16595D634
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,.............y............V..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scroll-horiz-slider-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 17
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):68
                                                                                                                                                                                                                          Entropy (8bit):4.5545412842157225
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CNPtl7ylaJen+K+WLL6wgPgE:6hJ4+K+WLOwgj
                                                                                                                                                                                                                          MD5:111245E92C0AA8C9DD9F69D2EE01BD9D
                                                                                                                                                                                                                          SHA1:98D1B136F14E8CFB2240E743B8E93A1343BE48BF
                                                                                                                                                                                                                          SHA-256:195D8B40E573B1A6C2BCBF932A34AB80D36E8C669B6A9F67F8837C53976FBBCB
                                                                                                                                                                                                                          SHA-512:84A6D092A64462BA1EFF26829BE92608BB7568C638B6F9934E3F8996D9EFB266567EBDF94A1E8F3B03DF5D9BDC01669FE5122A7ECC8602AD559AF36F58A0DFB0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,.................c....A.q.}T(n..I....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scroll-horiz-slider-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 17
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):68
                                                                                                                                                                                                                          Entropy (8bit):4.525129519509839
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CNPtl7ylaJen+KEC+ewXr:6hJ4+Ke9b
                                                                                                                                                                                                                          MD5:7CFAB82FE531B09472B766D6539A2D42
                                                                                                                                                                                                                          SHA1:5C67443BA47A6454CCAB05FA29BC501D2DE89614
                                                                                                                                                                                                                          SHA-256:586D3DF80F3B5C32565915E1D9A887D4F346BF4638DB835BC4A717C76D5ABE49
                                                                                                                                                                                                                          SHA-512:06B89180515701EDE97B7790E305B07EB4006A8EF03BAC446C2393CE13C50EAC384115DF8B87C406F44927EBF47B0DAEE79854B420AFD49AD7177234EB64885A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,......................m.u.|`.9.5J..J..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scroll-horiz-slider-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 17
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):56
                                                                                                                                                                                                                          Entropy (8bit):3.948292500450097
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CNPtl7yltxlEna3u5En:6ZaR
                                                                                                                                                                                                                          MD5:70346EB5FEBF51DE0E4C0564100DC421
                                                                                                                                                                                                                          SHA1:AEDAFAA9DFF93BB1B2C3E121B1D6A7B83F12FCD4
                                                                                                                                                                                                                          SHA-256:39D8B6DD1081577D59FC76C4FA769863E5FD3880D000EB3D9580647B1DE9E2A2
                                                                                                                                                                                                                          SHA-512:AD5249D8F30BFC2EE5F11C19D4B78E3EF142E060C75BC6FDD597A6F16D3B1CB7BD40BD549D6608172A27C05ABBA166F0E7618C9E74110982E74E1CF366162BD0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,.......................\..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scroll-horiz-slider.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 17
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):56
                                                                                                                                                                                                                          Entropy (8bit):3.948292500450097
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CNPtl7yltxlEna3u5En:6ZaR
                                                                                                                                                                                                                          MD5:70346EB5FEBF51DE0E4C0564100DC421
                                                                                                                                                                                                                          SHA1:AEDAFAA9DFF93BB1B2C3E121B1D6A7B83F12FCD4
                                                                                                                                                                                                                          SHA-256:39D8B6DD1081577D59FC76C4FA769863E5FD3880D000EB3D9580647B1DE9E2A2
                                                                                                                                                                                                                          SHA-512:AD5249D8F30BFC2EE5F11C19D4B78E3EF142E060C75BC6FDD597A6F16D3B1CB7BD40BD549D6608172A27C05ABBA166F0E7618C9E74110982E74E1CF366162BD0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,.......................\..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scroll-vert-bg-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 17 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):71
                                                                                                                                                                                                                          Entropy (8bit):4.91293673178461
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C//8twlaJWlZp+D3UMLbn:mQJiuDEg
                                                                                                                                                                                                                          MD5:9A4F56C8E64346F17567314041643DC0
                                                                                                                                                                                                                          SHA1:69355E6B50BDAC17D5313FB240CC002006F81DD3
                                                                                                                                                                                                                          SHA-256:9A1267CC5C64918D012E7C11560FC877C50A84684CA910A22698B6D406F841A2
                                                                                                                                                                                                                          SHA-512:0B01029FAEC99582955817ABB812946B929E4FA3BDE28462CFCAB30AD88C7DDF63B175E04B43C8D1FE352E45B2C506D835085CB0C1E3A2578143EA22209C659D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,..............`...2.....W/...f......&..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scroll-vert-bg.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 17 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):71
                                                                                                                                                                                                                          Entropy (8bit):4.91293673178461
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C//8twlaJWlZp+D3UMLbn:mQJiuDEg
                                                                                                                                                                                                                          MD5:9A4F56C8E64346F17567314041643DC0
                                                                                                                                                                                                                          SHA1:69355E6B50BDAC17D5313FB240CC002006F81DD3
                                                                                                                                                                                                                          SHA-256:9A1267CC5C64918D012E7C11560FC877C50A84684CA910A22698B6D406F841A2
                                                                                                                                                                                                                          SHA-512:0B01029FAEC99582955817ABB812946B929E4FA3BDE28462CFCAB30AD88C7DDF63B175E04B43C8D1FE352E45B2C506D835085CB0C1E3A2578143EA22209C659D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,..............`...2.....W/...f......&..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scroll-vert-slider-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 17 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):70
                                                                                                                                                                                                                          Entropy (8bit):4.584890222516102
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C///l7ylaJWla0bBCkmHC0Wn:mjJiamrB0W
                                                                                                                                                                                                                          MD5:AA849F37AF1D73643204E49F03E03C8F
                                                                                                                                                                                                                          SHA1:744BEF49A529D9517908D0C1D8A7B934806AD87B
                                                                                                                                                                                                                          SHA-256:921BB5436D2C4C4C43163A84E70DB7C3BEA44DE373D0DE82065E083B2B19BFDD
                                                                                                                                                                                                                          SHA-512:4A84689126B2F44DBA95C72118D6A76316335DCB483C770FF2F393433EED6752808960108D713B3FE00BE7927906F403F4BE811F46B01CB1C51FE742CF90466F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,..................pNgm.rs....u".....Q..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scroll-vert-slider-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 17 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):70
                                                                                                                                                                                                                          Entropy (8bit):4.471541231383376
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C///l7ylaJWla03l0D/I9AlJaEn:mjJiaMl0DgQr
                                                                                                                                                                                                                          MD5:44F15DCCF1E5CD11AE4430AB10DD8E60
                                                                                                                                                                                                                          SHA1:8771300499DE0362468E4CF4DCAD444DDBD89A7B
                                                                                                                                                                                                                          SHA-256:CF928776977BFA8ADDE01F89F82153F65921A77DDCAD60CB5EF14BF3AB1E2D25
                                                                                                                                                                                                                          SHA-512:3FCEE5811112580CEC0A91898C9486E259765628496D8F54D87AF8AFD47C1D6D6B8DE2FACC3AE8125E9E002FFC5EB99DBA9281C293035BDBD84126F6DD448076
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...................A../f..}..e.SB!..[..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scroll-vert-slider-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 17 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):56
                                                                                                                                                                                                                          Entropy (8bit):3.948292500450097
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C///l7yltxlMlIdu5En:mNIdR
                                                                                                                                                                                                                          MD5:3E6AB24D81699785804662728AB27C24
                                                                                                                                                                                                                          SHA1:73BA21A20149C3B62AB5D43736188DCB50527AB3
                                                                                                                                                                                                                          SHA-256:83257BB735769F569494FE16E64366831126824E589403F24BB4CC89382F20F6
                                                                                                                                                                                                                          SHA-512:65C930B4EEC769F1FC4D01AA999092865C611999A78821FC2AB93BD54FD3AFD04CB00936ED615A183E941AAEF76539DB6DB3BDACCBA734F6E7ABC13D1D19B22F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,.......................\..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\scroll-vert-slider.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 17 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):56
                                                                                                                                                                                                                          Entropy (8bit):3.948292500450097
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C///l7yltxlMlIdu5En:mNIdR
                                                                                                                                                                                                                          MD5:3E6AB24D81699785804662728AB27C24
                                                                                                                                                                                                                          SHA1:73BA21A20149C3B62AB5D43736188DCB50527AB3
                                                                                                                                                                                                                          SHA-256:83257BB735769F569494FE16E64366831126824E589403F24BB4CC89382F20F6
                                                                                                                                                                                                                          SHA-512:65C930B4EEC769F1FC4D01AA999092865C611999A78821FC2AB93BD54FD3AFD04CB00936ED615A183E941AAEF76539DB6DB3BDACCBA734F6E7ABC13D1D19B22F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,.......................\..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\spin-down-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):103
                                                                                                                                                                                                                          Entropy (8bit):4.901053936238042
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CDGhXtttylhJdlwfFZZNJbLle:oqpNm
                                                                                                                                                                                                                          MD5:394C0818B051CCE28885D6FE2F3C7431
                                                                                                                                                                                                                          SHA1:39AC8BDA73513730A7A234FB290264470C438395
                                                                                                                                                                                                                          SHA-256:80CFCAC0B5EE8322078019C88CB215BE274CA983D83B465350039822E99383CC
                                                                                                                                                                                                                          SHA-512:4D5E15CE6274DF61ED87414C3DD79C3C7F4CA9ABB7C94B6018DC8E7AA43DC2166281EB774223043EA4D2D212089A50B77CC62E5047DFD9F7AE97C0E8863F4AB5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......yyy.....................!.......,..........,8..K.......i.....Gb&....-..q7k.m......p(L..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\spin-down-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):103
                                                                                                                                                                                                                          Entropy (8bit):4.901053936238041
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:ComhCLNl9ylhJdlwfFZZNJbLle:C8wqpNm
                                                                                                                                                                                                                          MD5:5817DE6CA49EE9BFC50C101900FCFDE3
                                                                                                                                                                                                                          SHA1:D7555B9D9251F8A2F3B84FA73F95B805E60205A1
                                                                                                                                                                                                                          SHA-256:76A7432AE53328183DD8FE33E6057E338D2325AE6805BBA877475F99441E679A
                                                                                                                                                                                                                          SHA-512:EFB31E855BAD2E68395CC3160659913701F04CF8145E8D2CF8105DFA0DC520D8BC350F814C78179AFCA411ABBB05054F9F5DBCA2D1864C66DFF430A605C35619
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......,..........,8..K.......i.....Gb&....-..q7k.m......p(L..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\spin-down-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):58
                                                                                                                                                                                                                          Entropy (8bit):4.0285414156444626
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C8t7yltxl3lWduEue:Vd1R
                                                                                                                                                                                                                          MD5:DB48201BB24938FDC1FD37413F2B24B2
                                                                                                                                                                                                                          SHA1:23A18BEAC14AD31CC1461AF1A43A918190029770
                                                                                                                                                                                                                          SHA-256:672B6D565E302BD32CE6AEB674B465B6E43F215333DCF6650FCB9C5D6DEA57F0
                                                                                                                                                                                                                          SHA-512:9A5AADC8F0881DE6DB411262628EC2E104332A244E3FFCE659F737CFAF8AC98020BAE56D7BA24B7F7B9E661E8200E764769800AA924138162EFDE5CFC95E1D00
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........................;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\spin-down.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):88
                                                                                                                                                                                                                          Entropy (8bit):5.16590845688512
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CN2plkl0xl3lu9I/6XNVlle:e2ndjk9I/MW
                                                                                                                                                                                                                          MD5:C3FFC7DB65F3CC5664EBF92F9E2A9FC7
                                                                                                                                                                                                                          SHA1:6C0F4652DF2ED1E5B6BA80E27C1B3C7F38A834E0
                                                                                                                                                                                                                          SHA-256:47627964AB939EC01DC6E14823F616C9946D480223CF359BB1A54134D6AE767B
                                                                                                                                                                                                                          SHA-512:3719CD1442BA770580ED77B67D0B2B89E80D068376331C375D32A128E2392C3DCAC8741D0FF166B63D6A1D65D363F0D263B3E3334356F50DC36F7393BF833E74
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......,..........)..y3...q.ja.w.l %..Yz..r..f.........._..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\spin-up-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):90
                                                                                                                                                                                                                          Entropy (8bit):5.250877090673532
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CxX9Fdyl0xl3ls6EistedenSG7g5:iBjmv2denSGy
                                                                                                                                                                                                                          MD5:EAC70C69FCEECD7B2A8E8DC8A9E283C4
                                                                                                                                                                                                                          SHA1:DB31994A0635E45E6EEBC445870D4A32F5BB6368
                                                                                                                                                                                                                          SHA-256:93EF62AEFA0628251014ED988A9E666A8112FC00F247A49CCD5672B68DC1377B
                                                                                                                                                                                                                          SHA-512:381F3833D67117B53EDB28F0E28073B7DFABE94768A4425630E3C67F76DCF6F85999DC02CABD605AB36D7F554E0399B8068C8A9BEACC2B4B4F0413C6FDDA2C2E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......,..........+....(........\.~}.$.PizC...;.......>..#...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\spin-up-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):90
                                                                                                                                                                                                                          Entropy (8bit):5.214820285142015
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CMG/9kl0xl3ls6EistedenSG7g5:+9djmv2denSGy
                                                                                                                                                                                                                          MD5:603BC064A4605DC7383BF8355454EE43
                                                                                                                                                                                                                          SHA1:78997A518854383700ED91ACA2DF99E929BC5975
                                                                                                                                                                                                                          SHA-256:4381E240166AD33694A93C592DC2A274F42E243F077DCBECBD151456F81817DE
                                                                                                                                                                                                                          SHA-512:FBDA46DF59571C6D9EE97D8211A3FF4374B40EAAED92233CE71F481CBA8609D1248360F83A5D7CC6105E3A64555DE7318E731A7C6C8CD0084D0F79294AFE9ACF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......,..........+....(........\.~}.$.PizC...;.......>..#...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\spin-up-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):58
                                                                                                                                                                                                                          Entropy (8bit):4.0285414156444626
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C8t7yltxl3lWduEue:Vd1R
                                                                                                                                                                                                                          MD5:DB48201BB24938FDC1FD37413F2B24B2
                                                                                                                                                                                                                          SHA1:23A18BEAC14AD31CC1461AF1A43A918190029770
                                                                                                                                                                                                                          SHA-256:672B6D565E302BD32CE6AEB674B465B6E43F215333DCF6650FCB9C5D6DEA57F0
                                                                                                                                                                                                                          SHA-512:9A5AADC8F0881DE6DB411262628EC2E104332A244E3FFCE659F737CFAF8AC98020BAE56D7BA24B7F7B9E661E8200E764769800AA924138162EFDE5CFC95E1D00
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........................;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\spin-up.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):90
                                                                                                                                                                                                                          Entropy (8bit):5.214820285142015
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CJ5glkl0xl3ls6EistedenSG7g5:aMdjmv2denSGy
                                                                                                                                                                                                                          MD5:D071809E01F90C9521B7D50FA4757046
                                                                                                                                                                                                                          SHA1:BA47852BA6BF110185F6E0EA3FD3A7F6609E3931
                                                                                                                                                                                                                          SHA-256:E8A32A0A8C11A1ED4149F9EE5A35EA1E1CD577E5B4C496C4EABFCC11C92293D1
                                                                                                                                                                                                                          SHA-512:0DE2F8348FFD935FF8454F54AAA0625EB32C3D914DFEC2659AC3873D12C03B91BB8AEF633E48A6B7888DB31C274695A41F609C464A7E68036DDC4ADA5557F4A2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......,..........+....(........\.~}.$.PizC...;.......>..#...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\toolbutton-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):80
                                                                                                                                                                                                                          Entropy (8bit):4.970584399762101
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUll7yltxlKuE1C9crVe:h11Hw
                                                                                                                                                                                                                          MD5:550BBF2C4A6139DF5C6C8C378B744B36
                                                                                                                                                                                                                          SHA1:A77EC3099BD811427B8A4994B232F22EF8109D17
                                                                                                                                                                                                                          SHA-256:65B387FA85B9CB128B7EBDD570441CC5581E07B2A1D50CE4D67AA4C55CB48EEF
                                                                                                                                                                                                                          SHA-512:5BD09A8B4360A2A229B88A8ECB846C26BFD34EF796888988BDD43386B646A5E5E065C55141868AACA46FF4EDC1B9C061D2D39BFCB4432D43CE59235A4D659C99
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(.(..........!.......,....(.(...'................H........L......#..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\toolbutton-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):80
                                                                                                                                                                                                                          Entropy (8bit):4.970584399762101
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUll7yltxlKuE1C9crVe:h11Hw
                                                                                                                                                                                                                          MD5:550BBF2C4A6139DF5C6C8C378B744B36
                                                                                                                                                                                                                          SHA1:A77EC3099BD811427B8A4994B232F22EF8109D17
                                                                                                                                                                                                                          SHA-256:65B387FA85B9CB128B7EBDD570441CC5581E07B2A1D50CE4D67AA4C55CB48EEF
                                                                                                                                                                                                                          SHA-512:5BD09A8B4360A2A229B88A8ECB846C26BFD34EF796888988BDD43386B646A5E5E065C55141868AACA46FF4EDC1B9C061D2D39BFCB4432D43CE59235A4D659C99
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(.(..........!.......,....(.(...'................H........L......#..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\toolbutton-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):80
                                                                                                                                                                                                                          Entropy (8bit):4.970584399762101
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUll7yltxlKuE1C9crVe:h11Hw
                                                                                                                                                                                                                          MD5:550BBF2C4A6139DF5C6C8C378B744B36
                                                                                                                                                                                                                          SHA1:A77EC3099BD811427B8A4994B232F22EF8109D17
                                                                                                                                                                                                                          SHA-256:65B387FA85B9CB128B7EBDD570441CC5581E07B2A1D50CE4D67AA4C55CB48EEF
                                                                                                                                                                                                                          SHA-512:5BD09A8B4360A2A229B88A8ECB846C26BFD34EF796888988BDD43386B646A5E5E065C55141868AACA46FF4EDC1B9C061D2D39BFCB4432D43CE59235A4D659C99
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(.(..........!.......,....(.(...'................H........L......#..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\toolbutton.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):80
                                                                                                                                                                                                                          Entropy (8bit):4.970584399762101
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUll7yltxlKuE1C9crVe:h11Hw
                                                                                                                                                                                                                          MD5:550BBF2C4A6139DF5C6C8C378B744B36
                                                                                                                                                                                                                          SHA1:A77EC3099BD811427B8A4994B232F22EF8109D17
                                                                                                                                                                                                                          SHA-256:65B387FA85B9CB128B7EBDD570441CC5581E07B2A1D50CE4D67AA4C55CB48EEF
                                                                                                                                                                                                                          SHA-512:5BD09A8B4360A2A229B88A8ECB846C26BFD34EF796888988BDD43386B646A5E5E065C55141868AACA46FF4EDC1B9C061D2D39BFCB4432D43CE59235A4D659C99
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(.(..........!.......,....(.(...'................H........L......#..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\treeview-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):80
                                                                                                                                                                                                                          Entropy (8bit):4.970584399762101
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUll7yltxlKuE1C9crVe:h11Hw
                                                                                                                                                                                                                          MD5:550BBF2C4A6139DF5C6C8C378B744B36
                                                                                                                                                                                                                          SHA1:A77EC3099BD811427B8A4994B232F22EF8109D17
                                                                                                                                                                                                                          SHA-256:65B387FA85B9CB128B7EBDD570441CC5581E07B2A1D50CE4D67AA4C55CB48EEF
                                                                                                                                                                                                                          SHA-512:5BD09A8B4360A2A229B88A8ECB846C26BFD34EF796888988BDD43386B646A5E5E065C55141868AACA46FF4EDC1B9C061D2D39BFCB4432D43CE59235A4D659C99
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(.(..........!.......,....(.(...'................H........L......#..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\treeview-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):80
                                                                                                                                                                                                                          Entropy (8bit):4.970584399762101
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUll7yltxlKuE1C9crVe:h11Hw
                                                                                                                                                                                                                          MD5:550BBF2C4A6139DF5C6C8C378B744B36
                                                                                                                                                                                                                          SHA1:A77EC3099BD811427B8A4994B232F22EF8109D17
                                                                                                                                                                                                                          SHA-256:65B387FA85B9CB128B7EBDD570441CC5581E07B2A1D50CE4D67AA4C55CB48EEF
                                                                                                                                                                                                                          SHA-512:5BD09A8B4360A2A229B88A8ECB846C26BFD34EF796888988BDD43386B646A5E5E065C55141868AACA46FF4EDC1B9C061D2D39BFCB4432D43CE59235A4D659C99
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(.(..........!.......,....(.(...'................H........L......#..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\treeview-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):80
                                                                                                                                                                                                                          Entropy (8bit):4.970584399762101
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUll7yltxlKuE1C9crVe:h11Hw
                                                                                                                                                                                                                          MD5:550BBF2C4A6139DF5C6C8C378B744B36
                                                                                                                                                                                                                          SHA1:A77EC3099BD811427B8A4994B232F22EF8109D17
                                                                                                                                                                                                                          SHA-256:65B387FA85B9CB128B7EBDD570441CC5581E07B2A1D50CE4D67AA4C55CB48EEF
                                                                                                                                                                                                                          SHA-512:5BD09A8B4360A2A229B88A8ECB846C26BFD34EF796888988BDD43386B646A5E5E065C55141868AACA46FF4EDC1B9C061D2D39BFCB4432D43CE59235A4D659C99
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(.(..........!.......,....(.(...'................H........L......#..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\adapta\adapta\treeview.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 40 x 40
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):80
                                                                                                                                                                                                                          Entropy (8bit):4.970584399762101
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUll7yltxlKuE1C9crVe:h11Hw
                                                                                                                                                                                                                          MD5:550BBF2C4A6139DF5C6C8C378B744B36
                                                                                                                                                                                                                          SHA1:A77EC3099BD811427B8A4994B232F22EF8109D17
                                                                                                                                                                                                                          SHA-256:65B387FA85B9CB128B7EBDD570441CC5581E07B2A1D50CE4D67AA4C55CB48EEF
                                                                                                                                                                                                                          SHA-512:5BD09A8B4360A2A229B88A8ECB846C26BFD34EF796888988BDD43386B646A5E5E065C55141868AACA46FF4EDC1B9C061D2D39BFCB4432D43CE59235A4D659C99
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a(.(..........!.......,....(.(...'................H........L......#..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\LICENSE

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):35147
                                                                                                                                                                                                                          Entropy (8bit):4.573442652974749
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
                                                                                                                                                                                                                          MD5:D32239BCB673463AB874E80D47FAE504
                                                                                                                                                                                                                          SHA1:8624BCDAE55BAEEF00CD11D5DFCFA60F68710A02
                                                                                                                                                                                                                          SHA-256:8CEB4B9EE5ADEDDE47B31E975C1D90C73AD27B6B165A1DCD80C7C545EB65B903
                                                                                                                                                                                                                          SHA-512:7633623B66B5E686BB94DD96A7CDB5A7E5EE00E87004FAB416A5610D59C62BADAF512A2E26E34E2455B7ED6B76690D2CD47464836D7D85D78B51D50F7E933D5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview: GNU GENERAL PUBLIC LICENSE. Version 3, 29 June 2007.. Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed... Preamble.. The GNU General Public License is a free, copyleft license for.software and other kinds of works... The licenses for most software and other practical works are designed.to take away your freedom to share and change the works. By contrast,.the GNU General Public License is intended to guarantee your freedom to.share and change all versions of a program--to make sure it remains free.software for all its users. We, the Free Software Foundation, use the.GNU General Public License for most of our software; it applies also to.any other work released this way by its authors. You can apply it to.your programs, too... When we speak of free software, we are referring to

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13390
                                                                                                                                                                                                                          Entropy (8bit):4.182798283684785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:phC/eL+qSC38SC3u3D3uSC3CBC3NIiSCCltpn/u7zJTIOeGSSQ/gdrSff7d:PC/C+usGziRAtpnm7zSOoSQUyd
                                                                                                                                                                                                                          MD5:FFEDE1B25FFCD9D9EF57FEF7F5950D64
                                                                                                                                                                                                                          SHA1:675C3C67420C2EAC9B7106C8504EA95C268B842D
                                                                                                                                                                                                                          SHA-256:67149D8CDAB6DBD99EFB7395D5E512275586292B80472D93150031E67837A731
                                                                                                                                                                                                                          SHA-512:A22E33258CCC44848586183C4744245E8774C5CBE6F58D49A4E2D7F4B7405A7CFBF595F7785ADD7C7CCCA2C03FD0EC30D8DE8307EEE7B1D9505E68D521D6E635
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Copyright (c) 2015 Sergei Golovan <sgolovan@nes.ru>.# Derived from https://github.com/horst3180/arc-theme/ under the GNU GPLv3.# Thus this is available under GNU GPLv3 also, as described in LICENSE..namespace eval ttk::theme::arc {.. variable colors. array set colors {. -fg "#5c616c". -bg "#f5f6f7". -disabledbg "#fbfcfc". -disabledfg "#a9acb2". -selectbg "#5294e2". -selectfg "#ffffff". -window "#ffffff". -focuscolor "#5c616c". -checklight "#fbfcfc". }.. proc LoadImages {imgdir} {. variable I. foreach file [glob -directory $imgdir *.gif] {. set img [file tail [file rootname $file]]. set I($img) [image create photo -file $file]. }. }.. LoadImages [file join [file dirname [info script]] arc].. ttk::style theme create arc -parent default -settings {. ttk::style configure . \. -backgr

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-down-insens.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 6
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):88
                                                                                                                                                                                                                          Entropy (8bit):4.960887502567321
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CR0elExl0zgNrHHCEOGOLUule:gEIz9LUuE
                                                                                                                                                                                                                          MD5:D850E457D490B26EFA9FE74C3980A16F
                                                                                                                                                                                                                          SHA1:341EB1A7D597B7B6B8EBA5D12BFA342356DB3070
                                                                                                                                                                                                                          SHA-256:13F0B8A21E9E21257FE9BEC8B104721D1B0B04C044D6EED130DB4A40A87D4D81
                                                                                                                                                                                                                          SHA-512:5C45D545BE4BE0D1DDAF267E7E5365D6AA791722E64D0DB3DDF30D57A692A5795798DD75471680881A38E2B717EB8C50E53DE56819CA7B9343944BDBC28EF9BD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......]ak^al\bm...!.......!..ImageMagick.gamma=0.45455.,...................s1...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-down-prelight.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 6
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):105
                                                                                                                                                                                                                          Entropy (8bit):5.18511128731
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CR2W6zDyloE2cNrHHCEOGOLv+mxT:TXJLvPV
                                                                                                                                                                                                                          MD5:A03F4648A545BB10CD1583512186CCF2
                                                                                                                                                                                                                          SHA1:80F59555A53ABD3F727AD3A00598761612520138
                                                                                                                                                                                                                          SHA-256:A55832E842CE98C8A27DFA65EFCB963FA3B830CED3640DFCEB190B617C781B1B
                                                                                                                                                                                                                          SHA-512:18142204D3BF55C5E36E7E5B7237714FF0B44C7CA70A06721E494B552525F49E6410B9B916470D368E16D3D52784CE3A3528CB935993B7F05E7A109F30572A03
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......!..ImageMagick.gamma=0.45455.,...........Hu.@..(H...[. %.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-down-small-insens.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 6
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):85
                                                                                                                                                                                                                          Entropy (8bit):4.841862138862304
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CR0FJ9/lEcyl0zgNrHHCEOGOLz1qF:Jf/lpz9Lz1u
                                                                                                                                                                                                                          MD5:ECFD2BDD0BB9065E7A11EB05132B975B
                                                                                                                                                                                                                          SHA1:4E11DAE8A9AB5A980554BD1FC1F1F5AE88452F36
                                                                                                                                                                                                                          SHA-256:B6B42FF394166A045786DA9F83F597312603D0153D733B097048E9635008CEAF
                                                                                                                                                                                                                          SHA-512:A4C734E6D1CB72F1880C9195B28314EC2B189DACD8F8259C2957210EA3D0A68951BA465EC7A212BC4AEBA7FD796AF97FCAC5457641E446BC775128D71B001DA0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......\bk\al]cl...!.......!..ImageMagick.gamma=0.45455.,..............p.o.L..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-down-small-prelight.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 6
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):105
                                                                                                                                                                                                                          Entropy (8bit):5.219559276125498
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CR2b04ZvtCn1yloE2cNrHHCEOGOLCfXHsliuB2lE:TQ4ZVq1JLCfXkiuB2lE
                                                                                                                                                                                                                          MD5:7D00C4767D3EE8D18D106F8B5A0CB8D1
                                                                                                                                                                                                                          SHA1:DCCECD62CF29E568829CE9A7E90E6C64ABCB468F
                                                                                                                                                                                                                          SHA-256:5F30D259DC1531BD302FAA683531D4C7AA05B26F87183CCAF517F29CF805E4B0
                                                                                                                                                                                                                          SHA-512:006FF593C3DAD7A5C132D13CE5B8FD8749B0BFB2AF56ECC11195DF8B60C5A51DE7107B04D2B0D9BFDFED7C6680C4AC504DC502525BD8A057B8244C0197A41116
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......!..ImageMagick.gamma=0.45455.,...........x.,|.......S....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-down-small.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 6
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):107
                                                                                                                                                                                                                          Entropy (8bit):5.183058362356882
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CRh0aOgJb3EJ44YloE2cNrHHCEOGOL2WVv5xWT:vaOMLEJ44dJL2WVGT
                                                                                                                                                                                                                          MD5:4216611BC695F8F8C420AC4289635422
                                                                                                                                                                                                                          SHA1:F0F1A689EF2572A17A387BBEDB4D990B84A16FF8
                                                                                                                                                                                                                          SHA-256:173E207AD0D387F19A24979D143A6204E74EC3746AB2637A9F7222B25677C58C
                                                                                                                                                                                                                          SHA-512:376D4C51DB41608B910043F1B48F909982D68228FC272B1224D78E22922A413D196FAEC8DB14CA374431BED42A48E7A365A7C7572BFD9EB9E562624D43D77CF6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......\`k\ak]ak[al\`l\al]bm...!.......!..ImageMagick.gamma=0.45455.,...........x.l|B...X..B^(.stK..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-down.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 6
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):134
                                                                                                                                                                                                                          Entropy (8bit):4.693918725866837
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CRqO9YzylVCprNrHHCEOGOLmtX/Cplz/n:AOjkLIXKplz/n
                                                                                                                                                                                                                          MD5:327322EEBE594C23DC1CBAD61820CFD1
                                                                                                                                                                                                                          SHA1:49B7C6CB2F1F5AFACE12C9AAAB679071463CFAAC
                                                                                                                                                                                                                          SHA-256:08E4813B0D4B05AA0A2CE70003DF30CB927182E7C6A5BA03A1753217438634F3
                                                                                                                                                                                                                          SHA-512:BC0EEB2ABF88B93AB71422EF83EF15A0CFAF19F763D33CBC1448DFECD218D87C7C562F2A50E4684CCD5B9B3FDF0DB847E5A3C60BAFF97CBB3E329F367CE9499A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......[ak\`k]ak[`l]`l\al]al\am........................!.......!..ImageMagick.gamma=0.45455.,...........0.D...TZ.*.'T P........;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-left-insens.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 6 x 9
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):100
                                                                                                                                                                                                                          Entropy (8bit):4.711086466968027
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CphFObolVylhE2cNrHHCEOGOL7cDNEn:M0boGRL7pn
                                                                                                                                                                                                                          MD5:2896F1F040742CC05A067C76E0182F9A
                                                                                                                                                                                                                          SHA1:8343E91AD69F8D16A01D6B317887F5D4EEA2992C
                                                                                                                                                                                                                          SHA-256:27A7E638B6DE8E7349D8205AF74CB2E34F4403F9DFF5D0423787472B69409CA3
                                                                                                                                                                                                                          SHA-512:E0673B564C1D2EF27B31EC4C44105F579F1896EFA0B944CA30F2BBFD46F4CCE8CB28F90176CE7E9695D424B1443DFA24B7D0CC5366C2EA6489B76957C265EC1F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......\`k]ak^al\bm............!.......!..ImageMagick.gamma=0.45455.,...........H....1.&.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-left-prelight.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 6 x 9
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):135
                                                                                                                                                                                                                          Entropy (8bit):4.813288016093226
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CpG/k14of3mMylCz0rNrHHCEOGOLpGdVv7nUphRV:m14ImGz0kLpG/wphRV
                                                                                                                                                                                                                          MD5:9AC8DAC7BE4A3FB8B70D9A27AF808EE5
                                                                                                                                                                                                                          SHA1:917B6DBF43495AC499AE08F6035B48B937B0227D
                                                                                                                                                                                                                          SHA-256:DCBD000850BCA570455476C85D26C5D0BA0C92FF7528F20509D28B8AE7C71D27
                                                                                                                                                                                                                          SHA-512:090CCFBC4F9EF9C6A3B3AEB4006AB7AA9CFCC79E02BC10243F6A37858710E1DBCFE8A8683875E83F72151B6FC598A3EFFA529867E7611E13543C7748920D39D4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................!.......!..ImageMagick.gamma=0.45455.,...........0...,..d..1L..M.)..i...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-left.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 6 x 9
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):137
                                                                                                                                                                                                                          Entropy (8bit):4.869365645636171
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CpGKEE3F2zoEotlDylCz0rNrHHCEOGOLno+VrHh03/n:YESNTz0kLnpVaPn
                                                                                                                                                                                                                          MD5:84BF65EF0B076730E457C0302112BC53
                                                                                                                                                                                                                          SHA1:D33D25C3856CA8EAA82F0ECD20D008D0E7DD55D6
                                                                                                                                                                                                                          SHA-256:04395DF52A5AF76BEF34AD68862E523C48097EAB99FDEC541D7286098FC1BB4E
                                                                                                                                                                                                                          SHA-512:5FF240841C57483A199E941E0F65961F871B1E9D7EBD64AF00535CAAE6B6BF8E03DC69EEC3AE9F87027CE144BCF112743F77681F526A8EC0612A9499AC4118EC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......[ak\ak[al\`l]`l\al]al\`m\bm.....................!.......!..ImageMagick.gamma=0.45455.,...........0.d....P.<.T....f"..h.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-right-insens.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 6 x 9
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):102
                                                                                                                                                                                                                          Entropy (8bit):4.754528402498293
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CphFOEx9ylhE2cNrHHCEOGOL5tPjF1an:M0ExARL5tP5k
                                                                                                                                                                                                                          MD5:200E59A39D86D3205FFAA935A3694EF5
                                                                                                                                                                                                                          SHA1:778EFFD5A52A52F3DECC68C0F059ABF8E5D35F75
                                                                                                                                                                                                                          SHA-256:F75F98F84CCC7243CEEECCF7C53DE4134667869256A82969ADC927C4E3DC0C2E
                                                                                                                                                                                                                          SHA-512:ABC5CDA0D1FFDF5F3201E054B168DF9479B0757E0B3B1903F0DEEEBD94B1CD427D0BB4CEF4C9C51BAC2FBE637EB28ADA94F4493FBFBF8365118729DF854A3447
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......\`k]ak\al^al............!.......!..ImageMagick.gamma=0.45455.,...........H..... .K0+U..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-right-prelight.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 6 x 9
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):108
                                                                                                                                                                                                                          Entropy (8bit):5.2170421096681725
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cp20Lk14of3wDyloE2cNrHHCEOGOLjPUxmvU/en:x14I2JLjXMW
                                                                                                                                                                                                                          MD5:7D65BF16857A479B773DD3B3D7310EBF
                                                                                                                                                                                                                          SHA1:A22C77F0B5F97AF0AE8F0A267A24D10372EA18A1
                                                                                                                                                                                                                          SHA-256:0CCDD07ABEEB10BE9DE6AA5AA1690A8575C754C8ABF087D19D0C55E2CB9A0B09
                                                                                                                                                                                                                          SHA-512:C0EC4AB45213EAA65681700BDEBDE97BCF15257904616C6DAF97255EC8D7154BF47698781566A0FEA968AED2A8337F1CF6F52A1EF628A5BE9BEE605E2B3CD316
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......!..ImageMagick.gamma=0.45455.,...........Hq|D..'....F.4..q....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-right.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 6 x 9
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):134
                                                                                                                                                                                                                          Entropy (8bit):4.761887377050193
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CpGK/J54p9j/1ylCz0rNrHHCEOGOLoY3cnp1gEn:YB5GTz0kLkEEn
                                                                                                                                                                                                                          MD5:3FE915720C840AF83D0B5A7C2C82A11A
                                                                                                                                                                                                                          SHA1:F33503C72D778A7DD171D577FB10F100D6DD7458
                                                                                                                                                                                                                          SHA-256:B36F831F46300B866BD22F7222DF5A7DC43B6FF1A17592F0EA8B4F67D36D1287
                                                                                                                                                                                                                          SHA-512:B29289EE349CB49FF40521ADA031DC64C19B6E41F1C69A7E82819D509977F97311AEA8168C6E06E8A0E889A911CFD3588D9822DA0CC7DF52756C5F735F19C05F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......[ak\`k[`l\`l]`l\al]al\am]bl.....................!.......!..ImageMagick.gamma=0.45455.,...........0.D.)..rt*.....!.a&.TE.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-up-insens.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 6
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):89
                                                                                                                                                                                                                          Entropy (8bit):4.9181292768504274
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CR0elExl0zgNrHHCEOGOLiiMq+e:gEIz9Liivh
                                                                                                                                                                                                                          MD5:F3E68865832AB92AA02FD90AFF52C7A2
                                                                                                                                                                                                                          SHA1:5A1F52037F857D1D725A21876FB201B31112159B
                                                                                                                                                                                                                          SHA-256:1F41CA8781D2B58B9F3F0755D0538122B189773D967563981F83E4D0A0123576
                                                                                                                                                                                                                          SHA-512:A731B08BE36E840588949C054F604EC05703DB69ED24FF0F882733054100270FC12D277BC9BD51DC4BD23DD51E9C28D4B9627D0FB406EA8F120162D83CF2FFEB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......]ak^al\bm...!.......!..ImageMagick.gamma=0.45455.,..............i2..f!.L..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-up-prelight.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 6
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):105
                                                                                                                                                                                                                          Entropy (8bit):5.022859701885904
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CR27BrylOC5NrHHCEOGOLsXnxC/en:TXJL2no/en
                                                                                                                                                                                                                          MD5:B1024B8D4075764488D57817800D7748
                                                                                                                                                                                                                          SHA1:7C460B74706D7CBACD7B6D1CEC00E09A5CFBF734
                                                                                                                                                                                                                          SHA-256:8B23308F65892B58360FCDEED82001BCD62AFDB21F0EFF51D9F443A0A49A73BB
                                                                                                                                                                                                                          SHA-512:B0F70B10AA17CF61B4A65E74473812C42849A6E839D7999702357DCAA9A8C9985F3820BE6B0B8F25BED33DB02B8438BE3AAAF600EB1D1896B1C97C94B3D28F5B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......!..ImageMagick.gamma=0.45455.,...........XZ.>..2DT`.x7.N...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-up-small-insens.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 6
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):85
                                                                                                                                                                                                                          Entropy (8bit):4.8653915506270105
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CR0FJ9/lEcyl0zgNrHHCEOGOLzJstC/OE:Jf/lpz9LzJM8OE
                                                                                                                                                                                                                          MD5:2395C641ED805498DEAB3E6E969F614A
                                                                                                                                                                                                                          SHA1:8333A317BF61F4AED668DA242DADCE5783BC6D21
                                                                                                                                                                                                                          SHA-256:3E07DCCABFF68CB71A45F392718F4DCF1BCEE74F0F7592559238C804A67FE614
                                                                                                                                                                                                                          SHA-512:39B16E64BFC79C76FE68787104E485503DD211F20BEADC5FBD4F06B15CD7F6A213AEED1EA11789B0E25E58D642DB77240AECCF4D6D4C433C13C9BAE489C19554
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......\bk\al]cl...!.......!..ImageMagick.gamma=0.45455.,................'.L..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-up-small-prelight.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 6
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):104
                                                                                                                                                                                                                          Entropy (8bit):5.074466505932331
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CR2b14zWP/7yl7zgNrHHCEOGOLfueY3En:T0WnmLfDaEn
                                                                                                                                                                                                                          MD5:6D2A002806D6F8C662261A94AC8E9097
                                                                                                                                                                                                                          SHA1:BC8293A5B70BEC1886D36CEECC1F036ADFCD5EC5
                                                                                                                                                                                                                          SHA-256:AD339F562C987A79DE5ACDC1B0704A5317F9BA090E9F70E07D5221721AA61FA0
                                                                                                                                                                                                                          SHA-512:D3C5365F54DABD84DEEB0A2161B51504B640421B21CBBF72FAAAD6AFE00B63E2DE3610E674F68359ABA9F23889859A389A6EE7FCC114514A5F8A9E33F621C44F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......!..ImageMagick.gamma=0.45455.,...........hj.>.X..c...R..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-up-small.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 6
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):106
                                                                                                                                                                                                                          Entropy (8bit):5.092639197596037
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CRh0aOsH3G54/ExloE2cNrHHCEOGOLykBMv42een:vaOsHWSEUJLyk6v42n
                                                                                                                                                                                                                          MD5:E8E10993F6E4779FF39EB6ED749D37FB
                                                                                                                                                                                                                          SHA1:544345E3DC8484AE194E21C149CC5FF2C9F05976
                                                                                                                                                                                                                          SHA-256:619B8EC54D15BADFFB19C6743C13FBEC838593D0F28658A07AA4AC080BAA0418
                                                                                                                                                                                                                          SHA-512:7083E3F38B9C02090348B18249F6D4384923B408DDB6F7E64BC1E6FFFED8C018EEF12D9C92F92F9BEECB5FF5FF489253368A58050D946578A5042F794332771F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......\`k\ak[al[bl\`l\al\bm...!.......!..ImageMagick.gamma=0.45455.,...........xz.....diJ.U...1M..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\arrow-up.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 6
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):108
                                                                                                                                                                                                                          Entropy (8bit):5.128422469292914
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CRmJO4VTH/lExloE2cNrHHCEOGOLgbeqn:DJ5lEUJLgvn
                                                                                                                                                                                                                          MD5:3DC02B934FBC9AE19DB89FDD73E1E0C2
                                                                                                                                                                                                                          SHA1:DC7EB1255B3C2816F7B8858E017634D34D017FE4
                                                                                                                                                                                                                          SHA-256:815B75DD60792C8DCCCA5A68ECAB4D99369EA4250E6BB34BB62DE6F4AAB9F424
                                                                                                                                                                                                                          SHA-512:11BB25DFE70B4D4AC21B2A5AE153EA4105927800DCE2F65E1CD5F08019053FD5ACCCAE1AF82EA69FE5DDB0B49872D54ADE8D4E1BE11C37180B49A7534BB32515
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......[ak]ak]`l\al]al\am\bm...!.......!..ImageMagick.gamma=0.45455.,...........xz.>..FY.........a$.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\button-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 26 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):191
                                                                                                                                                                                                                          Entropy (8bit):6.008099547548735
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C94/l2XxsHvvnCHNHMXNylvE2IrNrHHCEOGOLXl6FYugtdNrU5hpYrNBcjVaJenz:RtuxsHvvCHNZIkLMF8dNrUBYrcjmgEhE
                                                                                                                                                                                                                          MD5:9E9526B98C7D9780A43DAC1EA2E648BD
                                                                                                                                                                                                                          SHA1:1ED141060113D528220111AAB6FBB3659416C3B6
                                                                                                                                                                                                                          SHA-256:4A15ECC9CAF5A10ECE0F6964501ECAC49613807473538B1B118DA32A3CCC4307
                                                                                                                                                                                                                          SHA-512:AD23C934E3B8BD2E49B95E4F2FACEC56F367E7868A3FCFDA74CA080AC819293E9412DD806235390809AB9C9D59E46E4C06EB04EF15C97C9FD8F3B29B458F3A04
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a....................................................!.......!..ImageMagick.gamma=0.45455.,..........OP.!..8K..J`(.!b...,y....#,....N..0H..E.#(.d..DhP.........j...<[D!...lE..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\button-empty.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 26 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):93
                                                                                                                                                                                                                          Entropy (8bit):5.178030577383781
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C+oAagNrHHCEOGOLXl8qU1C:3oAcLpU1C
                                                                                                                                                                                                                          MD5:6E9C07F51D1DDADC23959F1D76F63F2B
                                                                                                                                                                                                                          SHA1:A3B98533A2ED0492E1A9F4DAA0EFD97E6D879722
                                                                                                                                                                                                                          SHA-256:4D7DB1286D57416D551A869B11EA04A570A1D05834EC0BD1C854A6BBD5CB41E2
                                                                                                                                                                                                                          SHA-512:5C5C071E7B836B087C66E0C0B23F81E96A471B3FB00482CD57E6C598B50165A915B3ABF5B719D5D8C6ECF10BDB4D0A547E9F1BAF470FA2F29633643D5EB24318
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......!..ImageMagick.gamma=0.45455.,...........................H.fX..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\button-focus.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 26 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):211
                                                                                                                                                                                                                          Entropy (8bit):6.048975266027512
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C9H31O9llt7ylVCprNrHHCEOGOLXl4PbybNltgFVp+lBrge+xR4wd3TGzOR+D07:Gw9lltLkLqPmbNlcCDYxRfPuW
                                                                                                                                                                                                                          MD5:B24A1073554440F2D2A77A26C0BF0464
                                                                                                                                                                                                                          SHA1:0C88291BB5C4FF8C845D19B222D38F66886B4651
                                                                                                                                                                                                                          SHA-256:6C3B91D3FCA12EB81276188D167F189DBA1EACC5FC1AA3A777ED9C126E07B43B
                                                                                                                                                                                                                          SHA-512:37078AEA71089159A3EC9780F64B2EC2652B02F08963E0F5ECE4C996FD1DA52AECABB0E5CFE94BF41B2E71B9B3B6FB5F6C34CE30EEAC51DF1C7D3A50E84E0E26
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......\al.............................................!.......!..ImageMagick.gamma=0.45455.,..........c..!..8K..9`(..A..`......(".8..7.. ...K..9!Rw...#%TT...!)...f.^...b..p..E_....}d...&..>[&56......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\button-hover.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 26 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):163
                                                                                                                                                                                                                          Entropy (8bit):6.209437717328516
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C8/rq1PN4GloE2cNrHHCEOGOLXlV3xyRv/vV2lj1DRt3dMGXFSHZ8:1GL4fJL73OnvV21G6FaW
                                                                                                                                                                                                                          MD5:2A3202A3E4BFECAF140D267B08D8B655
                                                                                                                                                                                                                          SHA1:60E1DFE7C2881112B0E93F92254AE2DDD3ACC557
                                                                                                                                                                                                                          SHA-256:CE57A088D6714425AE7D99A7D3F2D56253C79CA19821862F66405A3893248C2B
                                                                                                                                                                                                                          SHA-512:BC57517BDB43371AE9305BB56FD41ABDAA4A72F76D1856256FED4C888FF8E0963FF3E0365B5E51838902F41EA7D7EAC41A09261AD6EC1F05A913B2AFA8D71A95
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......!..ImageMagick.gamma=0.45455.,..........Kx'..0..H18...Jpq$W.GP..........v....k..&($..<dNic....U.f...hzR..[........;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\button-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 26 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):163
                                                                                                                                                                                                                          Entropy (8bit):6.214726989251608
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C8/HD06gKeoexloE2cNrHHCEOGOLXlV3RQtUehvByVmlTFOp3fsYpeXSnn3/en:1N1eJUJL73f+EOTO3fsEeqnPen
                                                                                                                                                                                                                          MD5:D8C4383E654BE85976E710C4E596E679
                                                                                                                                                                                                                          SHA1:58FAF3B9399AC4660542FD357A87A701071BED50
                                                                                                                                                                                                                          SHA-256:4A91FE87BC8D59796D8D4B68733FE470EE764A66CEC4076A2F954E7AEF2ADBFD
                                                                                                                                                                                                                          SHA-512:54213E68E0C5C5265F93A9FF03A358ABF189CBC0FC9833388C23BF5DDDCF581CBF71ECFFC0682F93CD4A2495411D7EE4C15498B41C3A1ACAE903680D252ED518
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......!..ImageMagick.gamma=0.45455.,..........Kx'.....H18...Gpq$W.JP.......:.v.....>.0....A.O.c.5hL......xR.,.........;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\button.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 26 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):163
                                                                                                                                                                                                                          Entropy (8bit):6.27603129384553
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C8/rq1O9llGloE2cNrHHCEOGOLXlV3xyRv/vV2lj1DRt3dMGXFSHZ8:1Gw9llfJL73OnvV21G6FaW
                                                                                                                                                                                                                          MD5:25CB9C8AED4673EC54BA8C6B2AFB7688
                                                                                                                                                                                                                          SHA1:5D8A1708168559133F277ED0C4F33BC2ECE9CC21
                                                                                                                                                                                                                          SHA-256:2C11619F5FA6410C6D74FE33B630C6241D39ABF2541DB1BD70BF862484CC6EF8
                                                                                                                                                                                                                          SHA-512:35B18DB95A67D3BE61B6C2FD47EB726092E2E9521BF15DF876BBF5905D4C96A36CB758B659A4860E4FAC6627358199AA1054031095282B18146CCFFFE6D7FA57
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......!..ImageMagick.gamma=0.45455.,..........Kx'..0..H18...Jpq$W.GP..........v....k..&($..<dNic....U.f...hzR..[........;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\arc\arc\checkbox-checked-insensitive.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):234
                                                                                                                                                                                                                          Entropy (8bit):5.739900858430905
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cs5R6+bzDLMa82If+aTql/dylEE2cNrHHCEOGOLEBrBjPBx+KiRPmLxNbjpINp2T:NL3X86BJLoVjWKx9NJIJC
                                                                                                                                                                                                                          MD5:874015A424BF0986AB84CB105DC1317C
                                                                                                                                                                                                                          SHA1:BD248CAEAD68B62A5514240914D4F4A27ED2FCC0
                                                                                                                                                                                                                          SHA-256:48D36386B91556FAF88F0E24168C169DD44D6A4AAEF3C14C94495AEA91C92704
                                                                                                                                                                                                                          SHA-512:21832836DE778B7162AF3955E8D36D25346A66012F416ED482805C4908A00FD411FEFFC539C59937496D5AD8F7201DD95CA98D573409B8ABA95642486F38B05C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......R..Y.._..b..d..f..j..k......................................................................!.......!..ImageMagick.gamma=0.45455.,..........J.$.dI.h..j..n..2. .$.J..4.A..I ...p.,..!."4$...1......6..`..L/k.w.57.K!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\scale-ha.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):388
                                                                                                                                                                                                                          Entropy (8bit):6.373006266504265
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NhPdCP3n41RyV0lw1X1ihmq8kuIkL47I5QllaU3foQ9MsnCljqy:BMtJahCkuRLMDl3BMGCxqy
                                                                                                                                                                                                                          MD5:D72B08E8C470356D00C7046CF699DEEA
                                                                                                                                                                                                                          SHA1:7E04CCB2705A70B2A27D0ED9647C8D86A2CEAEF5
                                                                                                                                                                                                                          SHA-256:D5AC25089A5792DB3A427B7F46FE6D58137DB687425071F1EB9882BF1374F8E1
                                                                                                                                                                                                                          SHA-512:4BF0E254A92F5F4E70041817BF78695613C18C8A1838782D8F1F607F21B9E0E39313805F7F4B29B988472B5FC4B22DE49B09C21DFAF9A4E145F86115D134F04F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......iehkeijfikfijfjkgjldjlgjmfknfkmilqiotmqypw.^x.a}.b|.a}.V..R..W..[..\..Y..\..\..T..V..X..Y..Z..V..W..W..X..Y..Y..Z..Z..Z..[..[...................................................................!.......!..ImageMagick.gamma=0.45455.,...........@.pH,.].. q.....D.........h(..."...g.E0$DD"4..!....\^.,...'{h'..B...r..B..&.(&..B*.# .#.*C..%.|..D,..$&))&$..,E-........-M+....+M.DA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\scale-hd.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):401
                                                                                                                                                                                                                          Entropy (8bit):6.304579055192565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NQRtnFUl3SVLil4jJjrZTkL9eAU3nHJV3bASdzxmbzypmE:9iVS41jrGLIPBxmbept
                                                                                                                                                                                                                          MD5:ED78967B6EF550F31489FF94AFCA6B51
                                                                                                                                                                                                                          SHA1:7921C9B98A333ECE4721895D4CCCDFFE3026FCB2
                                                                                                                                                                                                                          SHA-256:3FCE9AF6B54E25D7194F25742920293E99EB431B3122D64FCF8A176446EE47BF
                                                                                                                                                                                                                          SHA-512:0F10F5E2DB970B9D7B10735AD4307879717EC2FE99E78AAB4ECC3A8CF163F36245EFB2B1357044D82060F13CB05CEAF6115AB43731CC0AF4C3D3D7F68CE3C02B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......roqtorunssprtpstqsuqsvptwptvruzrx}vz.]..h..k..l..a..y..b..e..f..c..f..f..c.._..b..a..d..b..a..b..b..c..c..d..d..d..e..e.........................................................................!.....,.!..ImageMagick.gamma=0.45455.,...........@.pH,.Y...q...............d$.......se0.8@p4..`....i>/.&.B..%{| %%..B..&&..|...B..$...%$..B(.!...&!.(C..#..#..D*.."$''$"..*E+........+M)....)M.DA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\scale-hn.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):254
                                                                                                                                                                                                                          Entropy (8bit):6.439648136087454
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NOD/5v4lG84YBYmPyyrLwctySEPjlt8Q/6Wq39:Y/5v4l/4YBLqaLwcb2tT/6WO
                                                                                                                                                                                                                          MD5:B42F129FEF13A3B5F6A2013EC1D9A43F
                                                                                                                                                                                                                          SHA1:7F7211110E35BE5304CA1C488B7FC1379EB67A00
                                                                                                                                                                                                                          SHA-256:CF16828A23068C90ACC2E4B556E98E47E03F3E895BAA4E7786E92D19E37920B6
                                                                                                                                                                                                                          SHA-512:63D82C35CC6D08FFA736761EBEEE44ACCD6B531D60B766C393BD7A2ADF8ED78855BB34905687F78EB12B4012D11922CB1886BDB631745D0C4F71FF171CC7E4D0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a......._\^b[_`\_a\_`\`a]`b]`c\ac_bd\af_dwUmzYpzXq{Xqicgnflzwy}~~.Nz.O..J..S..Q..S..S..S..S.............!.......!..ImageMagick.gamma=0.45455.,..........^.'.diz..$.8,SUM.p...TP...ps......A.),J.E!.D.6O.*,. .....E.bFd..\5.....j..R....2...-......-.$!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\scale-va.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):388
                                                                                                                                                                                                                          Entropy (8bit):6.373006266504265
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NhPdCP3n41RyV0lw1X1ihmq8kuIkL47I5QllaU3foQ9MsnCljqy:BMtJahCkuRLMDl3BMGCxqy
                                                                                                                                                                                                                          MD5:D72B08E8C470356D00C7046CF699DEEA
                                                                                                                                                                                                                          SHA1:7E04CCB2705A70B2A27D0ED9647C8D86A2CEAEF5
                                                                                                                                                                                                                          SHA-256:D5AC25089A5792DB3A427B7F46FE6D58137DB687425071F1EB9882BF1374F8E1
                                                                                                                                                                                                                          SHA-512:4BF0E254A92F5F4E70041817BF78695613C18C8A1838782D8F1F607F21B9E0E39313805F7F4B29B988472B5FC4B22DE49B09C21DFAF9A4E145F86115D134F04F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......iehkeijfikfijfjkgjldjlgjmfknfkmilqiotmqypw.^x.a}.b|.a}.V..R..W..[..\..Y..\..\..T..V..X..Y..Z..V..W..W..X..Y..Y..Z..Z..Z..[..[...................................................................!.......!..ImageMagick.gamma=0.45455.,...........@.pH,.].. q.....D.........h(..."...g.E0$DD"4..!....\^.,...'{h'..B...r..B..&.(&..B*.# .#.*C..%.|..D,..$&))&$..,E-........-M+....+M.DA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\scale-vd.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):401
                                                                                                                                                                                                                          Entropy (8bit):6.304579055192565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NQRtnFUl3SVLil4jJjrZTkL9eAU3nHJV3bASdzxmbzypmE:9iVS41jrGLIPBxmbept
                                                                                                                                                                                                                          MD5:ED78967B6EF550F31489FF94AFCA6B51
                                                                                                                                                                                                                          SHA1:7921C9B98A333ECE4721895D4CCCDFFE3026FCB2
                                                                                                                                                                                                                          SHA-256:3FCE9AF6B54E25D7194F25742920293E99EB431B3122D64FCF8A176446EE47BF
                                                                                                                                                                                                                          SHA-512:0F10F5E2DB970B9D7B10735AD4307879717EC2FE99E78AAB4ECC3A8CF163F36245EFB2B1357044D82060F13CB05CEAF6115AB43731CC0AF4C3D3D7F68CE3C02B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......roqtorunssprtpstqsuqsvptwptvruzrx}vz.]..h..k..l..a..y..b..e..f..c..f..f..c.._..b..a..d..b..a..b..b..c..c..d..d..d..e..e.........................................................................!.....,.!..ImageMagick.gamma=0.45455.,...........@.pH,.Y...q...............d$.......se0.8@p4..`....i>/.&.B..%{| %%..B..&&..|...B..$...%$..B(.!...&!.(C..#..#..D*.."$''$"..*E+........+M)....)M.DA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\scale-vn.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):254
                                                                                                                                                                                                                          Entropy (8bit):6.439648136087454
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NOD/5v4lG84YBYmPyyrLwctySEPjlt8Q/6Wq39:Y/5v4l/4YBLqaLwcb2tT/6WO
                                                                                                                                                                                                                          MD5:B42F129FEF13A3B5F6A2013EC1D9A43F
                                                                                                                                                                                                                          SHA1:7F7211110E35BE5304CA1C488B7FC1379EB67A00
                                                                                                                                                                                                                          SHA-256:CF16828A23068C90ACC2E4B556E98E47E03F3E895BAA4E7786E92D19E37920B6
                                                                                                                                                                                                                          SHA-512:63D82C35CC6D08FFA736761EBEEE44ACCD6B531D60B766C393BD7A2ADF8ED78855BB34905687F78EB12B4012D11922CB1886BDB631745D0C4F71FF171CC7E4D0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a......._\^b[_`\_a\_`\`a]`b]`c\ac_bd\af_dwUmzYpzXq{Xqicgnflzwy}~~.Nz.O..J..S..Q..S..S..S..S.............!.......!..ImageMagick.gamma=0.45455.,..........^.'.diz..$.8,SUM.p...TP...ps......A.),J.E!.D.6O.*,. .....E.bFd..\5.....j..R....2...-......-.$!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\scaletrough-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):190
                                                                                                                                                                                                                          Entropy (8bit):6.113247224699945
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CAlidzyh//AlyCbFFngAaaEcylQzgNrHEXHPcl7l0ss3dOod+CFHh9q0atMG3ASC:hlixyRgFCXkLzd8+ss8Y/o0aiGhWZtTx
                                                                                                                                                                                                                          MD5:C64B71FE3069BFEF9D386B051369119B
                                                                                                                                                                                                                          SHA1:F67B2646F7142A9320084AB40CCB614407F2A8F7
                                                                                                                                                                                                                          SHA-256:DDBA52FA6FEE33B8EE7A150625F392097198B718AFC76C47A4280E5AF8774876
                                                                                                                                                                                                                          SHA-512:D79C3D96BAA21B1337AA8DD5F202A6A69243BC396A11571A6194781619293BDF34959AAE5566A684EC93D852F5251CB6F94BED18BBA30121CA1A3A87A6ED5A71
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ......................................................!.......!..ImageMagick.gamma=0.454545.,.... .....M..I..8..5@..di.c ..A4p,.tM...|..:.@A,...$q.($..tJ- ...v.......A....4..n.'..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\scaletrough-hp.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):187
                                                                                                                                                                                                                          Entropy (8bit):6.132187381699208
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CAlidzyh//AKJBFPOzMcylQzgNrHEXHPcl7lBss3Mod+CFH2SFySVtb38NRX:hlixyRuJLzd8cAMYxMStb38DX
                                                                                                                                                                                                                          MD5:31295D215A5ED1435644AB0ED19DEFD8
                                                                                                                                                                                                                          SHA1:0DC209AE35E629324A23624E3BD060FDD8BC7F31
                                                                                                                                                                                                                          SHA-256:0B21801A201CAF28EA2070CA0D2FDB28705555C90D36CD12F374AA4C3C8803CE
                                                                                                                                                                                                                          SHA-512:2D94AC696CBB7A322D3C8CDD113BA3B9C3323E20DE6EE9B2F1465CB47561BF7AFD149E097CBEC73AF8C71075CE768FAB313D6F87D116F6AF14A5C630A89B5526
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ......................................................!.......!..ImageMagick.gamma=0.454545.,.... .....J..I..8..5@..di.c ..A$p,.tM....|..:..H,....b.l:....q@Y.....x4..xL.7<.z...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\scaletrough-v.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):200
                                                                                                                                                                                                                          Entropy (8bit):6.330902210507186
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cgixyh//AlyCbFFngAaaEcylQzgNrHEXHPclDhqBlXwT/03CoJy+tz7vvqHi3VX/:DixyRgFCXkLzd8sBlAT8W+CaFNV
                                                                                                                                                                                                                          MD5:EC25C9D7872013297D67E70270483B78
                                                                                                                                                                                                                          SHA1:1EC584594A922F228D70E2C918090334EE260EE7
                                                                                                                                                                                                                          SHA-256:343C64FBC7035F18685FD5F868B7C140347C9DDE2D104400D6F06E3F080432DC
                                                                                                                                                                                                                          SHA-512:7668E4868808BED40917CB785C66A788B9BBB30A95B6A9539A825AE01A11671C909D6F85FAD7E1CB5330706C3E95BEE839E017666CA06473A8F22C93926C7E2D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.. ....................................................!.......!..ImageMagick.gamma=0.454545.,...... ...W...02?v.Z..9@.5......*{.c9.Kg.......IzA.K2.B.R.\....6.B.].J.Z.g.......,...i(..#..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\scaletrough-vp.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):200
                                                                                                                                                                                                                          Entropy (8bit):6.331401537857736
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cgixyh//AKJBFPOzMcylQzgNrHEXHPclDhpIP1kXbCoJy+tz7vvqHi3VXNMNu:DixyRuJLzd8MP1kXS+CaFNV
                                                                                                                                                                                                                          MD5:1BE423DEAAA1894507B2B2E9E0AEF167
                                                                                                                                                                                                                          SHA1:9C6C6429DA4BD493DAB4FEAACD1A9BCB0A5CF34F
                                                                                                                                                                                                                          SHA-256:2AE1AA3D220693AA4FA324D388C82FAB0E9A8D6496B9498D37F6A233DA092E63
                                                                                                                                                                                                                          SHA-512:984B4E9F84F6160E85114364C88CEA1D317E1C99669ADB481783518946018BD8405A168E0067FF885E5DF47EE28AC25997D7D226F9759F2E937CE8B57BE58E86
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.. ....................................................!.......!..ImageMagick.gamma=0.454545.,...... ...W.I..02.v.R..9..%......*{.c9.Kg.......IzA.K2.B.R.\....6.B.].J.Z.g.......,...i(..#..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\sep-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.200339841920497
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUnWWGeQll2agNrHEXHPclHh/:29ll2i8B/
                                                                                                                                                                                                                          MD5:7025073FA36676495E27DB63FE5E79D8
                                                                                                                                                                                                                          SHA1:F2ADB1D32C53AF53B1663E4B58EBDFF70622D2D3
                                                                                                                                                                                                                          SHA-256:A980560CF839773238353CA7F1DFA1FA7D6DF5B5E8738E0671510CEC8FCDFBA5
                                                                                                                                                                                                                          SHA-512:25330A16EABAD2A1E7957C07E03F3FC9174E9180A1145B8F1761E31B6AF58E0AE4A432ADA97CF7B145D1D70297CF68DAEE007DA1C29C5B9D1F80D53BD4733B7A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......!..ImageMagick.gamma=0.454545.,...........D..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\sep-v.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.200339841920497
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUn9ftEwl2agNrHEXHPclHh/:nuwl2i8B/
                                                                                                                                                                                                                          MD5:D02C4392E722AEF6E60246DEEC7643F7
                                                                                                                                                                                                                          SHA1:DBA5860AB4231A3B159229BE595A1A61A075F78B
                                                                                                                                                                                                                          SHA-256:60300852D766D3A7692E4141E2F713E4F802A8A49D51953D96E4D17C23B7F3ED
                                                                                                                                                                                                                          SHA-512:97289B44AA17E8F870434B965BAA082FD80515ACB1D19FD8178188FB8EE510276F33FF8ADF9CBE18094DFE22AFB681C82EEC3071F487C6C84214E44127141267
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......!..ImageMagick.gamma=0.454545.,...........D..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\sizegrip.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):114
                                                                                                                                                                                                                          Entropy (8bit):5.477762189680691
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cs+N9qKTEchOagNrHHCEOGOL5NjQp5mJaZe:NKoEOcL5txf
                                                                                                                                                                                                                          MD5:7164000391F697434BECD6F5C0E07558
                                                                                                                                                                                                                          SHA1:0B406563FDEF1D00073F82F5ED4EF21C6A082770
                                                                                                                                                                                                                          SHA-256:9C3778F9DAF1B4A13AA1272571948211E7A6B5052FECA54DC5DFB8DFFB8A0AE5
                                                                                                                                                                                                                          SHA-512:C12E7E787299C7B5743D70E5E62860CF18C809EF0B0BE5CE7CF434ED97B7857F40AE9A71CF3228DD04F2441CEE605F7BFBCD8C2C95D3ED10599E65C108ACCB9E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......!..ImageMagick.gamma=0.45455.,..........&...{.:.Cq6iC.s..a .A$i.a.j.z.l.r.Wm(..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\spinarrowdown-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):353
                                                                                                                                                                                                                          Entropy (8bit):5.458088543902003
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HhqS3nvG4UAaXl2i8tsGlIBQvk2XMg4si:HB3nvG4UAkB8tplGQ8ygF
                                                                                                                                                                                                                          MD5:D9B45A320C4103307809FA781097C261
                                                                                                                                                                                                                          SHA1:9C8A170C24E940573876156853DA231083AD0561
                                                                                                                                                                                                                          SHA-256:319FD174F91649AA56B3340B97AAE7467ACB301D532A56FCEA2E5D57834A9C2F
                                                                                                                                                                                                                          SHA-512:130FA968AA5D7ED3557AE5695610BFF2076D619C2F585212744148EADB9921F637C16E345A6762D8DF65E221908AAFD1E70A52CE176CCDC7BAFD07B5620A81FE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......EEEHHHJJJLLLOOO\\\gggwww~~~.....................................................................................................................................................................!.......!..ImageMagick.gamma=0.454545.,..........`@.g...A..g.d~..Mc.........$..B..Qh0... p.5..e.. ..R./..}.....................................A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\spinarrowdown-af.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):343
                                                                                                                                                                                                                          Entropy (8bit):5.301955106636081
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HhqBV/WEoJUAaXl2cLsHu/um7sG16z3n9vnsk:H/EGUAk5LsHet7o3n9/sk
                                                                                                                                                                                                                          MD5:4928A314B428AF25BECF3D3C750D31D1
                                                                                                                                                                                                                          SHA1:3099DBF9A00862D4D8E2DCCB1AF301AB62DD2CE2
                                                                                                                                                                                                                          SHA-256:E39EAD05C778C4C487355813E5AD1EBF159EBBB7CF04E1502C8D424E0E265338
                                                                                                                                                                                                                          SHA-512:341D953A054BBBB2FF302E2BDD670837B888C4E0A4124393C374571480968AA3A28ABEF983C506480C41054DD2DED5B45DDA5A48D3795EA31AE5BA826C999177
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......EEEHHHJJJLLLOOO\\\gggwww~~~....p...............................................................................................................................................................!.......!..ImageMagick.gamma=0.45455.,..........W@.g......g.d"=...@.D6HN&.(...-R..8......\...}A^*x.. -......H.....H.......H.........A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\spinarrowdown-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):353
                                                                                                                                                                                                                          Entropy (8bit):5.458088543902003
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HhqS3nvG4UAaXl2i8tsGlIBQvk2XMg4si:HB3nvG4UAkB8tplGQ8ygF
                                                                                                                                                                                                                          MD5:D9B45A320C4103307809FA781097C261
                                                                                                                                                                                                                          SHA1:9C8A170C24E940573876156853DA231083AD0561
                                                                                                                                                                                                                          SHA-256:319FD174F91649AA56B3340B97AAE7467ACB301D532A56FCEA2E5D57834A9C2F
                                                                                                                                                                                                                          SHA-512:130FA968AA5D7ED3557AE5695610BFF2076D619C2F585212744148EADB9921F637C16E345A6762D8DF65E221908AAFD1E70A52CE176CCDC7BAFD07B5620A81FE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......EEEHHHJJJLLLOOO\\\gggwww~~~.....................................................................................................................................................................!.......!..ImageMagick.gamma=0.454545.,..........`@.g...A..g.d~..Mc.........$..B..Qh0... p.5..e.. ..R./..}.....................................A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\spinarrowdown-pa.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):247
                                                                                                                                                                                                                          Entropy (8bit):6.475681088009578
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CkhlnnRjj5svLlRRQQ+s3RRZRlu/z/tNw5jfPuu9fyagNrHEXHPcl5o4wstY/YiV:HaZR20RQF8HuyKi8f32HNFNbgLVf4Ke
                                                                                                                                                                                                                          MD5:86A78E2B4C7088D2C3B4D56F14686D92
                                                                                                                                                                                                                          SHA1:CA7BA454A065C5A238F54BA8435F1F83BC4A4FFD
                                                                                                                                                                                                                          SHA-256:4EFCFCEBCA6B75D91E7C255E5B9EF9A28D9EDCB8D059ED4350D28C0F1BFACA7F
                                                                                                                                                                                                                          SHA-512:FE089BE0799E0C10EE2C297267F76D032915407B5012D7C883F9CA344CE3628336CF184A784C42B02C3C288CA02AC090D55CBAF30DC4D5F2206F0FD90057E987
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......@@@BBBDDDFFFIIIUUU___nnntttuuu..................................................................!.......!..ImageMagick.gamma=0.454545.,..........V...hzJ..,.)...@.<..l....B..Qdz..A..e.....@H/...]...J.B)S.f..=i...dN.7...~.........!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\spinarrowdown-paf.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):239
                                                                                                                                                                                                                          Entropy (8bit):6.428665607579838
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HaZR2MxERmcB8HuyKcLk6Mjs2R2lGoWFE:HegMxEd8Oy7L3qs2R2l0FE
                                                                                                                                                                                                                          MD5:58DDC9B43AF92AF13A04D3584BFF0213
                                                                                                                                                                                                                          SHA1:C4282BB9D3B4861A05DD1D921A832EEEB0AECBE9
                                                                                                                                                                                                                          SHA-256:8BDE2B38A44E4FD4CD4619D9A9734D6DC957D72609DDD20856C2516E618A8CCD
                                                                                                                                                                                                                          SHA-512:C8EBFEF2CE285D9A5C02EB4407CE3E0318B7A59CCD61C66F9200DD8EF7A02F273D11D0B7AB94EDDE0F3455BFCC58B33B946949D658B83557732B03CFB8A52611
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......@@@BBBDDDFFFIIIUUU___nnntttuuu.p...............................................................!.......!..ImageMagick.gamma=0.45455.,..........O...h*J..,.r.3.t.i.aIq...*.k....P..8....T....ZAY&.."<AM$.t.%...o..E..?.:.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\spinarrowup-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):6.5633607609120395
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HYJeZdjM5cPcAEi6Mi8wVRLSnG3+HfEA3q6OeN:HddwekAED8wbLSnpHfEcQi
                                                                                                                                                                                                                          MD5:D492994180730FA86597F976CFBB7A01
                                                                                                                                                                                                                          SHA1:2100D1E621691CF4A640704AC09898B6B891D845
                                                                                                                                                                                                                          SHA-256:86332694130C170C65C5B890FDB999054FA970124B355ADCA6242708273A0ADC
                                                                                                                                                                                                                          SHA-512:303419418E69936B1460513C968FBEF69F2F9F57FBE1331A6285987CB8FB2FBB5E2B18B3292A4F55DA05B25F4AAF284EF52F1B15B77A06B348989B73B687D835
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......EEEHHHKKKLLLMMM^^^jjj|||........................................................................!.......!..ImageMagick.gamma=0.454545.,..........Z ".d.x_.~^..[,...i.....l. c..b6..e.. ..."S.,....A`(.D.P@.1..D.......,.....d.............!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\spinarrowup-af.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):240
                                                                                                                                                                                                                          Entropy (8bit):6.448417562182848
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ckfo5epKVngcm5zVA77A/ERWq7frll2agNrHHCEOGOLyL8D7C/gfm9Y9wSnxfT9D:H6e2m5GAE7ll2cLXGkYY9dxfpHYzWn
                                                                                                                                                                                                                          MD5:1D74F53042EE9E42D111F7FB744FCA13
                                                                                                                                                                                                                          SHA1:89D1D592842B832FF86FE1284BE1CA1352444BAF
                                                                                                                                                                                                                          SHA-256:AC1DBB9D609430E96F08A701D582CAE22E51037DB26DDDB97FD8ED8ED45BB021
                                                                                                                                                                                                                          SHA-512:8D22C9DAAEA72BDB5B2F4513F54849D98207B5FB6D2EED84DE8A9C34699D5DC283F60E2B28AA45A21D04558D622719A0D061ACE53E025D3A06B6337CDF59ECDE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......EEEHHHKKKLLLMMM^^^jjj|||.p.....................................................................!.......!..ImageMagick.gamma=0.45455.,..........P "...<d......m....e.38..h.)&.."F..X......e*.D.PH`E..#.(...Qe.n.E..\"..E..~.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\spinarrowup-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):6.5633607609120395
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HYJeZdjM5cPcAEi6Mi8wVRLSnG3+HfEA3q6OeN:HddwekAED8wbLSnpHfEcQi
                                                                                                                                                                                                                          MD5:D492994180730FA86597F976CFBB7A01
                                                                                                                                                                                                                          SHA1:2100D1E621691CF4A640704AC09898B6B891D845
                                                                                                                                                                                                                          SHA-256:86332694130C170C65C5B890FDB999054FA970124B355ADCA6242708273A0ADC
                                                                                                                                                                                                                          SHA-512:303419418E69936B1460513C968FBEF69F2F9F57FBE1331A6285987CB8FB2FBB5E2B18B3292A4F55DA05B25F4AAF284EF52F1B15B77A06B348989B73B687D835
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......EEEHHHKKKLLLMMM^^^jjj|||........................................................................!.......!..ImageMagick.gamma=0.454545.,..........Z ".d.x_.~^..[,...i.....l. c..b6..e.. ..."S.,....A`(.D.P@.1..D.......,.....d.............!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\spinarrowup-pa.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):249
                                                                                                                                                                                                                          Entropy (8bit):6.528873553433453
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HyUUX+025LaLUAWlJlMi88fTLtKtuSKGG:HyUUh25LaLUAsr58mAtCGG
                                                                                                                                                                                                                          MD5:57AE0A372C39425DFDDC49AC5B06995B
                                                                                                                                                                                                                          SHA1:F9A289544DC6C7B7B26A2C2285B1BE0E7E92DA21
                                                                                                                                                                                                                          SHA-256:A1F5FF92994E8402B6022430A4A3A5E5033674D118017A5FD7D17292175C9D2F
                                                                                                                                                                                                                          SHA-512:D268BE5ADC29BD64B2577283FBD9C113E272DA9375F5CF186617C1B03AAC38DB2BDE2016559076C24A7D3D2070266D9E62A1A6FBAF1EC5C5DE7005B3827CF1E6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......@@@BBBEEEFFFGGGWWWbbbrrr{{{.....................................................................!.......!..ImageMagick.gamma=0.454545.,..........X`"..y_.~^..f,;I..Z.k........HD....2..B` ,....BA.......L...:..X...|>.$&.|$..O........!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\spinarrowup-paf.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):239
                                                                                                                                                                                                                          Entropy (8bit):6.342070150140048
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HyUUX+0fdD+aLUAWIZl2cLbL+M5i9r1nDNMteauFv/:HyUUnV+aLUAJZ5LbLkZMt8
                                                                                                                                                                                                                          MD5:55DA8EAA8E45E76ED08D861606745158
                                                                                                                                                                                                                          SHA1:947B5C1479AE4FF47E76FFCFF46B5348DCCB0DBA
                                                                                                                                                                                                                          SHA-256:FCF31930C3EA1A1B45B4054BE2EBE7C44C3FDF2BF52FD82EEB20B5D5A331649F
                                                                                                                                                                                                                          SHA-512:66DB5C9311288F59872FF4C73116591A94C0383370D2D9AC80CA13C65D3F79FB5D1B3BF2D15A403E4CD46BB21B39003D5604C953C4695DF69440D0B9CE222FE7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......@@@BBBEEEFFFGGGWWWbbbrrr{{{.p..................................................................!.......!..ImageMagick.gamma=0.45455.,..........O`"..md....+..Bk........BD...(S.4..B.).P(.....,.F.@.0&".d.f.&.x$...$..^/...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\surface.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 60 x 60
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):279
                                                                                                                                                                                                                          Entropy (8bit):6.932775696829703
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:MhLkx6801FrNfmPeDPFCm+nocUb8UPTPfT7dFkyI:Mhm6803rNfDxCm4oc/yf7dF8
                                                                                                                                                                                                                          MD5:1B328CE6C89DF59A86FF15FCA7AFD001
                                                                                                                                                                                                                          SHA1:057FCC69F6950E8AC0D66005C41C489475625D26
                                                                                                                                                                                                                          SHA-256:947EFCEA4DFD2AF854737936AAE74285CB2D8ACD0F9CFFA9CD3884B2D9938593
                                                                                                                                                                                                                          SHA-512:C71598769A5CC7166E4339C4556F8090EF04FF8059E8348611098B158A2D1CB4C647B27EA69AC3306732A0BBC4AA79F043266EC04FCF82CFC246B8F251292781
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a<.<............................!.......!..ImageMagick.gamma=0.454545.,....<.<....h...0.IA0....`(....F..l.pl..*.x..../..H...H.1.-..]-JU=..+...".^"8l....s.....N3.....<.{.W~.).....|.y.v.s.p.m.j.g.d.a.^.[.X.U.T.Q.Y{.0.M.\....h..Ru.A......_...E.b.%...........4..........;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\tab-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):905
                                                                                                                                                                                                                          Entropy (8bit):6.760665950675206
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:v6GDsOUBpSyfIT70UMaq4BwG1vLqkj4IaE:tBUBFfo7LpNFpLUY
                                                                                                                                                                                                                          MD5:48394CAD9222FCF19D130A30D5F630DC
                                                                                                                                                                                                                          SHA1:2F63FFF01644143D255B4614630A73A9317D0861
                                                                                                                                                                                                                          SHA-256:0A6D3BB3DDA8B5E2147D02C4F3CBB19BDA9C753E83E74FCE8C1A557F802B1D5D
                                                                                                                                                                                                                          SHA-512:1014E31D4A3FB7EA85D3D555DFA9D87D80E60EF422FD4F1F6379C30FF1C1D40327833D2E173604B2801C6F2901B1570354AA6422537CE3617494A75284B5FA8E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ......................................................................................................................................................................................................................................................................................................................................................................................................!.....V.!..ImageMagick.gamma=0.45455.,.... .......V....................TSTTUUSR.TRU.S.R..R...V.Q...N.O..PP.NNPNO..KJ.MIIK.LJL.IJ.L.LKI..J.H..G.GFHFE...H...E.CABBC@D.A.@.A.@....A.~..H.G...{..A..A.<|4.C.E.;rh...#F.8B..#d..(S..Q.%../_....F1f...'O.1b......H..x.....Z.....Q..`.....P..@."...hO.8..m...*.=.6m#.&H.01b.^.%..-A.D..%..6.(... D@..!....3W....F.:h..!....;l....h..4dX}Zt#..,X...n..r..N.w...$T.@a9....K. !....)0...Q....C..}........;....)8.@A.....O............_..42....0........R(.......v.a .;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\tab-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):865
                                                                                                                                                                                                                          Entropy (8bit):6.410596761544753
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:veqr1ItJiNKL3uq2TIeHK9ejhcxFmUCd5a5bi1SYTtCE8C1QF:veqouGzM2e+xUP17hCHIE
                                                                                                                                                                                                                          MD5:6203C44D4563776602786C1E75E68306
                                                                                                                                                                                                                          SHA1:79F22CA65DFF15F7B4A87E3E9AA3C4C5CD35FF06
                                                                                                                                                                                                                          SHA-256:1BB758F2469482FDE49AE3BC7623FEAB58AD1CD76D243F47D28D4FD96D2AACE3
                                                                                                                                                                                                                          SHA-512:665F91DEC069F4223ED0B7FF1CE8000F283F91142D1EB391E5B89901C05D83C6C75706B71F810B75ED7A087E0D709BAC4C83683A4D58C800D09F39DEEF85045C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ......................................................................................................................................................................................................................................................................................................................................................................................................!.....J.!..ImageMagick.gamma=0.45455.,.... .......J....................HGHHIIGF.HFI.G.F..F...J.E...B.C..DD.BBDBC..A.......@..?.?>@>=...@...=.;9::;8<.9.8.9.8....9.7...65..556.7..h.h.c...2f.Xx.F..aH..C..F/2j.....X...b..%Y.X.....c6J.B..&R.P.....(t.Lq.E..)r6.1....".. !.DT.$Jh.....F!B|....Y.!@........bA.e......6t.W.......;.p...4\.`aqb..2`..Xq..."/V.B...>{..z...S...H... D..... <p ;w...!.o.@......O......#(.@y.F...8`.@..... p`.x...../~..F...O..|.../....@.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\tab-s.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):905
                                                                                                                                                                                                                          Entropy (8bit):6.760665950675206
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:v6GDsOUBpSyfIT70UMaq4BwG1vLqkj4IaE:tBUBFfo7LpNFpLUY
                                                                                                                                                                                                                          MD5:48394CAD9222FCF19D130A30D5F630DC
                                                                                                                                                                                                                          SHA1:2F63FFF01644143D255B4614630A73A9317D0861
                                                                                                                                                                                                                          SHA-256:0A6D3BB3DDA8B5E2147D02C4F3CBB19BDA9C753E83E74FCE8C1A557F802B1D5D
                                                                                                                                                                                                                          SHA-512:1014E31D4A3FB7EA85D3D555DFA9D87D80E60EF422FD4F1F6379C30FF1C1D40327833D2E173604B2801C6F2901B1570354AA6422537CE3617494A75284B5FA8E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ......................................................................................................................................................................................................................................................................................................................................................................................................!.....V.!..ImageMagick.gamma=0.45455.,.... .......V....................TSTTUUSR.TRU.S.R..R...V.Q...N.O..PP.NNPNO..KJ.MIIK.LJL.IJ.L.LKI..J.H..G.GFHFE...H...E.CABBC@D.A.@.A.@....A.~..H.G...{..A..A.<|4.C.E.;rh...#F.8B..#d..(S..Q.%../_....F1f...'O.1b......H..x.....Z.....Q..`.....P..@."...hO.8..m...*.=.6m#.&H.01b.^.%..-A.D..%..6.(... D@..!....3W....F.:h..!....;l....h..4dX}Zt#..,X...n..r..N.w...$T.@a9....K. !....)0...Q....C..}........;....)8.@A.....O............_..42....0........R(.......v.a .;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\toolbutton-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 28 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):525
                                                                                                                                                                                                                          Entropy (8bit):6.991900480690244
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:JtyW3Qu62bBWHrctn5LKvE/w+iyJOjGw+ncLdwGJb:JtyW3j7bILch1syJMGwYc5wGF
                                                                                                                                                                                                                          MD5:E3600BDDA6DE78A17235EA9158CAB654
                                                                                                                                                                                                                          SHA1:A6EB51173C4AE003EE219F263F23A819C12B0D31
                                                                                                                                                                                                                          SHA-256:985A342EFD2783F8CCEE02FDE8DC009CEB9938A06DD56380D650B3232CAD8651
                                                                                                                                                                                                                          SHA-512:9BEEDF4B62B5653ECA9014497A14980637FDE62C6400793046A59C76AA73ADBF70A50E0D25ABB3C448BA34B082C82635FEFA928700F5AE3318CE903CE6786EC2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....5..[.._..`..h..h..v..x.......................................................................................................................................................................!.......!..ImageMagick.gamma=0.45455.,.............'!....dR......kF.Z.X.......,.+..d.z...[..|N..[.j....|/F+)......+F(......F'......F&......F%......F$......F#........"......F!......F ......F.......F.......F.......F.......F.......F......(.....*\.....#J.(.H...3j..1c.^. ..I..... X..0c.T...../.0..@...'...PB.h..N...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\toolbutton-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 28 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):559
                                                                                                                                                                                                                          Entropy (8bit):7.051041943001878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:I9z6eWjW1A/ALR8I6KPsM1UGsWmU/hyS8IhurAe9Yan6:ILoW5LzP79hyS8IhW9tn6
                                                                                                                                                                                                                          MD5:6910FFA258D2C329F87C9AF02F167967
                                                                                                                                                                                                                          SHA1:C99761E996F1E3486EFD234C96808DEA6A713DB5
                                                                                                                                                                                                                          SHA-256:AF4FE13771079C7AD6AAB7BEA8F5915DD88194429A9100950AADC227E79D062E
                                                                                                                                                                                                                          SHA-512:3F6E7F955589DCC383AF9D8AF1E9A5FD72FFFB440A4D4F086881E3EA5D089FAF768C7E4CBB3424FBB63345E4F7A0E29C485206B6AC430657E828F592EC1D38DE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................................................................................................................!.....1.!..Created with GIMP.!..ImageMagick.gamma=0.454545.,..............")....er<&c1...r.`.v.{.R.K,.Z...4z.^E...|N.....~.w4Z,.......,..+........*........)........(........'........&........%........$..............#......x"......~!...... ...............<..H.....8(\.....J.....3b..#...4..I.....`.a..#]j`..e...b..@.&.I.?3....@..H.".0@.Q.I......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\toolbutton-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 28 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):550
                                                                                                                                                                                                                          Entropy (8bit):7.2353803794254645
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:yROu2fXPR8XFo2o/qush1oosJmQMtnyS1n:0WfN2o/zsh1kmQMks
                                                                                                                                                                                                                          MD5:833C0259908D1F1AF01A5C0627B0F2EB
                                                                                                                                                                                                                          SHA1:8A6747689D5EB0B4F0E99B01640CA017220EE48F
                                                                                                                                                                                                                          SHA-256:6D8E082B7C935F61150335A0CF01F606126E8CD08A118948C3A0C507AD8F08EE
                                                                                                                                                                                                                          SHA-512:20E6588E93F061BE45486A436B019EE435CD781DBF519A68D6085FBB46743E87F4FC617537BDC9944788C34531A7BD3BECA9C20E5771C3ECA496691117B1BC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................................................................................................................!.....7.!..ImageMagick.gamma=0.454545.,............[.2)...K.r<R...F.r.j..v..h.U.&q...:.^.$..LN.............21.......1..0......../.................-........,........+........*........)........(........'......|&......%......$.......#...H. AP".*\.!.T "J.H."EY.2j..#.]"B..).$.&C......0_.8..C...b.....&..4..Q`.O..9lH..@......Juj....V...@. .;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\toolbutton-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 28 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):515
                                                                                                                                                                                                                          Entropy (8bit):6.796133133135814
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:ZC0sBg6GlxQNt5LKVwkXz53bAQjguVPP/7R3:ZOBgrgNtvkj1sQjgC7t
                                                                                                                                                                                                                          MD5:2EF2B303104AAE6BFFE45CE864E554B2
                                                                                                                                                                                                                          SHA1:93B1BF09349A5D60F4B0C9598566F8836BEFC09E
                                                                                                                                                                                                                          SHA-256:D9294DD299BF231F01ECB58EFD7DB4CED38F7C11C9DE692D1B9CBF2C3A246C3F
                                                                                                                                                                                                                          SHA-512:81AE0146692A0D3C5AC273412823D75C98244FA3294D3546A2D8E0A6DAA6813A14C1B84BF7BC6B9ADEFF43FE8527E27B7A590E20DDAF44B02AE380027658B905
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........O..S..Z..g..h.............................................................................................................................................................................!.......!..ImageMagick.gamma=0.45455.,...........@.......d2p....K...Z..+u....V..*..d.z...Q..|N..QEUi....|*F&$......&F....F#......F"......F!......F .......... .........F.......F.......F.......F............F.......F.......F.......F.......h......*LhD...#J..Q...2j.......$h@...(K"0.A@J....l.S.....(.$@..'A..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\toolbutton-pa.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 28 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):800
                                                                                                                                                                                                                          Entropy (8bit):6.411688335693497
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:NV3wxf+Ubgc/QhLg9O3s3cITLB1MwP89Rsv:P36+agMO3+fDMwPsY
                                                                                                                                                                                                                          MD5:491EE39F4F34B3B0F7BA29CE0812890B
                                                                                                                                                                                                                          SHA1:079060CFCAE3D27A572058424879B36E5B35D822
                                                                                                                                                                                                                          SHA-256:AE5348939FDA08D2C0D43A788A54F207BEDD66D684FEB8575F4D29874F5D1E26
                                                                                                                                                                                                                          SHA-512:61D10F9BF5421CD958642488364FF2BA647896888A4D551BBFDCA1A444778173088AE99712CAC39E5287EEF45AB47908967F00DACEFA4BD54A78B05C646E7A33
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....H..[.._..`..h..h..v..x...................................................................................................................................................................................................................................................................................................................................................................!.......!..Created with GIMP.!..ImageMagick.gamma=0.45455.,............H(..........(..%'AFG....GFA'%..&)5@EEDC....D.@5)$.=.><;....;<>.=.BB?:8.....:?.9987.....8.6.......4......3.......2.......1......4......."......#J.h...3j.h... C..i...(S.Lih..0c.iH..8s..ih..@...jH..H.*Mj...P.J.j..X.j.j...`..k(D...6.]..Z.L..2.@7...x....C....$h..A...0\.......,L......(..X.AB..AW..a....P ...u.......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\tree-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):345
                                                                                                                                                                                                                          Entropy (8bit):6.979890938347175
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:Hwa5KqWZO12BZDOcLgb+uY1fyz6FVKVVdI++HoHB+nvfsf60:HwqWssBZ/Lh/1nVtvHaasf60
                                                                                                                                                                                                                          MD5:0BA7282CA716E083BF6EC617C3F5C7D2
                                                                                                                                                                                                                          SHA1:88D74E614B675D41B67AB409832F74C5611597C0
                                                                                                                                                                                                                          SHA-256:BCBF56283B7543D2338DE8A0F1B32BF776DB985CC7930C2537FFC8E3E4B5B2FD
                                                                                                                                                                                                                          SHA-512:1763FC9C10F8CFCC0A8A7BD0AB9FFB72AE0687A83783D09B91B644C4D06450EFF9FDE2BCE4786D28E891E6C14EAB81260612B4F9E9741184E6CF213A40107F47
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......!..ImageMagick.gamma=0.45455.,........... .di.^.ml...y.ex......pH,.3..r.l:/".tJ.Z-..v..z+".xL..)..z.n.'".|N..%..~...#"...........".......".......".......".......".......".......".......".......".........."............'...!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\tree-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):455
                                                                                                                                                                                                                          Entropy (8bit):6.051875729297079
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HCSAiXR2Ydj0ncT5Rl2cL45UoV0yxfVQlWmt6GQ90FzGqP0/AsGNUGS2sL9rE:HCEXR2biD5LMO2nm4GljPjVNQ2sLxE
                                                                                                                                                                                                                          MD5:4F5505E112E49A1955FA1C4144A3D0C8
                                                                                                                                                                                                                          SHA1:3073B0FD337F322667B0ECE60C62FEF9F4656727
                                                                                                                                                                                                                          SHA-256:2512676D272DACED88C15E4F2A78D1C850BCDE35E1E25DBB8D9E587A6A4255B4
                                                                                                                                                                                                                          SHA-512:B632183B3246869DE25A4017534A105D80182BE0560CBC07D9900130664D173C82B1B1B2D8446E70E9B3D74B89AA07A39BBA2F610CEAA243902284BC459465A3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................................................................................................................!.......!..ImageMagick.gamma=0.45455.,...........@.pH,...O..l:....#.m4.v.....xL..5B.z.n.1.|N../B.~...-B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B..........B........H@...G.*....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\tree-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):455
                                                                                                                                                                                                                          Entropy (8bit):6.051875729297079
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HCSAiXR2Ydj0ncT5Rl2cL45UoV0yxfVQlWmt6GQ90FzGqP0/AsGNUGS2sL9rE:HCEXR2biD5LMO2nm4GljPjVNQ2sLxE
                                                                                                                                                                                                                          MD5:4F5505E112E49A1955FA1C4144A3D0C8
                                                                                                                                                                                                                          SHA1:3073B0FD337F322667B0ECE60C62FEF9F4656727
                                                                                                                                                                                                                          SHA-256:2512676D272DACED88C15E4F2A78D1C850BCDE35E1E25DBB8D9E587A6A4255B4
                                                                                                                                                                                                                          SHA-512:B632183B3246869DE25A4017534A105D80182BE0560CBC07D9900130664D173C82B1B1B2D8446E70E9B3D74B89AA07A39BBA2F610CEAA243902284BC459465A3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................................................................................................................!.......!..ImageMagick.gamma=0.45455.,...........@.pH,...O..l:....#.m4.v.....xL..5B.z.n.1.|N../B.~...-B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B..........B........H@...G.*....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpink\tree-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):345
                                                                                                                                                                                                                          Entropy (8bit):6.71928393032399
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HHhbJtLumHULDOcLgIsU2A+owNdFBvRMI++HoHB+nvfsf60:HVjamHU//LUUAJPFBRtvHaasf60
                                                                                                                                                                                                                          MD5:A6BA9390FB6EAD270342F3F55CC537A2
                                                                                                                                                                                                                          SHA1:3E3FCD6C54656888DA4BEC080331FBADC5B41701
                                                                                                                                                                                                                          SHA-256:87920C669615487DE298A9CAC419B7DD72E79987B210E6CE7440B1B4EE1B4EEB
                                                                                                                                                                                                                          SHA-512:73AF22C941A926538647DE919FB8524721151837551B0148BB2B957F50711BCE4A3306E0349BBA56BBFD5C4BD1BBA06FE2366966DECCC88DC585FB6B0D065AAF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a......................................................................................................!.......!..ImageMagick.gamma=0.45455.,........... .di.^.ml...y.ex......0#.....#.8...".X...".x.."...."....|".....^".......".......".......".......".......".......".......".......".......".......".........."............'...!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\blank.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):92
                                                                                                                                                                                                                          Entropy (8bit):4.915776869423991
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CE/7yltzgNrHHCEOGOLSU1en:HILSU1e
                                                                                                                                                                                                                          MD5:9F3940648EC830E5180E79B1D799A347
                                                                                                                                                                                                                          SHA1:EAB0529F7FC30D50DA53B042AF0BDDA127FCA573
                                                                                                                                                                                                                          SHA-256:E6B5B7A553293B377AD7368426B90EDAC14BDA4D7B3F3FF09F5D935D56E79DFB
                                                                                                                                                                                                                          SHA-512:2764DFF79DC098EC8F8C09D5E6DFC370785258188DD8877F19416E0C32584DDF3113ADF2BC1C87CB2AA9E2E9FEF526C76E37B1F899228885471A209EC8A2420F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......!..ImageMagick.gamma=0.45455.,...........................H.S..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\button-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 28 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):382
                                                                                                                                                                                                                          Entropy (8bit):7.050420912396424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:dVL2FS2Ydj0w6ycrMcLaOwKuxcQJT4dhYbwGzHWGsofq+HOzxEiPi7CfR:n2M2bw61La91pyqwGSHUqlzja76R
                                                                                                                                                                                                                          MD5:5FD15DFA4911A902624C391204A32683
                                                                                                                                                                                                                          SHA1:44A55BD282C7728343FE3DE40FD30DF06456288E
                                                                                                                                                                                                                          SHA-256:47E205BCCEE28540084DCE0E1035467742121E07FCFB852C32EF93830F83F308
                                                                                                                                                                                                                          SHA-512:D2130901A5B8E9BAB6BF34716C5AB3D572096DDAC0453F696B8A004F2C1044996ADDC86E2D58E3926FB8E98B36130310314F30B1B4B9519BBA4DC6B065F88E25
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........[._.`.h.h.................................................................................!.......!..ImageMagick.gamma=0.45455.,...........`..@i.h..b2.pl.I.y_.ww...NI......x.8...y.X...z.x...{....|.....}......~.......'.......%.........'.......'.......'.......'.......'.......'.......'.......'.......'.......'-....'.........................%.d.DAC...2V....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\button-a1p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 28 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):525
                                                                                                                                                                                                                          Entropy (8bit):7.012662788084145
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:hLU73m2bBWPHRtn5LKvXOyyH/w+iyJOjGw+ncLdwGxD:hLcnbIJhyOyyfsyJMGwYc5wGxD
                                                                                                                                                                                                                          MD5:92BCA1A2E79365F8FC3AEB92ED28EE28
                                                                                                                                                                                                                          SHA1:C8C9203919BA44C41911DB34A069843A867A4444
                                                                                                                                                                                                                          SHA-256:A068C0FA8BFAF0AD09D6DF9D3A07D43DAE24ECF1A178792DF8FF2DC40BB16297
                                                                                                                                                                                                                          SHA-512:4FDC66A4B8723C19AA62D6B588FE3B00488A2330EA75BAB2F6CD2AC910B82E5D9B7ED671EB38C0834BC5A6BF165E4617C1698837A89F98873BF5A6B33E3F608B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....5..[._.`.h.h.v.x.......................................................................................................................................................................!.......!..ImageMagick.gamma=0.45455.,.............'!....dR......kF.Z.X......XL.+..d.z...[..|N..[.j....|/F+)......+F(......F'......F&......F%......F$......F#........"......F!......F ......F.......F.......F.......F.......F.......F......(.....*\.....#J.(.H...3j..1c.^. ..I..... P..0c.\...../.0..@'..'...PB.h..N...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\button-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 28 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):559
                                                                                                                                                                                                                          Entropy (8bit):7.051041943001878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:I9z6eWjW1A/ALR8I6KPsM1UGsWmU/hyS8IhurAe9Yan6:ILoW5LzP79hyS8IhW9tn6
                                                                                                                                                                                                                          MD5:6910FFA258D2C329F87C9AF02F167967
                                                                                                                                                                                                                          SHA1:C99761E996F1E3486EFD234C96808DEA6A713DB5
                                                                                                                                                                                                                          SHA-256:AF4FE13771079C7AD6AAB7BEA8F5915DD88194429A9100950AADC227E79D062E
                                                                                                                                                                                                                          SHA-512:3F6E7F955589DCC383AF9D8AF1E9A5FD72FFFB440A4D4F086881E3EA5D089FAF768C7E4CBB3424FBB63345E4F7A0E29C485206B6AC430657E828F592EC1D38DE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................................................................................................................!.....1.!..Created with GIMP.!..ImageMagick.gamma=0.454545.,..............")....er<&c1...r.`.v.{.R.K,.Z...4z.^E...|N.....~.w4Z,.......,..+........*........)........(........'........&........%........$..............#......x"......~!...... ...............<..H.....8(\.....J.....3b..#...4..I.....`.a..#]j`..e...b..@.&.I.?3....@..H.".0@.Q.I......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\button-default.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 28 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):550
                                                                                                                                                                                                                          Entropy (8bit):7.2353803794254645
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:yROu2fXPR8XFo2o/qush1oosJmQMtnyS1n:0WfN2o/zsh1kmQMks
                                                                                                                                                                                                                          MD5:833C0259908D1F1AF01A5C0627B0F2EB
                                                                                                                                                                                                                          SHA1:8A6747689D5EB0B4F0E99B01640CA017220EE48F
                                                                                                                                                                                                                          SHA-256:6D8E082B7C935F61150335A0CF01F606126E8CD08A118948C3A0C507AD8F08EE
                                                                                                                                                                                                                          SHA-512:20E6588E93F061BE45486A436B019EE435CD781DBF519A68D6085FBB46743E87F4FC617537BDC9944788C34531A7BD3BECA9C20E5771C3ECA496691117B1BC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................................................................................................................!.....7.!..ImageMagick.gamma=0.454545.,............[.2)...K.r<R...F.r.j..v..h.U.&q...:.^.$..LN.............21.......1..0......../.................-........,........+........*........)........(........'......|&......%......$.......#...H. AP".*\.!.T "J.H."EY.2j..#.]"B..).$.&C......0_.8..C...b.....&..4..Q`.O..9lH..@......Juj....V...@. .;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\button-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 28 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):548
                                                                                                                                                                                                                          Entropy (8bit):7.138253180301679
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:yR8su2fXi8Ntb6OWkmPIVjvFW0ovbFjSiOF9Kg9mS7O:0Nfh1WLMvk3bZSiOF9b7O
                                                                                                                                                                                                                          MD5:E7DD8E7E8E8E2C91F1C54BB55D524015
                                                                                                                                                                                                                          SHA1:8994C05004EBCCCEF17787DDFD050E4143137B0E
                                                                                                                                                                                                                          SHA-256:BD47EC4EF2A5D0799B460B548DE256C4F81063D720AFE3F68C9DCDB3A7192AE1
                                                                                                                                                                                                                          SHA-512:8633DFD239C5D416211B1647D87F946A30F4B9C8DAD2C538DA3F8C64F6C269F2C86AC49277A663E1A0033FF50A4F13D2D7D69180BDBA1C5BE01E5316D6EED189
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................................................................................................................!.....6.!..ImageMagick.gamma=0.454545.,...........@..2)...K.r<R.B[&..j.v[..Z).M.z...4z.~I 3Y|....v.......10.......0../.................-........,........+........*........)........(........'........&......{%......$......#......."....Hp....*\.p!...#J.Hqb,..3j..q... @..Ir.. .qX........C..0Y..P.&$.....(..g..4 .P .....J..`...S.. $..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\button-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 28 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):363
                                                                                                                                                                                                                          Entropy (8bit):6.896798204038558
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:dr1cBQKadGlLel2cLni7qkSujaMlwZhsNsASuUDNsAX9bse82UfnP3en:fcBL6Glq5Lni7KWaMlIGsHuUKYUfnW
                                                                                                                                                                                                                          MD5:232B7003597B3D746F1F760F1CA295DE
                                                                                                                                                                                                                          SHA1:36DF5EDB79D6CE018BC35CA0B516DAAB181A1955
                                                                                                                                                                                                                          SHA-256:9B13584F50E498E74717BEC0C7633A8A66342DF1ABE60156F446FBDCE582E480
                                                                                                                                                                                                                          SHA-512:54CDE6CF9982D0F4805B86B77C15A2D6C42C3A1D50D9B860021A2B3FE127437487F59C228C22593D07F1F319307DC7CE4EA060B41E744F4599BA725A884464CC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......}O..S..Z........................................................................................!.......!..ImageMagick.gamma=0.45455.,............u..`.h...0.f....m.|..%.pH,..$Se.l:.L.eJ.Z.T)v.EM..x.FI..z.FE..|.GA...~.....@........(.......(.......(.......(...........(.......(.......(.......(.......(.......(..............I........&..1.*-..1"!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\button-p1p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 28 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):515
                                                                                                                                                                                                                          Entropy (8bit):6.816095608742599
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:twmBpx6GlxMw45LLStg8kXz53bAQjguXGR3:xBpxrylStg8kj1sQjgoGt
                                                                                                                                                                                                                          MD5:CA570FF0A982B555D82A164896F4762C
                                                                                                                                                                                                                          SHA1:82AA244B232EB47B07BC85919102C0309CA5A65E
                                                                                                                                                                                                                          SHA-256:86DDA2BB55FAE2CFF133D3D29B6DDBFFFF13BED89DF7D22CE959F89219C4091F
                                                                                                                                                                                                                          SHA-512:4B19E4D7F7AF1429776667DB6D5BF0BBD64303434FB500655383C805D7B8707B2EB3D8A56EB19AFBBA1AAD34E94D3A723C594C73190D410C59B4688BCB4280BA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......}O..S..Z..g..h...............................................................................................................................................................................!.......!..ImageMagick.gamma=0.45455.,...........@.&.....d2.........Z..Ku.......*..d.z...Q..|N..Q.Ti....|)F&$......&F....F#......F"......F!......F .......... .........F.......F.......F.......F............F.......F.......F.......F.......h......*LhD...#J..Q.-..2j...F....h@...(K.@.A@J....l.S.....(.$@..'A..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\button-pa.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 28 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):800
                                                                                                                                                                                                                          Entropy (8bit):6.417050763657923
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:lKieFXZD+v6T//QhLg9OWolcITLB1MYqViV:NeFcixOWorfDMYqW
                                                                                                                                                                                                                          MD5:48114B30436F5A62A3BBD9E804ADB3AD
                                                                                                                                                                                                                          SHA1:AE6CAC403119C22E14CE55AE066349D281007A6E
                                                                                                                                                                                                                          SHA-256:D7EE3AE306DCBCD5010F257A4DAFA0C523934B04087072BC6AE219A09AD1344B
                                                                                                                                                                                                                          SHA-512:F555AB0D526E6EE54760BB71C00B2E7B39142B30D5E9A72B3C79D107B4BCAF0FC237A251F4D2D3E626B641F6A60CE6D0A0C15000C80E13E5D5C71C1CDD8CA68A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....H..[._.`.h.h.v.x...................................................................................................................................................................................................................................................................................................................................................................!.......!..Created with GIMP.!..ImageMagick.gamma=0.45455.,............H(..........(..$'@FG....GF@'$..&)5ADDEC....E.A5)%.>.=<;....;<=.>.BB?:8.....:?.9987.....8.6.......4......3.......2.......1......4......."......#J.h...3j.h... C..i...(S.Lih..0c.iH..8s..ih..@...jH..H.*Mj...P.J.j..X.j.j...`..k(D...6.]..Z.L..2.@7...x....C....$`..A...0\.......,P...A..(..X.A...AO..a....P ...u.......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\check-ac.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):304
                                                                                                                                                                                                                          Entropy (8bit):6.841376775320791
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NuNXJl6tSp63sexdQb5CgQkLIkCkv4T2jGpXCDT:cp6tSp68xLJLIkCkv4SapXCX
                                                                                                                                                                                                                          MD5:AA1FD62599CB61A95C7E1DD9E182A81C
                                                                                                                                                                                                                          SHA1:840E157F26EFFFB9D198291B379BC6B3EE862AAD
                                                                                                                                                                                                                          SHA-256:690038DDCE4B2790F0D881474D67359A5D1B588615B733C9E8FE30856A10C7CB
                                                                                                                                                                                                                          SHA-512:A9781E2E4A0EE9216509E4376032FA6050A8DB99353EB2D89428565F05019E740C5091CD63BE1513B3FDB29F2B8AA8D0B0C2A0BF81B7C3A58A14B68E7A44EC5F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......X7w[9{_;.j^tfffgggth~|||}}}a=.d>.f@.hB.mC.{Q..T..P..U..W..W..W..Y..Y..X..X..Y..Y..Z.[..........!.......!..Created with GIMP.!..ImageMagick.gamma=0.45455.,..........{.'.d9.h....@p.;.!..D..>=6.!.i...M$H.p....*.H..Et.YX...B..s(`N".].......p.L.'...;...L........A........"..........#..+)..&.%!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\check-au.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):292
                                                                                                                                                                                                                          Entropy (8bit):6.534243281201697
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NYfkHU8gbxMJI3OemXhCgQkLX6mp4dHAXsVIwO9sJiGgge:e4gbxMJyOJhLJLD4drayiGy
                                                                                                                                                                                                                          MD5:1BBC80FB918305995300DD8DFD3614EF
                                                                                                                                                                                                                          SHA1:DE4FB09592834DED411B5689B5EECB0E53E9D6D5
                                                                                                                                                                                                                          SHA-256:DB2B8DCA5A79138DD6F77417799DBA2589C2C6D9AEC8E84B6C4944064E440ECB
                                                                                                                                                                                                                          SHA-512:6B921128778A48665348A2EDF2762D84D5824C11D93F25B6835E0FD1CC9F40B72759E482F7476747ECDE3AB859365E3070749A83C1C3687EC6F22B3DDC2BFA28
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......!..Created with GIMP.!..ImageMagick.gamma=0.45455.,..........o.&.d):.......@tM?.!..T...$..I,..2i..5..&C.R1..h .Z.....V.....-..k/. J...Hq.b.{}f....HKJ....................!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\check-dc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):281
                                                                                                                                                                                                                          Entropy (8bit):6.633491306812876
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NcFrgiDUn9c4oRLAEB1soZW/CSexm8oyqE:yOiAn9c4eL91mKSimvyB
                                                                                                                                                                                                                          MD5:6BAD2FF5A2432BFCB5A97498AECDB675
                                                                                                                                                                                                                          SHA1:4161FEA1FFC0F5C44E987FB252E006FB0129EBF0
                                                                                                                                                                                                                          SHA-256:EB4E61A82A75A444F331A0727617099891AC1DF4F4EA2BBDD6DFC8B283BD8132
                                                                                                                                                                                                                          SHA-512:4E37029F50FE52F55F7973D004E8C9429EA4271E686A466F5B7485238379D910D3352EB1424F3C1F9879793EF7FB21791CEEDFDF11BC0A35448116F0F19C3D09
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......w].|_.}a..}..b..c..e..f..g..r..u..r..v.y.w.w.w.x.y.y.z.z..............................!.......!..ImageMagick.gamma=0.45455.,..........y '.d9Zh...,p.'.%Z.....)6..AA..F.#hyT....*.<.NCt.1X..J...W.....].......T".J ..o.wL........A........"..........#..+)..&.%!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\check-du.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):292
                                                                                                                                                                                                                          Entropy (8bit):6.534243281201697
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NYfkHU8gbxMJI3OemXhCgQkLX6mp4dHAXsVIwO9sJiGgge:e4gbxMJyOJhLJLD4drayiGy
                                                                                                                                                                                                                          MD5:1BBC80FB918305995300DD8DFD3614EF
                                                                                                                                                                                                                          SHA1:DE4FB09592834DED411B5689B5EECB0E53E9D6D5
                                                                                                                                                                                                                          SHA-256:DB2B8DCA5A79138DD6F77417799DBA2589C2C6D9AEC8E84B6C4944064E440ECB
                                                                                                                                                                                                                          SHA-512:6B921128778A48665348A2EDF2762D84D5824C11D93F25B6835E0FD1CC9F40B72759E482F7476747ECDE3AB859365E3070749A83C1C3687EC6F22B3DDC2BFA28
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......!..Created with GIMP.!..ImageMagick.gamma=0.45455.,..........o.&.d):.......@tM?.!..T...$..I,..2i..5..&C.R1..h .Z.....V.....-..k/. J...Hq.b.{}f....HKJ....................!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\check-hu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):258
                                                                                                                                                                                                                          Entropy (8bit):6.236918377564035
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NwXGfSp63sex8XoIkLDjO7uM9qSedhaBYuXEMe:ZSp68zoRLDjauM9qtdhKZJe
                                                                                                                                                                                                                          MD5:E1058ACE69D37DDA9DEAF04CB4DDF454
                                                                                                                                                                                                                          SHA1:DCC7629BB9803C39259088730B465D8954A78673
                                                                                                                                                                                                                          SHA-256:1C9440A5668E5B66DD8DEC6894E74E96BFC004FC5535FCE23B53231ED61AB711
                                                                                                                                                                                                                          SHA-512:270F7538D84DFCCB19E9D9005823AEBAFEB400EAC818523F385F3831EE1CDCFCEA9A1429405399E66A007D7B3BA84E70822B8BD26F864F13D48E1B095952141B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......j^tfffgggth~|||}}}{Q..T..P..U..W..W..W..Y..Y..X..X..Y..Y..Z.[..................................!.......!..ImageMagick.gamma=0.45455.,..........b.%.d9.h..'` p..@ .......6K 1....I".PP.H.....L..Z.0.[....C).&...0#.k$(hP..|C ".........#..+)..&.%!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\check-nc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):304
                                                                                                                                                                                                                          Entropy (8bit):6.841376775320791
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NuNXJl6tSp63sexdQb5CgQkLIkCkv4T2jGpXCDT:cp6tSp68xLJLIkCkv4SapXCX
                                                                                                                                                                                                                          MD5:AA1FD62599CB61A95C7E1DD9E182A81C
                                                                                                                                                                                                                          SHA1:840E157F26EFFFB9D198291B379BC6B3EE862AAD
                                                                                                                                                                                                                          SHA-256:690038DDCE4B2790F0D881474D67359A5D1B588615B733C9E8FE30856A10C7CB
                                                                                                                                                                                                                          SHA-512:A9781E2E4A0EE9216509E4376032FA6050A8DB99353EB2D89428565F05019E740C5091CD63BE1513B3FDB29F2B8AA8D0B0C2A0BF81B7C3A58A14B68E7A44EC5F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......X7w[9{_;.j^tfffgggth~|||}}}a=.d>.f@.hB.mC.{Q..T..P..U..W..W..W..Y..Y..X..X..Y..Y..Z.[..........!.......!..Created with GIMP.!..ImageMagick.gamma=0.45455.,..........{.'.d9.h....@p.;.!..D..>=6.!.i...M$H.p....*.H..Et.YX...B..s(`N".].......p.L.'...;...L........A........"..........#..+)..&.%!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\check-nu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):292
                                                                                                                                                                                                                          Entropy (8bit):6.534243281201697
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NYfkHU8gbxMJI3OemXhCgQkLX6mp4dHAXsVIwO9sJiGgge:e4gbxMJyOJhLJLD4drayiGy
                                                                                                                                                                                                                          MD5:1BBC80FB918305995300DD8DFD3614EF
                                                                                                                                                                                                                          SHA1:DE4FB09592834DED411B5689B5EECB0E53E9D6D5
                                                                                                                                                                                                                          SHA-256:DB2B8DCA5A79138DD6F77417799DBA2589C2C6D9AEC8E84B6C4944064E440ECB
                                                                                                                                                                                                                          SHA-512:6B921128778A48665348A2EDF2762D84D5824C11D93F25B6835E0FD1CC9F40B72759E482F7476747ECDE3AB859365E3070749A83C1C3687EC6F22B3DDC2BFA28
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......!..Created with GIMP.!..ImageMagick.gamma=0.45455.,..........o.&.d):.......@tM?.!..T...$..I,..2i..5..&C.R1..h .Z.....V.....-..k/. J...Hq.b.{}f....HKJ....................!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\check-pc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):304
                                                                                                                                                                                                                          Entropy (8bit):6.841376775320791
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NuNXJl6tSp63sexdQb5CgQkLIkCkv4T2jGpXCDT:cp6tSp68xLJLIkCkv4SapXCX
                                                                                                                                                                                                                          MD5:AA1FD62599CB61A95C7E1DD9E182A81C
                                                                                                                                                                                                                          SHA1:840E157F26EFFFB9D198291B379BC6B3EE862AAD
                                                                                                                                                                                                                          SHA-256:690038DDCE4B2790F0D881474D67359A5D1B588615B733C9E8FE30856A10C7CB
                                                                                                                                                                                                                          SHA-512:A9781E2E4A0EE9216509E4376032FA6050A8DB99353EB2D89428565F05019E740C5091CD63BE1513B3FDB29F2B8AA8D0B0C2A0BF81B7C3A58A14B68E7A44EC5F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......X7w[9{_;.j^tfffgggth~|||}}}a=.d>.f@.hB.mC.{Q..T..P..U..W..W..W..Y..Y..X..X..Y..Y..Z.[..........!.......!..Created with GIMP.!..ImageMagick.gamma=0.45455.,..........{.'.d9.h....@p.;.!..D..>=6.!.i...M$H.p....*.H..Et.YX...B..s(`N".].......p.L.'...;...L........A........"..........#..+)..&.%!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\check-pu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):250
                                                                                                                                                                                                                          Entropy (8bit):6.102331857529333
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CsDDRWJZ1YrNZSpy3ySM7exZr/lbylez0rNrHHCEOGOL0dCF4fjELnd9cvyOd63w:NwXGfSp63sexV3z0kLfO4DOdL5X
                                                                                                                                                                                                                          MD5:07FD63932FFE2BFBE5AC2BAAE2B9AF83
                                                                                                                                                                                                                          SHA1:2ECF65E9DE775A6D56B1F34409E9B6E8EA8A3706
                                                                                                                                                                                                                          SHA-256:36E50A149CF0BEAAF484AD43FEDFD309FAA23F34C4F06D61B713E31338E95EDA
                                                                                                                                                                                                                          SHA-512:F8CA96A6F1B71895C3254E719E09AD0A3FF02344CE7615AB455D7D5963C90B13556EF7936D557F95DC5E7D584D9B4A5E97140EC2D9C99815470240A63F85F793
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......j^tfffgggth~|||}}}{Q..T..P..U..W..W..W..Y..Y..X..X..Y..Y..Z.[..................................!.......!..ImageMagick.gamma=0.45455.,..........Z`%.d9.h..'` p..@ ........J 1....I".P .....=Jo....j)...Ky0!d.3B....rC "....>...F..+)..&.%!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\combo-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):151
                                                                                                                                                                                                                          Entropy (8bit):5.69214773407456
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEvFtAZaaull/rylhE2cNrHHCEOGOLDtwRq39vFgTEPuODRrKuwIzKXxyP/n:HYkauX+RLxqEvD3wIzEyH
                                                                                                                                                                                                                          MD5:EB063B68CBC9573FE1C4799A16A69A4F
                                                                                                                                                                                                                          SHA1:864FF25B3104020AA09F24E4FC66DD0B88604D09
                                                                                                                                                                                                                          SHA-256:CB5FEBB987210DF3F37CFE02DAC53336FEB71BC1EB9799F0CC339DD9564A93C8
                                                                                                                                                                                                                          SHA-512:C4F22192A6AD952FF7AC2F34DF182C1C5D3902C0C0CABBBA9B9C03C8376B11FF37290EC923376D471C38DB34B1C596433EE61DB0FAC156626C51F2BE70762655
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......!..ImageMagick.gamma=0.45455.,..........?H....,A..X.1..`8lb).f...'......*....^...m.Y..l5U.T..v..l$..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\combo-ra.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):134
                                                                                                                                                                                                                          Entropy (8bit):5.797471016796787
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEJGl0zgNrHHCEOGOLLvYoGdqLkMenyaBKnMNVqGen:HJTz9LhGxy+NQ
                                                                                                                                                                                                                          MD5:8BC6334F883672E29F3AFA957D6DD224
                                                                                                                                                                                                                          SHA1:A0B2C6515D911DED1F1DA49883ADB253CAC347D0
                                                                                                                                                                                                                          SHA-256:4CF62A76CD6090344978A693F2336914720F5E00C54DCCE5F1E803F58B788AA3
                                                                                                                                                                                                                          SHA-512:A70995774467C99B86C188860F07AF45D6B670C0FF2080CCE5C95FA33317287B00644A3F3558E9CC1024F2468C46F8A7F50DC4E397912E9CA827F9B29F122CB7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........[.........!.......!..ImageMagick.gamma=0.45455.,..........:....}.#@...H.k..(zd.........)om=.8-.....(b.(..*..3a@<%..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\combo-rd.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):151
                                                                                                                                                                                                                          Entropy (8bit):5.7790312802915365
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEvhwUPCSl/rylhE2cNrHHCEOGOLDtwRq39vFgTEPuODRrKuwIzKXxyP/n:HKRG+RLxqEvD3wIzEyH
                                                                                                                                                                                                                          MD5:3B7396C29B7AB438D3448F63DB6AF2A9
                                                                                                                                                                                                                          SHA1:F86DD580397B75BBCEDDF9F3BE496C67DE964C24
                                                                                                                                                                                                                          SHA-256:DA47EF8AF8C696DAE02F99D7B0A55E5ACB927E471E78A833D6AF06D50FAC994D
                                                                                                                                                                                                                          SHA-512:D8A21D2654D2C6D195B77F2DD4685E18734B26EC31BDFFA8AE73227B4BC8C5081CBE4E0C4A5FA1DE0C4504DBD980D77174704FFD34FBC211E960594C347403CF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........S......................!.......!..ImageMagick.gamma=0.45455.,..........?H....,A..X.1..`8lb).f...'......*....^...m.Y..l5U.T..v..l$..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\combo-rf.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):153
                                                                                                                                                                                                                          Entropy (8bit):6.001915278055444
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEuo4+B7czl2agNrHHCEOGOLYGvlUNqP7dQsTPjbIuCnOyz6QtrZW5+x5NW:H54+C4cLY+lUNqBpbbmNbrZBxTW
                                                                                                                                                                                                                          MD5:920539D0005C3B489FBA08B110C76CC6
                                                                                                                                                                                                                          SHA1:ECE7FB88A34F5AD1CEAAEF8CA4B0821A84638130
                                                                                                                                                                                                                          SHA-256:62CC8E30CFE6E89A365D21E6F49775892FBE07648DEA55CD2664D172BC74C5AE
                                                                                                                                                                                                                          SHA-512:B6E05438A9BEF182DA77336E4C91640A95CFC9EC66C286C7353A93E98336334964CE6C658DB16575E6211B138D8663FED12EF159D9AF863AB587C440A5700F68
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......|N..........!.......!..ImageMagick.gamma=0.45455.,..........MT...p...T.1...........)vjF......c..k-.}x=.P.C.49.Pi.9Y....;iS(&q.U...C..(..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\combo-rn.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):137
                                                                                                                                                                                                                          Entropy (8bit):5.8967362626308475
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEuo4+B7czl2agNrHHCEOGOLilMvlUNqP7NQCWyY2vmO42EW:H54+C4cLiClUNqRrWL2vQfW
                                                                                                                                                                                                                          MD5:9069097D0CDC84C5446D1E50848F0102
                                                                                                                                                                                                                          SHA1:C8C0750452B2F3A6D5AB7BCB328427D3133495C8
                                                                                                                                                                                                                          SHA-256:45357C7CC1A9C394B3871022899CAE4F033CE476497F6F5608280EC441A24758
                                                                                                                                                                                                                          SHA-512:650D084E5D4BC6766DD1212EB39BF7B41943C83D44B6E1C87111AB360A6984E3F82AF9FDC1B4AD99C5BDDBAFFAFCF220F328C25DB754B1753FEFE2A346D62522
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......|N..........!.......!..ImageMagick.gamma=0.45455.,..........=T...p...T.1.....(..i.h:bl..[,.n=...F..e.W.uL%M.RSt.e..j...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\combo-rp.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):137
                                                                                                                                                                                                                          Entropy (8bit):5.8967362626308475
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEmkQJ2agNrHHCEOGOLilMvlUNqP7NQCWyY2vmO42EW:HBQ4cLiClUNqRrWL2vQfW
                                                                                                                                                                                                                          MD5:2D38BA6FB99C3F71FA0945F83712C742
                                                                                                                                                                                                                          SHA1:D77417CE2C8C012C2E42D7C96CD15937E07D62EA
                                                                                                                                                                                                                          SHA-256:C7D38BC828A3154BC529C6A3C783927C0D1F44A5DCC2D14895767B20CC957C00
                                                                                                                                                                                                                          SHA-512:BF4C442500880CE5AF45B2F7FDC9AD72FA68B5065524FFD7B6E86C77981A8DEE9E8456B65ADAA3A443EF0FAECD1DEFB23AF6BA7089C3F121D66221C850ADB111
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......xJ..{......!.......!..ImageMagick.gamma=0.45455.,..........=T...p...T.1.....(..i.h:bl..[,.n=...F..e.W.uL%M.RSt.e..j...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\comboarrow-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):404
                                                                                                                                                                                                                          Entropy (8bit):6.359834810605032
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:LwKq1+h5uLa0A79mgs3l2cLG0xQDFO8dCH5akCfgH:Lo+hwLfA79mt5LEoZaFIH
                                                                                                                                                                                                                          MD5:9E87DEBFD997DA83560758E747DBD73D
                                                                                                                                                                                                                          SHA1:E3EC82C3F9920D1FD104164C49543C104115623F
                                                                                                                                                                                                                          SHA-256:7FD6DB9F0B8849229A5D87511ED6D03F8264494F43D87D335AFA014F5E034664
                                                                                                                                                                                                                          SHA-512:8200716EDDB3DC6C957FC6C22B173C970F6FA37A64A1992F2772F344DD7B18585EFF71646D4589C349889D56C1F4EA94726AFF153B0CDC03280AE75DB53741BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......@@@EEEHHHJJJLLLOOO\\\gggwww~~~....[............................................................................................................................................................!.......!..ImageMagick.gamma=0.45455.,.............p8td2...X9...BE.V...V;Dy...iL&.M#.zD*....|.P.#.....~ .....!C#.......#C" ..... "C!!......~.......C.......C....C....CG........C....C.......RJEH.KGA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\comboarrow-af.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):409
                                                                                                                                                                                                                          Entropy (8bit):6.435843041723439
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:LwKq1+h5uLa0A7eNecjPl2cLe627fYrZrkhoVNFb7/K7lqn6t0hFe:Lo+hwLfA7Sem5LejWesNFXgPp
                                                                                                                                                                                                                          MD5:423B8004B79F01F0AFF0DC32693CA58C
                                                                                                                                                                                                                          SHA1:A23AEDF3098D50376A64CF7F1F25F0CB2F71F322
                                                                                                                                                                                                                          SHA-256:1CEAA0F925BBE85E46BA3D63258270352284A2BC0583D9B9914CDB45060D32E6
                                                                                                                                                                                                                          SHA-512:3F2539AD8BB513EF92A552478A826CC7559228B67B17B1CB5AE820634EBEFD785C653BE1B495F399AA7EA7742D3D6F12E04876C129965745B845D27C89F6B7C0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......@@@EEEHHHJJJLLLOOO\\\gggwww~~~....[............................................................................................................................................................!.......!..ImageMagick.gamma=0.45455.,.............p8td2....j:.K.tJ....P..z...x,D.F..d:.K..|.P.#....y. .....!B##.......#Bi ..... "B!.......B........B.......B....B....BG..H.......B....B.......KJDF.BF.A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\comboarrow-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):646
                                                                                                                                                                                                                          Entropy (8bit):5.912195847114442
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:LWK3eQ2x+RA7jDR8kQLkgc202i/+Yk67a:zedYRAjlQAFx/XkIa
                                                                                                                                                                                                                          MD5:3663555DB1853CEDFF3667D99E61012C
                                                                                                                                                                                                                          SHA1:C3FBCB27BEBDC65A58AF07FAC28FA840D6AEF208
                                                                                                                                                                                                                          SHA-256:C18E53965D8C425F67FFD4BDEF0F7F88DF30170502F299EF39ACAC3B4ED5C945
                                                                                                                                                                                                                          SHA-512:F256B798FC3A082278BD835C3162EC03FCC5C9093E2229E9F375C6BFE9C97132E1A6C80869A8517726F37A531D6010AFF307903BA74E7F5E566E1729067F7538
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......[[[```bbbdddfffhhhsss}}}........................................................................................................................................................................................................................................................................................................................................................................!.....C.!..ImageMagick.gamma=0.454545.,.................CCB..A@=9.C?...?.>...>.=...=.<...<.;...;.:954.5689:.7......7.7$....$7.72#....&37.55-.....-...3"...%3..3.-...-.3.2.2(.'1..1.......^(\..E...#Jl1a.E..^d.Qc.. C.\.....*@.D..#.."U.x0...6.8@...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\comboarrow-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):648
                                                                                                                                                                                                                          Entropy (8bit):5.961598998148554
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:LUqnyofY6w5Yu4Ga0A7Pjk2tlhl2i8rEE2MypTPBSKggFy9AkOStyRM+h:LyzDlfA7ZXhB8TzzKly9Ak+2+h
                                                                                                                                                                                                                          MD5:6E7C50B964772490D2CAC40C5024B618
                                                                                                                                                                                                                          SHA1:D4408BE3A3FC91C389869E9D95DC3A3E448E5B5B
                                                                                                                                                                                                                          SHA-256:04400DA00BD1F8DDFB75F19DCC43624E82074D6650B72680FF8DED878F12AF21
                                                                                                                                                                                                                          SHA-512:197EBFE46F6A3A87A10A41FEBA4A4027EF9476A5684053C61F115CF5B3D39E037FB03FA4BD795D710D92B6D3698C0D559FA6C31B49C5220FB5C386403245C106
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......@@@EEEHHHJJJLLLOOO\\\gggwww~~~..................................................................................................................................................................................................................................................................................................................................................................!.......!..ImageMagick.gamma=0.454545.,.................--E..DC@<.-B...B.A...A.@...@.?...?.>...>.=;76.78:;=.9......9.9$....$9.93#....&59.77-.........4"...%4..5.....-.5.3.3(.'2..2....@..`(\..F...#Jt1....$....#G..V..Ir...,V...R%..*S.T..A..8s.l..Q .;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\comboarrow-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):400
                                                                                                                                                                                                                          Entropy (8bit):5.734219472111407
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:Ll4ZR20RQF8HuVHl2i8avzjRBxNYHiLKisc+PGsS273gNrmGse:Lyg0yF8OVHB8yfLWiCPGR63g5mJe
                                                                                                                                                                                                                          MD5:A27D582D9AE6ADD1887B623F6949FE69
                                                                                                                                                                                                                          SHA1:368FCB94A67EDE669AE34D3B220F5A11ACADC3B7
                                                                                                                                                                                                                          SHA-256:70D9228ADB078937C9727FC194656B50E7807B4BF131F4AC8B623DC1347E79DC
                                                                                                                                                                                                                          SHA-512:4DD48892FB828D2A7D66A680C64EE34F76117E5ADEB924BD677AF9C977723710E389C43A8313130073A2A755544F115FFD6783D65F9B7BBDBCDBAAECEF8193ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......;;;@@@BBBDDDFFFIIIUUU___nnntttuuu...............................................................................................................................................................!.......!..ImageMagick.gamma=0.454545.,.............pH..B.r!.9...h...>..v..v...xL.....n.....A....NxC...................................................................................."D.L"A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\entry-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):140
                                                                                                                                                                                                                          Entropy (8bit):5.991194339178342
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEJGl0zgNrHHCEOGOLqm73imaK/2iRHeveL:HJTz9Lqmra5iVb
                                                                                                                                                                                                                          MD5:031FCEC42B06FF95FA17388B53EAE3C0
                                                                                                                                                                                                                          SHA1:F91180C876284722AE72A9C18D3642B97A01C039
                                                                                                                                                                                                                          SHA-256:99C8B13022565C7922E74B488513E7684EA3BB75D7123059CD2CBA128A85C087
                                                                                                                                                                                                                          SHA-512:720C663F44B0A871AFC324FE6423027C30FE2B3DF4E9DD4364CF397A8C955B01609F299D51C66F2C96791AF6798BABE33BF90DCBF149E29FFC9EE3800939D236
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........[.........!.......!..ImageMagick.gamma=0.45455.,..........@.....v...........KHbcI......fp|...._..Z4..X;"....Y.L.....x...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\entry-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):135
                                                                                                                                                                                                                          Entropy (8bit):5.910114780199734
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEUFlNOQkl0zgNrHEXHPcly/Ne1NPKA93OZA9nLEo1bpgEn:HceQdzd8MNep93gAFoAbn
                                                                                                                                                                                                                          MD5:D7627F536A1FB455BE05BC121A0B7AC0
                                                                                                                                                                                                                          SHA1:B02E4B7ADE8C3DE597D4852E953AAA1940ABE5F8
                                                                                                                                                                                                                          SHA-256:1C1A1241CA67D073394ADD7774B6D2BF229F9BAAAABA38CAD365D3D0FB1FF68D
                                                                                                                                                                                                                          SHA-512:5D41C74B9FEB3469A1B82A77A5D63281F49FE9DB1C3805A4D6873D7C1F5C01166B60011C539B88E2F9CBFF36775DB7D244A86B7FD584FFAE96113BD6ED64604C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......!..ImageMagick.gamma=0.454545.,..........:\...a ....S..h{.}^(jdY..Q....-.>B.....B.Q..$M.....2...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\entry-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):158
                                                                                                                                                                                                                          Entropy (8bit):5.738121926733303
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEvFtAZaaull/rylhE2cNrHHCEOGOLxKhFszhjZyD1CZ3G:HYkauX+RLxqy9o03G
                                                                                                                                                                                                                          MD5:AD66288603548A5EAA6604D4B78D2737
                                                                                                                                                                                                                          SHA1:C64B9A726EF8988392C5927132A0812A82578968
                                                                                                                                                                                                                          SHA-256:1DFF2F9E5C0DB4BFFAE26CCB1E8A225A39799970DEBF3C65F9B27EC07EB7020F
                                                                                                                                                                                                                          SHA-512:D49963602ADB37DFF6827EF5B813807C5EABE889731963DA3AF18E7B536C780EA173B7C1E21838E665D9118D745CAC36DE99CE446679A55857E5A249989464AA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......!..ImageMagick.gamma=0.45455.,..........FH.../( ....%..`..L'."I..-...L..=.z....p ..{G].5c.V.....C....L `.$..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\entry-rd.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):134
                                                                                                                                                                                                                          Entropy (8bit):5.997134356365172
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CE4EQkl0zgNrHHCEOGOLA/Ne1NPKA93OZA9nLEo1bpgEn:HJQdz9LeNep93gAFoAbn
                                                                                                                                                                                                                          MD5:7012DA2008305C550FFE259F7693953F
                                                                                                                                                                                                                          SHA1:51DC4ADBDE615BFC5211843F624D0E2763E0BD76
                                                                                                                                                                                                                          SHA-256:AF4A24D04A6F6DDE3A90F7EB2B298E022C40EBE4D15E50D6D30F8F6B51A8CCD1
                                                                                                                                                                                                                          SHA-512:AC9328DF66067480E1CE86DCFFDB862B368CB4AE5EF5A7F4B8B6FB58D3ED81A31DF03B3388A6EA52C1AB22996980BC33A264ADD06FA6CE3658FAB79DA2982ABB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........[.........!.......!..ImageMagick.gamma=0.45455.,..........:\...a ....S..h{.}^(jdY..Q....-.>B.....B.Q..$M.....2...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\labelframe.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):135
                                                                                                                                                                                                                          Entropy (8bit):5.801655629441002
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CEUFlttlDylHC5NrHEXHPclLEb/Ne1NPKA93OZA9nLEo1bpgEn:HcY80Nep93gAFoAbn
                                                                                                                                                                                                                          MD5:947DD42910443F58F9BDB0915455BA22
                                                                                                                                                                                                                          SHA1:C65F052B03B96F28F3768A46C26BA34E0C620C28
                                                                                                                                                                                                                          SHA-256:88ACB5587F6A3D96B93537436A564E17383BFF8D9D7E4C734E4A9355A94A25B2
                                                                                                                                                                                                                          SHA-512:8A5B67D3E1484AD3E84FF8272117C754A1FFEF9D71347A49902F3F27C65764DF4B05C6034FDF3DF1D1961BDB9F0110CFCAF43CF90FD02ECD60A5F1895AFACF51
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......!..ImageMagick.gamma=0.454545.,..........:T...a ....S..h{.}^(jdY..Q....-.>B.....B.Q..$M.....2...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\menuarrow-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 8 x 8
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):93
                                                                                                                                                                                                                          Entropy (8bit):4.794573207909773
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cf/F/t7ylHC5NrHEXHPclHlXUsiUe:c/48ege
                                                                                                                                                                                                                          MD5:2752BCF88F2713DDC6B0EA73DF49A590
                                                                                                                                                                                                                          SHA1:A41EF55D1FE52FDE914B818AD83EED2994060CA0
                                                                                                                                                                                                                          SHA-256:9F137B2B607C5BAD0ED9D8C14DE632F20C26FE3D545059CC3FA1BFA0C1547E4B
                                                                                                                                                                                                                          SHA-512:D22274BFF256F153BF0179CE4432740E503CB24C236C7E75F24F135E4DB659868B6C3A594C697FA945C3B4339CBD575939A5DD6E621ECFD4BA449C9E5947F5E2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......@@@```......!.......!..ImageMagick.gamma=0.454545.,.............`y.(....G......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\menuarrow-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 8 x 8
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):93
                                                                                                                                                                                                                          Entropy (8bit):4.829466890682208
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CfXvtlDylHC5NrHEXHPclHlXUsiUe:cw8ege
                                                                                                                                                                                                                          MD5:04A144F64D726BD213D017323794CE16
                                                                                                                                                                                                                          SHA1:A7811D03E6ACE78075B39A80871FE224C6ABC73E
                                                                                                                                                                                                                          SHA-256:4CA53F76E7C30947E89E88B56EF60B612146CDE78E95356F3A56FDED107972EB
                                                                                                                                                                                                                          SHA-512:B099CFC6446FA4BC7479787511F5C7DD225277662ECA2F7893740C92B6B9F8AE1F125D8F85A3F7EE12900B0D641507EEC214765FEB8BF0766F0A57EE6E65A45B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......!..ImageMagick.gamma=0.454545.,.............`y.(....G......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\progress-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 50 x 20
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1618
                                                                                                                                                                                                                          Entropy (8bit):6.841931888350617
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:PXK0dkakPa0gPeSHfVKyBeSAPPYRjcAthVs:PXK0dkkheSH9K/rWjDVs
                                                                                                                                                                                                                          MD5:F0D80234AD8E4817B9C5DE842D680588
                                                                                                                                                                                                                          SHA1:B1643095519284B72219B982802891FC76DADA03
                                                                                                                                                                                                                          SHA-256:B26121F06DF3F180EEF81F383820CA40A47050B1ED916487D829FEF87D791CAE
                                                                                                                                                                                                                          SHA-512:085F84216A47BBC83CD60629AB8D4938D52DE07F51765741DA95E3B122E911A5941AC8BD383D96E5E44FEAEB5D3100040E3F45128E08182F474B57C512B038C6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a2......n>.o>.n?.o?.n>.o?.n?.p?.q?.q@.p@.p@.qA.rA.sA.pA.qA.rA.rB.sB.rB.sB.rB.rC.sC.tC.uC.tD.uD.tD.uD.tE.uE.vD.wD.vE.wE.wE.wE.wF.xD.xE.xF.yF.yG.zF.zG.yG.zG.{G.xG.zH.{H.yH.zH.{H.zH.{I.|H.}I.|I.~J.{I.{J.}J.|J.}K.~K.}J.}K.~J.~K.~K.}L.~L..L..L..L..M..M..M..N..N..M..M..M..N..N..N..O..O..O..O..O..P..P..P..Q..P..P..P..Q..Q..Q..Q..Q..Q..R..R..R..R..S..S..S..S..S..S..S..S..T..T..T..T..T..T..U..U..T..U..V..T..U..V..V..W..V..W..V..W..W..X..X..X.Y.Y.W..X..X..Y..Y.Z.Z.Y.Z.Z................................................................................................................................................................................................................................................................................................................!.......!..ImageMagick.gamma=0.45455.,....2.......3..H........dI..L..Z..0.J.2A.T.R&...Az.r#.K$C>.Xi..J(.5...$G.rJ.)S....&...S..C.2..h.E..E2......Bd.Q..V.F=...!Be..Et..!.h.......t...3..~.......A............G..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\progress-v.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 20 x 50
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1626
                                                                                                                                                                                                                          Entropy (8bit):6.8482917580218
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:S9huqwK0dkrWlkPa0rtyDTBOKzLxxEggsyWdE/bCw7a3CIFibaB:/XK0dkakPa0ZyDTBOKzLrEj2Ez3+CQfB
                                                                                                                                                                                                                          MD5:6D1D0083C3763B792099D28D402D5973
                                                                                                                                                                                                                          SHA1:C9D2E40CEF8B33633F0135259DB4A482ABD79826
                                                                                                                                                                                                                          SHA-256:A47EF0193FEF5153D30EF703A75BAD4E75A1E1C59B7FCC0906CD536659D0E71D
                                                                                                                                                                                                                          SHA-512:1C8F43236804C65C95E84976E451E42C5CD0E90FB262E76DCFA8F85A29179585FC46CE525FA6D61F988FAFFFB79C8181CBCE3B5043F01281E3ED4F75CAE00F81
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..2....n>.o>.n?.o?.n>.o?.n?.p?.q?.q@.p@.p@.qA.rA.sA.pA.qA.rA.rB.sB.rB.sB.rB.rC.sC.tC.uC.tD.uD.tD.uD.tE.uE.vD.wD.vE.wE.wE.wE.wF.xD.xE.xF.yF.yG.zF.zG.yG.zG.{G.xG.zH.{H.yH.zH.{H.zH.{I.|H.}I.|I.~J.{I.{J.}J.|J.}K.~K.}J.}K.~J.~K.~K.}L.~L..L..L..L..M..M..M..N..N..M..M..M..N..N..N..O..O..O..O..O..P..P..P..Q..P..P..P..Q..Q..Q..Q..Q..Q..R..R..R..R..S..S..S..S..S..S..S..S..T..T..T..T..T..T..U..U..T..U..V..T..U..V..V..W..V..W..V..W..W..X..X..X.Y.Y.W..X..X..Y..Y.Z.Z.Y.Z.Z................................................................................................................................................................................................................................................................................................................!.......!..ImageMagick.gamma=0.45455.,......2......(..A...>.4...L.=..9...@."b..Q...-b..Z..R&.."h .BG."I..)#G. C.LZ|.....N.p)....C.4eB.@B..+n......3nlF..T...,^...d.U6ynJ.x eO.?.(..LQ@...l@....9.R.r...Ck+.....+[..I....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\radio-ac.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):649
                                                                                                                                                                                                                          Entropy (8bit):5.796780661052572
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:8m7e+n7uPPg/0+PUTfwCj5zLJLLEOV/6i6K9qoX/9Oh:/NuX0PUTfbzLj/Z9ZFq
                                                                                                                                                                                                                          MD5:62307E070708A554CEF3C191F125C3DB
                                                                                                                                                                                                                          SHA1:AC0ACDB079DE2C918F5B2091929C7791E2ED41A2
                                                                                                                                                                                                                          SHA-256:A7655E85A44BD1CEF960165A5166300E0E9B614D12589C8BBD5311D404045F3E
                                                                                                                                                                                                                          SHA-512:B00D97F71A8D4915B1CC7479437E28E8A0A16B2195271965ED850CC83179CE2586795A708B3827537BFCBE0DA72054C0EAE2D56A1159DD4CCB6CC849960A959F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a......._;.geigfjiekhfjigkjfkhdlhfmkglkfnkimmiqpmtupya?.gA.h@.s^.mD.oF.oE.rF.vI.xV.ua.wb.ta.wK.~W.|R.~[..\..Y..\..\..T..X..Y..Z..V..V..W..W..X..Y..Y..Z..Z.[.Z.[....................................................................................................................................................................................................................................!.....A.!..Created with GIMP.!..ImageMagick.gamma=0.45455.,............A.....A.................$())($....!,+....+,!....,,.9??9......./.8@.@8./....%2.>.@>.2%...&3.=.=.3&... 0.7.7.0 ..4.-*.6<<6.*-.4..#^......./F, .....0b..b....v$. .......hT.....j4ZI(..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\radio-au.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):433
                                                                                                                                                                                                                          Entropy (8bit):6.990760270524508
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:aI16fWWbGWYc0cmE/Atp+LJLaV85v6ByfggcQnG:aI+Yc0bHr+LA85SyfuoG
                                                                                                                                                                                                                          MD5:6C5F9A0160DA36963E0287AE0F0247C4
                                                                                                                                                                                                                          SHA1:EFE62E320B5FE0880EDA335BC6649FD6DBC0917D
                                                                                                                                                                                                                          SHA-256:D18AD04F7C53340B83237FCDCB33CC31EE1A5855C5F02CF384BE5CFD003A2E6D
                                                                                                                                                                                                                          SHA-512:DCEF5802E79536DB38D88701490C4DC8F1D9AF66CBFB873809EE385A60DE3EDC4176E182871A75FB65D019F9B47E132E04357A068E55218D342C9559ECFB71EE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....:.................................................................................................................................................................................................!.....;.!..Created with GIMP.!..ImageMagick.gamma=0.45455.,.............pH,....@@0..........j.j.P.C..Q.l.........*...t9\LU... 08w.:80 .B.)6v.x6).;4.,7..7+.4;.'..:7&.B....96..B..)..8)..C".*uwy*.$D5#Q+66+..%5E4/!....!/.N23.32EA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\radio-dc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):628
                                                                                                                                                                                                                          Entropy (8bit):5.679101728903009
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:N6oNNcliB/YshqMzkwhVjqyQZyPaWS1HMW+auww5IbGRLU/GuswEUrf9a6jB0vWT:TNRHc/ibGyPaWMhuxQML0uwEG0vWgtKP
                                                                                                                                                                                                                          MD5:A8E6E6C7D48201E2137980E3D4B60CC0
                                                                                                                                                                                                                          SHA1:FB6F8A2A029E26D4558D029776DC019C1CE73A0B
                                                                                                                                                                                                                          SHA-256:0B89DB9C2AB571B121F5A31EEDB2EB2F7E55C704C1AFF5B9D2FA64D80A0878CC
                                                                                                                                                                                                                          SHA-512:B7602894E238567E9173049B31E5807220E5BC597D76940A655E48567C77CC52479AD32CE977619130799CFC78412D89EDCA0FA3EC83CFA2882077F3961E17D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......zy|zy}{y}{x.}y~~y~|z~~z.rT.uW.zX.{Y.{y.|y.~|.~|..s..u..u..v..\..^..]..^..l..`..b..l..p..q..h..n..m..n..j..o..q..q..l..l.m.l.n.n.o.o.o.p.p.............................................................................................................................................................................................................................................!.....@.!..ImageMagick.gamma=0.45455.,............@.....@................."&''&".....()....)(.....((.8>>8.......,.7?.?7.,.... ..=.?=.. ...!0.<.<.0!..2.-.6.6.-.2.3.*'.5;;5.'*.3..%X.......,J8 ..A..-^.h......t..@b......hD#...1h4ZI(..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\radio-du.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):433
                                                                                                                                                                                                                          Entropy (8bit):6.990760270524508
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:aI16fWWbGWYc0cmE/Atp+LJLaV85v6ByfggcQnG:aI+Yc0bHr+LA85SyfuoG
                                                                                                                                                                                                                          MD5:6C5F9A0160DA36963E0287AE0F0247C4
                                                                                                                                                                                                                          SHA1:EFE62E320B5FE0880EDA335BC6649FD6DBC0917D
                                                                                                                                                                                                                          SHA-256:D18AD04F7C53340B83237FCDCB33CC31EE1A5855C5F02CF384BE5CFD003A2E6D
                                                                                                                                                                                                                          SHA-512:DCEF5802E79536DB38D88701490C4DC8F1D9AF66CBFB873809EE385A60DE3EDC4176E182871A75FB65D019F9B47E132E04357A068E55218D342C9559ECFB71EE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....:.................................................................................................................................................................................................!.....;.!..Created with GIMP.!..ImageMagick.gamma=0.45455.,.............pH,....@@0..........j.j.P.C..Q.l.........*...t9\LU... 08w.:80 .B.)6v.x6).;4.,7..7+.4;.'..:7&.B....96..B..)..8)..C".*uwy*.$D5#Q+66+..%5E4/!....!/.N23.32EA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\radio-hu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):392
                                                                                                                                                                                                                          Entropy (8bit):6.335379881353891
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NB/Ys4DhVjqyQZV1S1HM7Tz0kLisaliHygzTevAwCoHp3EXVo:PH6bGV1SkLiHiHyPAxgUm
                                                                                                                                                                                                                          MD5:CB00DDBE3DE8D54965983913A22C5156
                                                                                                                                                                                                                          SHA1:CF780BC468AC8BDB487339C4A1E2A8D12A30CED1
                                                                                                                                                                                                                          SHA-256:0C9E88DA76D0BB3ECA2FFCC323EBAFC9CA44506365169AAE2A4B7374E3DBE4F3
                                                                                                                                                                                                                          SHA-512:23FFA9B24A1DE81BE727BE7C247390AF75558076EBFF6AFCF1526C5095550429DFE762918FCB62232445C1355DC541044CF67AD71DBC53826D3FEED5B00369AB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......zy|zy}{y}{x.}y~~y~|z~~z.{y.|y.~|.~|..s..u..u..v..l..l..p..q..h..n..m..n..j..o..q..q..l..l.m.n.n.o.o.o.p.p..............................................................................!.....-.!..ImageMagick.gamma=0.45455.,.............pH,.[.. q.......(.......`"......rE0.8.ht....$.x<$Y...#zh#..B..%.g%..B'.".,".'B(..fz...(C..!.g.!..D*.. "$$" ..*E+........+M)&..&)M.DA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\radio-nc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):649
                                                                                                                                                                                                                          Entropy (8bit):5.796780661052572
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:8m7e+n7uPPg/0+PUTfwCj5zLJLLEOV/6i6K9qoX/9Oh:/NuX0PUTfbzLj/Z9ZFq
                                                                                                                                                                                                                          MD5:62307E070708A554CEF3C191F125C3DB
                                                                                                                                                                                                                          SHA1:AC0ACDB079DE2C918F5B2091929C7791E2ED41A2
                                                                                                                                                                                                                          SHA-256:A7655E85A44BD1CEF960165A5166300E0E9B614D12589C8BBD5311D404045F3E
                                                                                                                                                                                                                          SHA-512:B00D97F71A8D4915B1CC7479437E28E8A0A16B2195271965ED850CC83179CE2586795A708B3827537BFCBE0DA72054C0EAE2D56A1159DD4CCB6CC849960A959F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a......._;.geigfjiekhfjigkjfkhdlhfmkglkfnkimmiqpmtupya?.gA.h@.s^.mD.oF.oE.rF.vI.xV.ua.wb.ta.wK.~W.|R.~[..\..Y..\..\..T..X..Y..Z..V..V..W..W..X..Y..Y..Z..Z.[.Z.[....................................................................................................................................................................................................................................!.....A.!..Created with GIMP.!..ImageMagick.gamma=0.45455.,............A.....A.................$())($....!,+....+,!....,,.9??9......./.8@.@8./....%2.>.@>.2%...&3.=.=.3&... 0.7.7.0 ..4.-*.6<<6.*-.4..#^......./F, .....0b..b....v$. .......hT.....j4ZI(..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\radio-nu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):433
                                                                                                                                                                                                                          Entropy (8bit):6.990760270524508
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:aI16fWWbGWYc0cmE/Atp+LJLaV85v6ByfggcQnG:aI+Yc0bHr+LA85SyfuoG
                                                                                                                                                                                                                          MD5:6C5F9A0160DA36963E0287AE0F0247C4
                                                                                                                                                                                                                          SHA1:EFE62E320B5FE0880EDA335BC6649FD6DBC0917D
                                                                                                                                                                                                                          SHA-256:D18AD04F7C53340B83237FCDCB33CC31EE1A5855C5F02CF384BE5CFD003A2E6D
                                                                                                                                                                                                                          SHA-512:DCEF5802E79536DB38D88701490C4DC8F1D9AF66CBFB873809EE385A60DE3EDC4176E182871A75FB65D019F9B47E132E04357A068E55218D342C9559ECFB71EE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....:.................................................................................................................................................................................................!.....;.!..Created with GIMP.!..ImageMagick.gamma=0.45455.,.............pH,....@@0..........j.j.P.C..Q.l.........*...t9\LU... 08w.:80 .B.)6v.x6).;4.,7..7+.4;.'..:7&.B....96..B..)..8)..C".*uwy*.$D5#Q+66+..%5E4/!....!/.N23.32EA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\radio-pc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):649
                                                                                                                                                                                                                          Entropy (8bit):5.796780661052572
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:8m7e+n7uPPg/0+PUTfwCj5zLJLLEOV/6i6K9qoX/9Oh:/NuX0PUTfbzLj/Z9ZFq
                                                                                                                                                                                                                          MD5:62307E070708A554CEF3C191F125C3DB
                                                                                                                                                                                                                          SHA1:AC0ACDB079DE2C918F5B2091929C7791E2ED41A2
                                                                                                                                                                                                                          SHA-256:A7655E85A44BD1CEF960165A5166300E0E9B614D12589C8BBD5311D404045F3E
                                                                                                                                                                                                                          SHA-512:B00D97F71A8D4915B1CC7479437E28E8A0A16B2195271965ED850CC83179CE2586795A708B3827537BFCBE0DA72054C0EAE2D56A1159DD4CCB6CC849960A959F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a......._;.geigfjiekhfjigkjfkhdlhfmkglkfnkimmiqpmtupya?.gA.h@.s^.mD.oF.oE.rF.vI.xV.ua.wb.ta.wK.~W.|R.~[..\..Y..\..\..T..X..Y..Z..V..V..W..W..X..Y..Y..Z..Z.[.Z.[....................................................................................................................................................................................................................................!.....A.!..Created with GIMP.!..ImageMagick.gamma=0.45455.,............A.....A.................$())($....!,+....+,!....,,.9??9......./.8@.@8./....%2.>.@>.2%...&3.=.=.3&... 0.7.7.0 ..4.-*.6<<6.*-.4..#^......./F, .....0b..b....v$. .......hT.....j4ZI(..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\radio-pu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):388
                                                                                                                                                                                                                          Entropy (8bit):6.346669958942714
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:b7eJf3cPg/0+PUHkuRLMActB7p2yDwlCnxh/:bWfK0PUF6A8hpioh/
                                                                                                                                                                                                                          MD5:C76163C30A200251AFC9F7D72127D888
                                                                                                                                                                                                                          SHA1:A867D85F298A5A47E4DA8BF08E95E88BCFD472D1
                                                                                                                                                                                                                          SHA-256:C39DC5DB3691A8735925DF6403B47639F3988106BC2138A6C56ABBDED6475AEB
                                                                                                                                                                                                                          SHA-512:DC58AB598B7EEC13BB4CC01CBE05C02D8AC4F2AE2422450CA9EA6A9EAAD9583C037905E5AB5938FE61627B838AAEAAC7615327E611EDE9D355EF3EA3F2C4B020
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......geigfjiekhfjigkjfkhdlhfmkglkfnkimmiqpmtupys^.xV.ua.wb.ta.~W.|R.~[..\..Y..\..\..T..X..Y..Z..V..V..W..W..X..Y..Y..Z..Z.[.Z.[..................................................................!.......!..ImageMagick.gamma=0.45455.,...........@.pH,.].. q...............h&..."...g.e0.HD"4.......\^.,...({h(..B...r..B..&.)&..B*.# .#.*C..%.|..D,..$&''&$..,E-........-M+....+M.DA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\sas-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 6
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):82
                                                                                                                                                                                                                          Entropy (8bit):4.737435074827283
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CRlfMcylaE2cNrHEXHPcl7qFgZnE:/uR87qC6
                                                                                                                                                                                                                          MD5:55D09F967EF48453577823F1D9DF08F2
                                                                                                                                                                                                                          SHA1:01C24C7748E62AB2BA1C100C72E26EB517E00737
                                                                                                                                                                                                                          SHA-256:E477D934FD7B54E2CBF69A0AA0B056B2BAC8A008A2D6E2A658E7C8413C3B9284
                                                                                                                                                                                                                          SHA-512:4EAD07B555ACF92DA95641D9D2198C1CF5CC588D628E67FD25ED9179785C67FB73D35349EBAF897A05E927C2DF3EF0FDD079C09F248753AAFC6BF3921117EE6C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......!..ImageMagick.gamma=0.454545.,.............`...[|....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\sas-v.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 6 x 9
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):81
                                                                                                                                                                                                                          Entropy (8bit):4.672346887071809
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cpd3McylaE2cNrHEXHPclEpulFw:3uR8AuE
                                                                                                                                                                                                                          MD5:E0CDCBF5EFCACF5E91B02EE2EFC424CA
                                                                                                                                                                                                                          SHA1:66548803F51A35201058C5EFBEDBDCC68823C98E
                                                                                                                                                                                                                          SHA-256:24E58192853AEA879FA8BACF0B65BEE506DC7B9690A1894FE5A6031D745E9F91
                                                                                                                                                                                                                          SHA-512:1AC0DD500FDEAE50A4C8AE6BABD77EAF057CD09185DC2457084F7FE508C68FBBA7FA49F023B1881E82F82777F4FA9B57CA6A2BB24E67DB44483CFBB226301C81
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......!..ImageMagick.gamma=0.454545.,.....................;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\sbthumb-ha.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):267
                                                                                                                                                                                                                          Entropy (8bit):6.16026604016916
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CAlDlssfAd2Ilehb34r9/qyyexRulzyl4CprNrHEXHPcl7ldXlUaxNtwpGjstGhE:hltcegBy39Q68vWvtG7XQRQwNJ
                                                                                                                                                                                                                          MD5:C56F637081001C22B2F0295163462C54
                                                                                                                                                                                                                          SHA1:11810772503B1305903BD9D555ADA98C65C72B73
                                                                                                                                                                                                                          SHA-256:2A78788D135F0C2068E2E50850FC148816C6F4AC8045FD77FD64209EE09B412F
                                                                                                                                                                                                                          SHA-512:92509072A4A1C9A62D77B1E29863E08C221F70716E94933AA9DB097BF058CE1D08733CBA47B0D51E1268C3AB91A3FB06F8CBB6634244309AAFDF10C444E2C143
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ......................................................................................................!.......!..ImageMagick.gamma=0.454545.,.... .....j.%.di.g..l.k...b.x..w...@.B,.....8L..tJ=....v..z!2.cL...h..Ph...|^.\...~.....v"............#0...3(..'!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\sbthumb-hd.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):267
                                                                                                                                                                                                                          Entropy (8bit):6.136054828758262
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CAlDlyzFGu/8Lz32p7/dAAB3PHJs/jyl4CprNrHEXHPcl7ldXlUaxNtwpGjstGhE:hlE/SypzCgmvQ68vWvtG7XQRQwNJ
                                                                                                                                                                                                                          MD5:D5060CF8876C2CC8A0ADFA4BE020CAC4
                                                                                                                                                                                                                          SHA1:D0BAA3462B328F997238A6BCE188FEAEAC73FB31
                                                                                                                                                                                                                          SHA-256:248314BF2CD07E332CCE9DDF4C0A8521EAC6A5DC5B6F9E66247EF73CB465F69D
                                                                                                                                                                                                                          SHA-512:6A4198278DDDF52FFCDC1BFCD40420F3C7546509E08A4EBFB2297879953B653EFADC9B44A7055D76812C47B0B0D361F78BF625BFFB6B177F882D832F7678DC49
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ......................................................................................................!.......!..ImageMagick.gamma=0.454545.,.... .....j.%.di.g..l.k...b.x..w...@.B,.....8L..tJ=....v..z!2.cL...h..Ph...|^.\...~.....v"............#0...3(..'!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\sbthumb-hn.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):267
                                                                                                                                                                                                                          Entropy (8bit):6.172420019561805
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CAlDl4//pQcPwJN0RYv885pFXVMNabyl4CprNrHEXHPcl7ldXlUaxNtwpGjstGhE:hl2px4fOEQ68vWvtG7XQRQwNJ
                                                                                                                                                                                                                          MD5:1E65B36334CDD742B9DD7BBA22345A00
                                                                                                                                                                                                                          SHA1:18D68DDD61EA295D4ADE1DFAEE6F18EAAC0C3A57
                                                                                                                                                                                                                          SHA-256:DD4F1ED1903180E1B6BAC336A7DDFB291ACA2D87959AC51C9529BDC4F245CF0B
                                                                                                                                                                                                                          SHA-512:05DF91E773E63ECF36531199D372916C32442AB42EB53E1CD22A7A0FEABF7D6C3396731F45EC3CBFAEBC2504AC3CC1BFFFDDE78342FD86896D86CC147C758A9B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ......................................................................................................!.......!..ImageMagick.gamma=0.454545.,.... .....j.%.di.g..l.k...b.x..w...@.B,.....8L..tJ=....v..z!2.cL...h..Ph...|^.\...~.....v"............#0...3(..'!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\sbthumb-hp.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):267
                                                                                                                                                                                                                          Entropy (8bit):6.16026604016916
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:hlSC1pcD+uk9+WwYvQ68vWvtG7XQRQwNJ:zt1uDRI9/Q68vxX4/
                                                                                                                                                                                                                          MD5:1B1ADEED51F14CDA879F631217B73A6D
                                                                                                                                                                                                                          SHA1:D2E7F593AFACEEAA18668A93A30EC95E97D68C38
                                                                                                                                                                                                                          SHA-256:671678524613C3A047BB0F6CEBB089A55688AF8EE061F46CEEFDFCACDD005672
                                                                                                                                                                                                                          SHA-512:58D350326F15F6489AC1E3BAA60A5D7C16DE87EEC28E2D90A80B6F75AB5642F2EA90BF36F5B0A0A26A1F16676EC68CD820C98EF51B34BC4154519D3E0399CBB7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ......................................................................................................!.......!..ImageMagick.gamma=0.454545.,.... .....j.%.di.g..l.k...b.x..w...@.B,.....8L..tJ=....v..z!2.cL...h..Ph...|^.\...~.....v"............#0...3(..'!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\sbthumb-va.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):270
                                                                                                                                                                                                                          Entropy (8bit):6.266923050015269
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CgDlooqsfAd2Ilehb34r9/qyyexRulzyl4CprNrHEXHPclDg4AgfE8DiBqgl0zDX:D26cegBy39Q6884Q8Diq5zv5r4Wxmkt
                                                                                                                                                                                                                          MD5:6985858F7479B926E99F0D573691C3AB
                                                                                                                                                                                                                          SHA1:A4636CA373FEACEA029FE636C76E15E778E64D66
                                                                                                                                                                                                                          SHA-256:A41C4B8DEABE3C095D1AE817F8AD198FE1518EC87D6C9F49E5485995895003F3
                                                                                                                                                                                                                          SHA-512:0BD59E8246459EE9A50F082A735DF0A72A1EDB3958210533D1645EDF8AA366C6952E0D5061804A66351659691FE7062BC5D350307B06B877B2D566FA515A4EBC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.. ....................................................................................................!.......!..ImageMagick.gamma=0.454545.,...... ...m.%^A .c:..S..4EO..dB.5C..@eGk0....B.)`..d.Pk.A.D..4\.w...)....t.]v.uy..]..p{.h|..~d$.c.8..W7)$...8)%..!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\sbthumb-vd.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):270
                                                                                                                                                                                                                          Entropy (8bit):6.230866244483752
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DmF/SypzCgmvQ6884Q8Diq5zv5r4Wxmkt:DErSQ68845r5r4J+
                                                                                                                                                                                                                          MD5:147ADD4CA4A6A88D53CF90B57FF2B444
                                                                                                                                                                                                                          SHA1:90CE7B5978764C2423FD359104BFCD4503894669
                                                                                                                                                                                                                          SHA-256:434939656B61AE90AC23D98DF5B4F829F12B9E866A337EF1B9AFE06A7E01884B
                                                                                                                                                                                                                          SHA-512:EAC21001CFEEF7A4335E5E5ACED741A65D9B292BFBC10965D0BE97BD9257BD18ACD567ACDBE5A30B1D0E242FB5FA3FC5D650235C7DC33B451C6C45C04F9EB326
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.. ....................................................................................................!.......!..ImageMagick.gamma=0.454545.,...... ...m.%^A .c:..S..4EO..dB.5C..@eGk0....B.)`..d.Pk.A.D..4\.w...)....t.]v.uy..]..p{.h|..~d$.c.8..W7)$...8)%..!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\sbthumb-vn.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):270
                                                                                                                                                                                                                          Entropy (8bit):6.266923050015269
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CgDlzzA//pQcPwJN0RYv885pFXVMNabyl4CprNrHEXHPclDg4AgfE8DiBqgl0zDX:D2px4fOEQ6884Q8Diq5zv5r4Wxmkt
                                                                                                                                                                                                                          MD5:3AF70DFC3DFE057CD3E0E5D93E6CBBFA
                                                                                                                                                                                                                          SHA1:EBAF73963761E6B6E732D1D1E1876E3490E46D6D
                                                                                                                                                                                                                          SHA-256:5EFC27DEAE347D11C539F87B69A124A9C8E55A660C81BAFE3CC7D50AAB20FEEF
                                                                                                                                                                                                                          SHA-512:3F908ABFBDF548DDD30118D04CCEC91424B877AA323568F4E1E668CAFA99177E6AA2E7A280FCB8317F41A1DC6EB4AFBA0A5330049BD107BD7E7135B1B121A6C6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.. ....................................................................................................!.......!..ImageMagick.gamma=0.454545.,...... ...m.%^A .c:..S..4EO..dB.5C..@eGk0....B.)`..d.Pk.A.D..4\.w...)....t.]v.uy..]..p{.h|..~d$.c.8..W7)$...8)%..!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\sbthumb-vp.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):270
                                                                                                                                                                                                                          Entropy (8bit):6.2849036165792445
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DSC1pcD+uk9+WwYvQ6884Q8Diq5zv5r4Wxmkt:Dt1uDRI9/Q68845r5r4J+
                                                                                                                                                                                                                          MD5:0107E0ECAF2DB643DF361693C694B17F
                                                                                                                                                                                                                          SHA1:942326AA7F886E3050EC7C3B3BA285F95667356D
                                                                                                                                                                                                                          SHA-256:4AD6BE088E27C5B1E14A88B34FA6829C2D2C1E25042CC2387174E621B9841BFC
                                                                                                                                                                                                                          SHA-512:9392D0F953E8045105267B7DEF94C4C16D59AF8856C948E5D16FF8DFE482196C3965F4C764326A30DA026646F6ABE9B91AC3168173E71DC4C1AA376C7AC8ECC8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.. ....................................................................................................!.......!..ImageMagick.gamma=0.454545.,...... ...m.%^A .c:..S..4EO..dB.5C..@eGk0....B.)`..d.Pk.A.D..4\.w...)....t.]v.uy..]..p{.h|..~d$.c.8..W7)$...8)%..!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\sbtrough-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):191
                                                                                                                                                                                                                          Entropy (8bit):5.911911344652603
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CAli45R1dNMRnlrzl2agNrHEXHPcl7l81s6DP6lKzxEia5YjWfoLeOE:hlinnlvl2i8Wn9EixjxeF
                                                                                                                                                                                                                          MD5:466EBFCD19BB096317FF37606A567A0B
                                                                                                                                                                                                                          SHA1:0E884EC6923A8E33239ABD90E780785BE059D3BF
                                                                                                                                                                                                                          SHA-256:836CC2CD80164ED47A44ED8C44D8D0E6BB11214AB528B4463AA055251ADA704B
                                                                                                                                                                                                                          SHA-512:37D42DF8D478B2A7EE892C93BDB92D27E3788AF1A1BBAE870F40355E9B6CB2C01A41B2B4EDB7525D116C640CE28BC99CAF9BA592CF042F46043A155C68D1942D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ......................................................!.......!..ImageMagick.gamma=0.454545.,.... .....N..I..4.... .di..l.,!.tm.t..|..<.pH,...r.l:.L.tJ.Z..v..z.\.xL....z.n.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\sbtrough-v.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):186
                                                                                                                                                                                                                          Entropy (8bit):5.890074072715949
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cgi45R1dNMRnlrzl2agNrHEXHPclDhUbi1m9gF/fHYah8cVui0lqgEee:Dinnlvl2i8aGk9gF//Y3iSDe
                                                                                                                                                                                                                          MD5:E4882E760B3A00B55335D95494F10B0D
                                                                                                                                                                                                                          SHA1:E7C76EA0673587374B7E2D4EBB6BF8EE4E0F7E7F
                                                                                                                                                                                                                          SHA-256:3CEDB0996A6DE50802D9F399CE074F76F8F8E56BFD9092C3409A828021D83351
                                                                                                                                                                                                                          SHA-512:DBC8CA68F0F40608413B6CA63A8CCE1476C8FB170A1DD92DFC421C5654B02DA8E02D94B2304791332D08684160C9F3C89CA6F52184DC9127869EF58645367EB8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.. ....................................................!.......!..ImageMagick.gamma=0.454545.,...... ...I..1H1.%.$...y.m.T.(......g....zl....&.....7.!..c.i...WeP..u..*v...7..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\scale-ha.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):388
                                                                                                                                                                                                                          Entropy (8bit):6.346669958942714
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:b7eJf3cPg/0+PUHkuRLMActB7p2yDwlCnxh/:bWfK0PUF6A8hpioh/
                                                                                                                                                                                                                          MD5:C76163C30A200251AFC9F7D72127D888
                                                                                                                                                                                                                          SHA1:A867D85F298A5A47E4DA8BF08E95E88BCFD472D1
                                                                                                                                                                                                                          SHA-256:C39DC5DB3691A8735925DF6403B47639F3988106BC2138A6C56ABBDED6475AEB
                                                                                                                                                                                                                          SHA-512:DC58AB598B7EEC13BB4CC01CBE05C02D8AC4F2AE2422450CA9EA6A9EAAD9583C037905E5AB5938FE61627B838AAEAAC7615327E611EDE9D355EF3EA3F2C4B020
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......geigfjiekhfjigkjfkhdlhfmkglkfnkimmiqpmtupys^.xV.ua.wb.ta.~W.|R.~[..\..Y..\..\..T..X..Y..Z..V..V..W..W..X..Y..Y..Z..Z.[.Z.[..................................................................!.......!..ImageMagick.gamma=0.45455.,...........@.pH,.].. q...............h&..."...g.e0.HD"4.......\^.,...({h(..B...r..B..&.)&..B*.# .#.*C..%.|..D,..$&''&$..,E-........-M+....+M.DA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\scale-hd.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):401
                                                                                                                                                                                                                          Entropy (8bit):6.291793915093687
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NIt4W86UcuSKYPKyBiuHPNkLxN6zDSxD6epRmqOmrnTUDXqIE:U4WnzrELmHSxeepDTTws
                                                                                                                                                                                                                          MD5:EE303A978438DDADFC9F03D412DCD453
                                                                                                                                                                                                                          SHA1:D65C6A816B895A424A7D460FAC48A9347FCBA3B4
                                                                                                                                                                                                                          SHA-256:BA3BD89BBB1B772DB01D9F1818BD6BDE97C8246F2D9A99CC36B96FC6CB888639
                                                                                                                                                                                                                          SHA-512:B16AF1711AA2D1AE9484FBBB71CEA0038DF14A62B51F4C151C19FE3D5FD5026494B58FFD4B72A8A8AFBA144520F2ECA8DF7E6D35A3927B98612A7EBF25D1A14A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......oorpnusotppsrptrqtspwtqutpvtrvvrzyv}yh.~k.~l.|y..a..].._..b..e..c..f..f..f..b..c..a..d..a..b..b..b..c.c.d.d.e.d.e........................................................................!.....,.!..ImageMagick.gamma=0.45455.,...........@.pH,.Y...p....H.........H&.......se0.4@p4..`....i>'.(.B..${| $$..B..''..|...B..#...$#..B(.!...'!.(C..&..&..D*.."#%%#"..*E+........+M)....)M.DA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\gif\scid\scidpurple\scale-hn.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):254
                                                                                                                                                                                                                          Entropy (8bit):6.434203499215381
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NIDqRbhKuUYaT0zjXpJLPUlf47S8lhnRtMS6Nf:Dh1UYa4BJLsf428lrtF69
                                                                                                                                                                                                                          MD5:BC672A8C4AE7E8B85EA475733718C2F3
                                                                                                                                                                                                                          SHA1:51C2FEF49D4CCC687D50B2C091E0FC41E4C887BC
                                                                                                                                                                                                                          SHA-256:001D3F438342920C7FC38884E0F03276D9DB7E3753428709088CE5BFE5F786C4
                                                                                                                                                                                                                          SHA-512:1D5A9F9875D266A60B730D97D7625327DBCF38A2A2F44823E0155E7E2CBB9B1312F1B5463B64EEBA16F3D5636CD75FADE6C36F2AE517889FE87C5823E4A6BFC4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......]\_^[b]\`^\`_]a^\c`\aa\aa]ba_ca\da_fgUwiX{jXzlYzgcijfnwwz~}}oN.oJ.qO.tS.uS.vS.vQ.{S..S..........!.......!..ImageMagick.gamma=0.45455.,..........^.'.di~..(.x0TUQ.q....VP..........!.-.J.e!2D....*$."..'..I..d..\7.R...n.......0...-......-.$!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\button-unshade.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):303
                                                                                                                                                                                                                          Entropy (8bit):6.210099586588092
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPZXQ9hm+jdKce+cwNawFx+Ou+LgFIqEZJ+IGIXXlSwlbp:6v/7ytZe+swFIz5EZnPXlS61
                                                                                                                                                                                                                          MD5:A869EA853F5D7B122889B0C7353E6FC8
                                                                                                                                                                                                                          SHA1:1F979747D8538D8AE7CA83415A27B776159DE1EC
                                                                                                                                                                                                                          SHA-256:3AF86AADFECBB60C05B351DF1802636D81A3BAED01ED3B440315DA6F31433D20
                                                                                                                                                                                                                          SHA-512:A6B5BC1AA5358FD5AF2A8EEBF2B88FA677785E86C140CD7060142350383465974305B603E122A9AC3368557BDD88269A43BF13C26FBC29876E5088D2D6E1AD20
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<....RtEXtCopyright.CC Attribution-ShareAlike http://creativecommons.org/licenses/by-sa/4.0/.Tb....NIDATH.c`...`..}..O.......e..h..<.,......DY......m..K.2.dp.....7..S..Q0.F.e......1{......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\button.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):392
                                                                                                                                                                                                                          Entropy (8bit):6.927834966950524
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7niUpZ67lg4+IKCjn5K2DQKYgSR8oc:IiUpwZNZrI2E0SR8B
                                                                                                                                                                                                                          MD5:65B3A1447AB565B0259E205DDAC23CC1
                                                                                                                                                                                                                          SHA1:D3F321743EC0200F918D741DE263D38DA0A69E2C
                                                                                                                                                                                                                          SHA-256:E0C3E8F6416FDC6A436B445BF225E52A8D6D231C76AFB132E34268A4DE9F0783
                                                                                                                                                                                                                          SHA-512:9CC32C39E972770CAD7790B5A50DC213BA286388C243F4DA68AE3A732E93880244DF9154B51C165FB7C6604754F81A25F4266BF186DFC75E85287E49FCCF9048
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...(...(........m....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATX...1N.0.....t...3q.n....\.-9.SVKt`...$0.Y0 .'.../Y..'+Y....L'.J.+.Y./`..x..a....yq.......9....}......8.UUU....).u}.|:.........`.......?..&.K......3.6.j3.6.j3.6.j3.6.j3.6.j3.6.j3.6.j..%.t,*.UJ..:.'....5 c....X..r.......e.5....|.9...........\^..9...(Ag.<L.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\button_shade_prelight.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):621
                                                                                                                                                                                                                          Entropy (8bit):7.280611733659861
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7ytZe+swFISbiC8lVThiuc3P6gPAGqjpLe10O2Z:lt1e/lVThil3PLPAGqjle1EZ
                                                                                                                                                                                                                          MD5:85A050D23929F4F4311A5FE6B3178D3E
                                                                                                                                                                                                                          SHA1:ADC5B3176253C0B4C806C8F8A6C47204E468A26F
                                                                                                                                                                                                                          SHA-256:1FA3EF20E27ADF3B5FFE315C9E17EB523F5C67FB35A551162063FF3276F40A09
                                                                                                                                                                                                                          SHA-512:A7F168E68EF7A69BA4900E40FB0207025A356518A91C9F8E7CAB37F1673B075D4C0F9FFF9F751093FC72EFD060C7E6AFD0612C66D916E5DA51436C6E425D2A37
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<....RtEXtCopyright.CC Attribution-ShareAlike http://creativecommons.org/licenses/by-sa/4.0/.Tb.....IDATH..;n.@..g.k..........*7J.t9B:.f.#P.pA......I...a..D.v.....kg..]X.)"8.c.V.&.......H)....Ng;.....f@..M..z..*..imx.^.A......z)s...T....h.,..c^..|..a.^s.....E.w. "H.v.^.Ls.....X.4.=v...ZE......X..Y.....4...K.-..Dj\b..........g..Y.la.r...._.2....@U.*.z.a_....I...At...@<.c.....L..2.R....X.N.b/.G.Qr..|?!..o..u......(.^.5.[.C\....7..o..(..M..?..f.j-.....~.......K.=.Z~d.J...$....F.....O..........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\button_shade_pressed.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):687
                                                                                                                                                                                                                          Entropy (8bit):7.341761307255035
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7ytZe+swFI4Hv7EmkzyVMoxXy7IPnkR8ersm8hWycohTjTbPCplKP:lt17PG6BdWMDertElolKP
                                                                                                                                                                                                                          MD5:E59CB7585B899512F725F638B5D50024
                                                                                                                                                                                                                          SHA1:36E4CD71824F6C8ED3891EBFEE94FB99902ADD5E
                                                                                                                                                                                                                          SHA-256:2406719B2CDF71A7F89073DFA3344FF3BEFFDC7A2BB25E529EBC4AEFFAB8B114
                                                                                                                                                                                                                          SHA-512:1CB52D531E390CABFA2DCA3977838B80C9806A878ED3EBE84932AAD25E8F6D95F66E4947AC821E0EBA6BD6F8FCFE757C9AFA825AE17468D68155E2A109658A2C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<....RtEXtCopyright.CC Attribution-ShareAlike http://creativecommons.org/licenses/by-sa/4.0/.Tb.....IDATH..?o.@.....*.l.[A..*.@"j..n|..HHt.s..`.@g$V6$&B...`....wjD.r..C[;...$S...{......7=.l.Z.....a.........4q.8q..x.6......0lz...W/]....X.w{.Q%.I..E-:l..s ......../.....l~...U*..as.x....p..W`.U..`.p..XkSnz...Ewk5>\W....g.{y.*+2(~.j...!...#3...6Xr-4./.^... .....4..|.[.V..."xQ....n..U.U$4.9.7..U.$.....3H\2...g'&....E..P".i..$^.T.".+.<{....dm.6....g.....A...h-..?....;...^w$..+.5Of.@A?....4K..t.d.....r............xN`x4.....|...d..rW-.`.D.E$~...".2....b.]^.A.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\check-off-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):398
                                                                                                                                                                                                                          Entropy (8bit):7.133345524052082
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPZXQiUjdKcutsfcWQaEd0JdsjQ0/UVRSp4BQn8natLw8Yrf/DsrEYAp:6v/7yiUpZuefcW50Wd+np4s8nieAa
                                                                                                                                                                                                                          MD5:E3C465ACC5858C4A3E8EB9034D3718E8
                                                                                                                                                                                                                          SHA1:83BACAB72DEFA68E275A3525784FBA3C0E786FD0
                                                                                                                                                                                                                          SHA-256:5616EE1B4A2DE42EB4EE9CC8ED2E40909343E151D9A2607CFC0B868A9DD727C5
                                                                                                                                                                                                                          SHA-512:0A3634F7B01C37180EB3C37C258DEFC75E29C739B96E0C2913F1B9EC293B515DE362ABD7F4362F46588C80DFE495C2A351612966A64FC6EBFC36452102C78C9E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...J.A.....,FMaLH'...$o..W..A..I|.SX.x!..Y-vW....H.p`......g.r..b.!A..V.;.........^.w.B.s.(.....`0.F.a...dr.Bh......c..?.C..Z..C.$....+...)..4.jA. ..V...Q..6.....3.e'..v.."(...uS.,.^.....E:....4..._,...px...H9..8........&.U.x..nq.)..M...a%.G.J0...1....E~.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\check-off-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):389
                                                                                                                                                                                                                          Entropy (8bit):7.108109066256885
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7yiUpZ/ZmzFTnYpmt6OCKFzVt7cGfz:liUpDQFLYp79UzVP
                                                                                                                                                                                                                          MD5:3AE4507936C1279B9661376B9226E3AB
                                                                                                                                                                                                                          SHA1:64DEED717DDF1D048045BC0407FB627DB62E1B6A
                                                                                                                                                                                                                          SHA-256:83BE602169779252FFBFB5454D9E453977A9613B3292E5D197A222B3DA1ABE79
                                                                                                                                                                                                                          SHA-512:16029F614A1A30A489A450D008FA68204BC69F06158CACE17AF5921E2862BFC9F871D6FF97C96188A06D5E6958CCD86484D8B105F1B56DEC9B9A2555D9CDA788
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...KJ.P..._.b...B.9s..GW....v...8..m....$..G.N....\.........u.8A.Q}..[..B..:4.L&.EQ..e.mSEQ<...;$..8E.>.?.q.o...r..$.-.C...+..8....P.....E......F..S....x.".S.....G.Qp......<.g....|.Z...>,...(..mx...`0.a.u.Z.}....=.|.~...R<..o..7.E..8...(P..L1C........^....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\check-off-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):221
                                                                                                                                                                                                                          Entropy (8bit):6.176455686714606
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPZXQiUjdKcJhkz8BJVIoUjCYyu65JFNlbp:6v/7yiUpZvpBPU2Y/65JF31
                                                                                                                                                                                                                          MD5:1347DC396E2D420590DDEFCDDB7CA09E
                                                                                                                                                                                                                          SHA1:179A3C1770068EEF7B30FF9B269927E800346FCD
                                                                                                                                                                                                                          SHA-256:568467DCFFAD60478BCDA569934A73FC3321506883F89B71C810EAB686CAE985
                                                                                                                                                                                                                          SHA-512:14C2AD782B36D5C7BD2C34AE65391C8EEDC3C684F178D0799CB9922CC617614625CA950BB59C742662E9D424FA25AB17E3C8711E4A52FE15F0CD8292032731CE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....ZIDATH..1.. ..'....X...JP.).B.v..+f.;X=[....0.@.....~1s;<u.D.}7Y`...X .T!.f.a........s....5|.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\check-off.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):343
                                                                                                                                                                                                                          Entropy (8bit):6.896877480380903
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPZXQiUjdKc955vYHtXanx8Ztmqrv5dDenA7VxQu+i257Hup:6v/7yiUpZ932XanSZtPrPDenA7QW
                                                                                                                                                                                                                          MD5:AFB15E244950F3D123A3BC919143E182
                                                                                                                                                                                                                          SHA1:4358854357D4ABF0458535EB8869D16E7185996D
                                                                                                                                                                                                                          SHA-256:7203918317F6140A6F9684CE2569FC49B84DAC7ADA0FD9F92D89E47FDE759041
                                                                                                                                                                                                                          SHA-512:313BB8FF27459A559E3C1ACCDD5E41BA545E6F3E633DC6B6BFCC5DFB98B190B00F65F4F26C0832307EAC66D0BA87833782C730285D0273251EF10799888216AC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH..1..0..'.A..(.........P....*..L..N.B".."+...u...ce2..s..e^....F!C..*.........;.......z...y>o......EQ,...,0.*..Z;......_9@.....NF.?U...=......1....1...4rHeYn.....UU...4Z6.`.Ly6...'...I|...#..~.W ...?.....J....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\check-on-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):499
                                                                                                                                                                                                                          Entropy (8bit):7.259366818386013
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7yiUpZrUS9DxeCT3Zl/1k3vpUNymxyTPSVg:liUp1USHPuphmYTPb
                                                                                                                                                                                                                          MD5:335C2B7BC38D3F915D5231B8C4B41563
                                                                                                                                                                                                                          SHA1:931086C00CDC1DF8412307C42BEBDC6B2E743004
                                                                                                                                                                                                                          SHA-256:594C4A1567DCE81D03B7701003CFBDFADF6E46150AB93FBB3F861A851E385ADA
                                                                                                                                                                                                                          SHA-512:9340AE658598BE789C59063E6238AAE6E3A1A9AC4E568643CC7CDFCBB397713113323E06C4C1CFA58EDF3BD4672015B26B19B4F77A93EB201D86CA806104C925
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....pIDATH...J.@.......`[qUE.....t.O.....,".J.q..J.,.m.J.....6...a`.f.....g`.2..@.0....h.8......\..?^....i..D.:.[........PBG].v.jY..B...v.......@A..Y..+.E /.Rd.....H.@..@....jf...<S.."'[3..0....q].7.C.....;..7.`2...z.C..z~f..0?.$.H....q......n....4.3I.....M...3H... ).W.{...\.......P}.NW.j..4l5.e...{..n..p........V..A.G#=l..h.O@..{MX@.(.+..+....t.....U.{........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\check-on-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):501
                                                                                                                                                                                                                          Entropy (8bit):7.315847185128914
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7yiUpZU0VLx99Jm9qfGRBHLbhtMvta:liUpV9J6sE1tM1a
                                                                                                                                                                                                                          MD5:24E17A2E2F2D10283557299A30D0BF07
                                                                                                                                                                                                                          SHA1:3174AB3EF1E276AACD22F283922668C7D82CC554
                                                                                                                                                                                                                          SHA-256:81C9B85DABD4E5F0430D89481A737FDD87CFB147AE2B3B5C927149246EDF0D71
                                                                                                                                                                                                                          SHA-512:5A515DE744D82A810A5691116ACFA19597F960C0AEED6CB32874CFFC672236938E6D7D3B97BAC227C9049C3316CA8741195ED64A5A344A3DB5E8132821E33271
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....rIDATH...?o.@...4m.@....P:1........n-3s..K......1...?....a...Uj'N*.N.N..9..N>.8A.B4PG-......I.\...i....z{.).z'..}.......r..F.5.<..S..^.,."V....F.O..JK..|.&j.....Z....)J@.=+...v..J...?..o'c.c{.........e...>:.s........$....9...K...>..|.y.K...l..M./...L...D....LN..X@:.*.t..;A....Q..\..L..!.../.}53<.u....@.ch....t....$.d..K......6...V..pwM#.."....?.wL|.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\check-on-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):337
                                                                                                                                                                                                                          Entropy (8bit):6.8853903452816105
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPZXQiUjdKc1zEkO0s0yNhne3wla5wuodu14Fu6HYrDq/0pxjp:6v/7yiUpZREj0+w34HVu14FYrY0pxN
                                                                                                                                                                                                                          MD5:6EA9EDA23B6893ED141E881F116C989E
                                                                                                                                                                                                                          SHA1:17775EA8F563C679502289428BA42FACC863AB4B
                                                                                                                                                                                                                          SHA-256:6D90E239E6BF887B1A5950666F8BE37051F63372B33AB52D55A086F32319B323
                                                                                                                                                                                                                          SHA-512:5F0AFF7FD29623A87C79D2487E0C4DFC0EA988496B511A094C6AFDE7FF9636D5E4AB4075489081E9F98CCDC0723F80C4E2CA55ED1D281146196813B2F7303D20
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH..9..0.E.'.4...@.ar..&.......IAX....+#...e.........j9DLsCL.....0.p.W.>^.(o/l.......<.d...}.N..&.q.ce.V.._QRL....m.......-....._..R....JxU6...R.....,..l...c.%.4'.-.....:.~Ul....F.ZALbER.2.&O.QLzs..`....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\check-on.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):469
                                                                                                                                                                                                                          Entropy (8bit):7.280395190523175
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPZXQiUjdKc/B4Kn28NLmCwxrKIxJlmQFvbkR76yfbenSfGm1d5+WnshG5Hy:6v/7yiUpZLn28ZmC8KbYOBhfRPnd8V7h
                                                                                                                                                                                                                          MD5:C40A041D41A98513496D0EF3A5EA306C
                                                                                                                                                                                                                          SHA1:20543082DD933C3B90330DCC36AE374881C6D4F8
                                                                                                                                                                                                                          SHA-256:8BFB5834CE7B36AC43226D4264D13E5B3E40F3CF8B4373065302CF9E1FF07BCC
                                                                                                                                                                                                                          SHA-512:1D3EA853455A7B2E2274FB7D58B3008BE1C19F4A2D92B7A9C6E4F514BF6680D9FAB3BE9F202B86524BC4521FE291430A3FC76BBCE3179CCA5AD2D5D749A9D93C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....RIDATH..1N.0...:FJ...-d..(..\......p........QuB4.l.$.....*M....%./.....Q.a.j.Y.....S@..zVR.%..'t.kD.m.r.....qz|.DBgk.>h.....^....!..8X.9|n"].....\..W.h....Z$a.6.F.^....~...z]..;.....u.v....j..R..2,.... X.~a....J....AP./5.n=.....K...s.oUx.A.I.8.....c.+..|e.H3......b...j.-R..H.'B.3....b.~.<=...P..l....i'2}..........4.-..j.."..zD?..n O.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\combo-button-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):313
                                                                                                                                                                                                                          Entropy (8bit):6.780655340789754
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPysQiUjdKcNJh5l+TvM3aiQ6F9whID+JW84uPp:6v/7wiUpZLl+AK16j6Jrfh
                                                                                                                                                                                                                          MD5:CD171CE338EDF9BEFB3FAD67AEEA551F
                                                                                                                                                                                                                          SHA1:0087CA5BD61739EC47E473AEDA211AA2FB7CBD20
                                                                                                                                                                                                                          SHA-256:0F0DB90CD9CB35B2BB9F5C8598BF4EB851EB529F1132F25DA5CEBE399E99477C
                                                                                                                                                                                                                          SHA-512:94B0020DF10481799C5749490D1C5418BA1D2095D0A467BC1BE0C26F8005F9DEFC889587B35348895D30A8C76BDB71948227C94BD1B1B0EB87AAFDEB58EFA0A8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.......(......1......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...1N.0....%.....3..l...s......$T.R.Z..aF.=....O...G...d._p...Ha..%.QJ.}....v849.4Ms..#... ..o.WwU.\s.MIpS..P..P.,....`.+X..V...w.....M.......8.._.,....+^...|a......+...8./..74.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\combo-button-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):313
                                                                                                                                                                                                                          Entropy (8bit):6.858539674479675
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPysQiUjdKcNJl3m1KcO3BylAt9JeMvUzASj9ph+4n78+bp:6v/7wiUpZp3m8zBylI9v6ASBphPb1
                                                                                                                                                                                                                          MD5:ADA6171B8E80C5F063BCD4AC58747B6B
                                                                                                                                                                                                                          SHA1:AEF4D1B9FB293779F55FC994FFCD5BF3B689EBBE
                                                                                                                                                                                                                          SHA-256:DA5ADED33FBBD6890CFA97571297C6FB94A9B5D3ED89CBB31BEDD41C2EB5213A
                                                                                                                                                                                                                          SHA-512:FE244B5D0C935241243943869ECE3B0450C069A85803E45459778F8A92AC579C89C920EA0A4CA2908D4C4A63E8E44618BB4BAA37C5918F92AFC4E71B38D55566
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.......(......1......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...1N.@...gb..rA....^p.W\..P..T....Q.u.S...[....vH..O....qB...!,1..y..}...;.. L.o..._....u.u]]..\.MJp.., %.Ej0y..f0...`.3........5....0.?]..sYU.......>.P...r.../.+<....7uS.6.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\combo-button-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):206
                                                                                                                                                                                                                          Entropy (8bit):5.873853532753769
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlbr/lCsrtxBlly+r3U8G9RthwShLKOWGEVwRshkxe0+aaSBTuafFCX:6v/lhPysQiUjdKcRA50+RyTi+k8se7up
                                                                                                                                                                                                                          MD5:7E0148FFEEEC6ED34BE3187CDB5A1706
                                                                                                                                                                                                                          SHA1:E78292C86A94B040FAEB353891159B46512B22A6
                                                                                                                                                                                                                          SHA-256:1543B04B7506E039337153867B130D61AA1B1B09D9B4C0953ACBD2A32BD4BB52
                                                                                                                                                                                                                          SHA-512:47C0FB43B7EED1811D71A04AAF1C5D2FECFC7A48856702612BD3B912A079FCDD88D1A9B5827E35B149BC53AAA8861E56AA1576A08B7528748244A62BC8EB28A1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.......(......1......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....KIDATH.....0...k.\..G'.a...d#Z.S.yD.v..}.H....X.h..w.(~CU.........'.Y....^...H........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\combo-button.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):291
                                                                                                                                                                                                                          Entropy (8bit):6.66729330134116
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPysQiUjdKcSwgq8lJo3MxkTwica27BpKPwWV1ktclsefdp:6v/7wiUpZSwvXwK+iwWV10er
                                                                                                                                                                                                                          MD5:F695C8079B4D0F176868862FA1B25528
                                                                                                                                                                                                                          SHA1:F7D4071759357EBCACC140F7645AC9F4BD29523F
                                                                                                                                                                                                                          SHA-256:971BF5645CFA92A1125533EBBE7DE37D09EC955D1E1061993E7903B28A135C93
                                                                                                                                                                                                                          SHA-512:A1BD827ACBC4FBFAAB9AF54709188BEAAD9B439A3E663D74ADACFC63F40897B77883F835A83A8252790060EB7B080F8BC4F3A297DD4C9D7E1FD9875CA25117F4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.......(......1......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH.....1...?'7d..T..L..J...M$(.@IHr..C.$.-Y....ap.`._..(mV.RZz..R......n. ....9.b.".g=...7.0#.i4.U.TPA..TPA.......=Fz...}..3..j.........%..#`i........4..g.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\combo-entry-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):330
                                                                                                                                                                                                                          Entropy (8bit):6.861668032147372
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPysQiUjdKcdNMLZihz7iCSQdg6SiAMZwk9vLKXop8qhIHt/Gp:6v/7wiUpZdNMLwhz7i3J6RAM6k9vLK4b
                                                                                                                                                                                                                          MD5:2D8FAF8B3E5E39C46D0EA2F4E12D1B10
                                                                                                                                                                                                                          SHA1:CE897DB64F73516B3D6144E34CF16DD3258DB966
                                                                                                                                                                                                                          SHA-256:E977283DDB23AB3FB1F83AFCC97990F200B23A45A4840CAC979875DED5B0534C
                                                                                                                                                                                                                          SHA-512:99B598BECD28F42D7C4CF499781682F5D63A5C362278B873E40702CA5E4EE67A84184952E1CD2C2C042B55479A719BBEC1ED501111F0B03E70C5A9D3D587A577
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.......(......1......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...1..0.D.=.. ..$.AF....AF......f.4.+.....?. ....W....y"".*9...KU9...#}.S...v.FDp..u.m....q..4.m...*!.G.?PU.........a..X......,..@c..Z....Z.e...m..V..<.3.82M..""..{.c.!..s,....pm7..*W}.........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\combo-entry-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):286
                                                                                                                                                                                                                          Entropy (8bit):6.593594866415919
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPysQiUjdKcB+OP8UeE9F659Ztox7wlACUsfZMjp:6v/7wiUpZB+OP4E0ZtO7FsON
                                                                                                                                                                                                                          MD5:81D4B95A45DADCA003BA787B99677FD7
                                                                                                                                                                                                                          SHA1:64B5D535B932B7CEF274882BF7DC91F00C034FDE
                                                                                                                                                                                                                          SHA-256:863576750340E923995A8B3C683FDAD248C53B1279EBA386050A65F92B5CD617
                                                                                                                                                                                                                          SHA-512:B1B3CD02D467D52AB8BC84ECDCE548294D245F5EA2B0F76D945B19D0396FC6A3AC4D0F63148440CC5D7F7C295D47980140FA7FC6196342041C69EEB7ED5A85F8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.......(......1......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...1..0.D./.....x...i.4.,W...{.C.%"..=.S...`.AD........y.,.B)ejCqwT.......Nk......s.S..'...I.&.`..&.`......u=....V.u}.-f..q.m....Z...[..#..UEU1.....B.gf#P......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\combo-entry.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):288
                                                                                                                                                                                                                          Entropy (8bit):6.637017332662386
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPysQiUjdKcH+j/L6th+IW8r4A8lkqWqdWTTPHKhebp:6v/7wiUpZej/LOh+IW/A8lkEcTjHye1
                                                                                                                                                                                                                          MD5:7C9AAEF872018F2BA2F5F4247326FDB9
                                                                                                                                                                                                                          SHA1:DC7EB9C6B78F6481510FA76335C1CEEDC11615BA
                                                                                                                                                                                                                          SHA-256:FBC2A4D5B40D1582D48F4F8479BE2BA82B2A6F17323DB70247AE51D995202E8D
                                                                                                                                                                                                                          SHA-512:2F033141D74D1DEEAAA0B83EE33D9A680B6B8B20CE1FAF00A50C6A916312C950A97E276FF2DCF6830C7F4511B642F61176B34B28462043FBC80DA16BF5417835
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.......(......1......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH.....0.E............]...*o.vd..23..;. ".LZkd&.q..L..wg]WD.kC..T.eY.1.qwj........".O.....8...p...........z...J)l...:.Y......A..[.o...43T.U.....e.g....)....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\entry-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):456
                                                                                                                                                                                                                          Entropy (8bit):7.128452223870287
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7niUpZ4ZBzbz0OrRQZSET0MAbBLBunhC3z:IiUpmZOOeZ63BInhCj
                                                                                                                                                                                                                          MD5:902DEF7AEE67E9AB3E7CB32AA2021C8B
                                                                                                                                                                                                                          SHA1:926018BB68D6A7ECB62776DAA06CC51CA73CF4A2
                                                                                                                                                                                                                          SHA-256:14D2CC90F964ED2B856EA6EF343EFCD97AF7F0733F8C1E10AABBD32F73FF0649
                                                                                                                                                                                                                          SHA-512:F98B2EC3AAD413B9A9A239EAA0B3CAD06912E2DD63EE33A48185DDAB8D8592E816247D09AA6C6CE76094546F66F9442D9534890050CC185EA1F1FCA526B44EC0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...(...(........m....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....EIDATX...=..1...7?.`...b.....j.80..Ln!.......+x8p.O....t.u]y<.,.BJ....(..Z..l.R.SJ..w.u.p8`...{.c.r..,..ZdJ...].U..l.[...z..RB...!`..m{g.e.Gb.....\...<.....H)..|.rI......$...*..../..5`i.XZ....5`i.XZ....5`i.XZ....I)%J).i.my7M.J)..H...Z..'.P..8..}....W.c..3.....=..6..!...s.....c.Zk.s........,..vC!..Zkv.......Zk.....k.x.L....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\entry-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):410
                                                                                                                                                                                                                          Entropy (8bit):7.1005307864446685
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7niUpZCCCUOdj+Kn2ZTlvTUh8Hf8Hf8HqsG0whec:IiUpcjMKnaTNAAAgG0w4c
                                                                                                                                                                                                                          MD5:0EE4C1683AB763047961352626DFBC0C
                                                                                                                                                                                                                          SHA1:CF1ABC074C8B52B55D1ED25FD8E317B674FCCCDB
                                                                                                                                                                                                                          SHA-256:A9CB2D60974484E7E50A8328205D4B809F88B4071793461C76DCFC9499DD6BC1
                                                                                                                                                                                                                          SHA-512:1ECB7416ACFEF84BB656EA75A239264346A4A17A2E04CE42825E7ABCC118CC67FAA12CCFFFA1C09DA8AEB6F42FB3542D08B3765A946D0AE75F603268A637A883
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...(...(........m....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATX...=.B1.E.c.!.....Y...@.HD..@.f.)"M(rV...+...........z.pw..E..!.......Sk..9.N....j...wD..#.Z....x...03.....Zkh...3f6..).H.Z+..~[.I...`.........&....m.{...&....m.{...&....m.{...&.7.PUJ).-.J)..o."..q.\...s.z.bf...B .....|>.s.ls..6./...,.B..SURJ...~...|..4U..#)%v.......raD.B.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\entry.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):309
                                                                                                                                                                                                                          Entropy (8bit):6.857928927804143
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPUTUjdKcBEoTD3MLd7f7qc7K1BNod4Uq/QkKgGXh6bgbp:6v/7YUpZCoTrMFMLNoWzokKrXWg1
                                                                                                                                                                                                                          MD5:50A24301DDFA74497AD62C10C09D1E72
                                                                                                                                                                                                                          SHA1:2CA7F2D585740DDCB825B43257E245FB7CDAB465
                                                                                                                                                                                                                          SHA-256:97294F8EDD6F60564297AC82FA554A42904E1264CC659F72C9E67BB51F104041
                                                                                                                                                                                                                          SHA-512:3D90EE57AE7EED8D943E25E532D7722C195E37C3D0B9A86174E2A95769D88A2CC16934D9D4C79BC5EA9B40B7681A1F394BE6533258B0585002BC79BC204122B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............2.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT....I..@.D_.U.+.......D7ZRC...|.:../.......@..3.....NDh...AUqfF..Ue.&.s......R..{...}..^..{.8...M...9.c.{..m[b....9.?G<.>.c._...*"8....|]....CD.u].<O.}.8.......!..a..*].FJ.].u.m....F.g..tD.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\notebook-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 36 x 10, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2395
                                                                                                                                                                                                                          Entropy (8bit):7.891487436376082
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:6P0QPMv4fTglb8wQ9idFNYie+dsJlrqY3NUw2lFgHYXhfDVO0ysquytEGzgkrGpc:6lPFTgl8wJjKiliqOtUFgHabpqu+EGzV
                                                                                                                                                                                                                          MD5:B7407142091B89423BF2B0FC52807DE9
                                                                                                                                                                                                                          SHA1:81F78A170937DC7048E72F7499A693D11C73A2FF
                                                                                                                                                                                                                          SHA-256:93141FCF4800865510052B99675C59F6A81BC1DE5F0A67F9D7D9D490701E43D5
                                                                                                                                                                                                                          SHA-512:66182B747B8A40FA02098310914581B6F1DD7CFF699773D61C1D787666AE401A89CBFE71B4BDE87E09DD999B7D4B053906E47DCA0D8AF8EB509D4B1BCC8CA048
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...$................zTXtRaw profile type exif..x..XQ..)....s...........'..jw..vy........!.N...G...U.TE...2..k....._.%......}.c{... 41...S..2...~.Q...dw..=....e.._$...^...../..._..s=].o.yOz.(?.N....%..b....m....3.i.&..WX.+.Q..+. ..{>s~.....o.3.U....=.?a....;.|....;...".....@.p....Fm@...u.]..`..s|...V|..z...!..(....J/.V".Z...e_.U..Xi..I...6c.N..O..%H.....E;......r..U...`(.LV....g..s..u *.LP_...k,.0w.1....y....}....B.........c.).[l..3c....B%...`A.-XLa0.[a).d%.R........1.@.!.".27JJF.6~...KB.N3r....,.7...U.?Z.14...H..K.e4n.IkM.IrCY..6U5.:...X35.n.Sg.@.k.........50~.e..Y..6u..s,..KV[.l.5...i...w....L...n.}.@..G.....=..k7....Z.Y...3N.XCkR}NQN:.....Z......t8.Vj....,w...".p....@a.$..w.{..$..o.+...O0.@...}...:......`....c.Y.7...Da.....J.}..A..r.}j..F.S.w.p...%Y[1.l.>[...C....a.oW.s..KL.9h.8.0..A^.y.4e.Z(&.*.w..EK4.$....[.9g...oksPo.!o..z%..{......B}m.6...^f ,..9.q.z.G..x.......5.s>.H..0A..&k(....Z......1QQ}.|x+].F..j.L...Z..JD....P..Uc!Z.ixn

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\notebook.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 38 x 9, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1853
                                                                                                                                                                                                                          Entropy (8bit):7.850148651842548
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5AlT2iyDPbMypM7GP1+Upf49p4efFVO0ysquytEGw5Yt:5Al6igjMo15KpHbpqu+EG4u
                                                                                                                                                                                                                          MD5:DA8336258FA48036948E2D982DDFD03D
                                                                                                                                                                                                                          SHA1:476CD47F40EC9012AF0ED4ACCA7351F8CFC8BC54
                                                                                                                                                                                                                          SHA-256:5B759AE729E5A1B12E63C2A49EAAE46EBC58C76A5ACC48EEEAECC3C540DA4B67
                                                                                                                                                                                                                          SHA-512:C1E5490725B1FC31641A6B881A3354D7E4DFD1F25B7CDC649EEB13B9204372197704D37DA6B37419EFD17A7D1BADFC3EEB5A3E33DFC545FC5ADC5E8F75B782DD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...&.........^.^M....zTXtRaw profile type exif..x.Wk.3)...*f....._.3;....T...N.7eR............E.b.bE.j.k..0(.v.s....\..3z?..aH`*.O......yy}.n....P.'\.E...-3..-H..m....@+.}.......r}... .....D6Di..%.(.s/7...m.*.2.(..[8.^H..w.......]...1.i<.>.K"}...Y...H........D....].. ...n....^.u.Mw5...y:.).V*..i.....(.q.6......iR#.u.A..3/6...+..H....9[.i................T`y.D.............&....t#.w^..fn.!.B./.........B..A9a.p..~S.^s+......m.Q.y)@.`[.....JIH)...!...5 .k........SR...m.ctdYXyO.6....2pSS.Y9...rA.5I.ED....4iVQU.].%.&.fV.Z+.."E..Rji.kB....j.....P.......=..k.^z.m }F.2t.(..6y..21u.,..(,T...,]...9r.g.W7/^...v.....5.X......0...*h....1...m3....Y,.3o.6g.2..0@..&L......W..-Hy.7......?....3o.X.{.....*.1.....Wi...`_d}:.j..dL.@TY....w.g!.S.6*..t...y...^....TS..~.e.j..2.{.V.@...srGZ...;5....q.%.S......g."./...R].PG...7]q'Y2..) .?i...Z{.u.~.....w.a.|..@....Wp..-...3l.Q.~.-<..o...I}.[....g..;l....[..bx.-.|1|.f..XA....zf....z..D...qH...c8.^..R...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\progress-bar.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 4 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):152
                                                                                                                                                                                                                          Entropy (8bit):5.376877128129555
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlJ7t3lllAsrtxBlly+r3U8G9RthwShLKOWGEVwPP5aHg6zUoeg1p:6v/lhPJlllAsQiUjdKcPhaHgWp
                                                                                                                                                                                                                          MD5:53A6E80D057CA7E70E83A3F037E6C776
                                                                                                                                                                                                                          SHA1:0E92F1D47D0AD1962EECCC7B1E064FEB8A0A363A
                                                                                                                                                                                                                          SHA-256:35F45846FAB1665A0E1AC505E20C2A90D42F2DE6C9DA195612554918D266FC67
                                                                                                                                                                                                                          SHA-512:6111BA2E2E59128770A5319598AEC13F8638FE242BF3BF86322B8FE085E97B153D012E33EC31ED6DAB23FEF7B5BF36DFFE8F805301DC772A4392500FDF21F872
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............~....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..cd.s.?..`b@.....`..........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\progress-bg.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 4 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):152
                                                                                                                                                                                                                          Entropy (8bit):5.318622174364598
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlJ7t3lllAsrtxBlly+r3U8G9RthwShLKOWGEVwPPZyOHDe/lVp:6v/lhPJlllAsQiUjdKcPxycObp
                                                                                                                                                                                                                          MD5:D5750057E860A3A677EE0A8F6612E5D4
                                                                                                                                                                                                                          SHA1:93D2E685B39B5B72FE50631622316D96C8015214
                                                                                                                                                                                                                          SHA-256:5315959568CC3E412FB3441B5E79599F56EBDDD73CB568CE9CAFD0973ADC1428
                                                                                                                                                                                                                          SHA-512:00E0A4AC2F4B6CA5155818A86CDCCBB17818D1892AE66DA3F3683B2CA3BE46C9A14FAC0D3217970E30DF5127798E4B9C4E23607A0401116F651E0B0A5E76ADF5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............~....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..cd.w...01.....tb..<.{.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\radio-off-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):862
                                                                                                                                                                                                                          Entropy (8bit):7.578072354809667
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7yiUpZYgqSj90xT0myX45cLt8fm4iDOZp39g3+DcNj5sS52hoSluOscNfF0xl:liUpPnaD2LYEOZh6+cNjuSoBR5Lkh
                                                                                                                                                                                                                          MD5:6E13C7109B16F4700E88E0173E024865
                                                                                                                                                                                                                          SHA1:69F4DD7925689D96FCC718215A2445E631B1FDD8
                                                                                                                                                                                                                          SHA-256:83D08A10CC1AFCC1E8F9666060C5E21B12B42F350AF020201DE682F503B3D0B9
                                                                                                                                                                                                                          SHA-512:13408A08A6A28C0EA29138F532A389E623CAB069752ECB5723708C094A29EDE9A259BFB0C3D564FBBB3CFF6BE707DC9B63CF568EACC1A7E7968226AE345F7047
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH....KSa..?..v.Kf.is.c$#...j.Ewb..X7...&(b..B.JB.#....7.y..aC.t.M.....t...q]...Q.P.........}..y....6S..f...J..u....O.....c.....yb..mM.n...k..t..j.B.RY..r.......}.*....6.Z.\.D.N .x.(....T......p8..(..h........>;;.T..f.[..{..D....=....0.V.........".m{{.....}`.8.N..b..sss..+....G...].%4M2S.`0x.....y....<...^@..2......UU...l6.666v.p...5....K......H....\m......p7.T...i.@U.v.3Pd.Y[%.P...B.$.T*.R..GGGR.d......V...|~.Q....(..|j. .....Q3....R.T.....aqzz..F..e..b..M.Ro/.XXXxS(.v..f.8d.`Y^^..B.........}..bq`.(.U..M.L&....^...]g.O......3]..9...-b...$j................p.T...OLLL......!..~`..v..x.......Fo.B..^...r.\..r...fwVWW?...?88.....`.. ....a......P'.7.XlA.(...w.@...G...*.q`.-..+.XeY....cN.0....s...v.P....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\radio-off-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):825
                                                                                                                                                                                                                          Entropy (8bit):7.5550055671438034
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:liUpADSmH6KjWt6fGJSl7mdVyxMvEBsngD9:lNpAR1Wt4TZA8D
                                                                                                                                                                                                                          MD5:7018CA0497303E3D42E3DD8F15C54786
                                                                                                                                                                                                                          SHA1:922BEACB65A6C11734FE79545FDEF7507C8ADC69
                                                                                                                                                                                                                          SHA-256:6BAA8581689BB37C1E7999970E6C9108EF3ADCE13CA901982D65E6BA665879DE
                                                                                                                                                                                                                          SHA-512:86EF8C1E3386D49351C51709716D930FACC7B76179D1215C507C55AD06809CFF7D208C8B465B83F1F179AF5C1E6B0E02F5F41322B4A48CEA16B7A9AF9431060D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH....K.A.....].4..X.xJ..=.A.<.......R.'T...`...=E..6...&"..M!..$.l>l..n.;..E.&}...y.......)..p..o.M..8.0.E..x........\N.u=].........\..nmm=.....]b.E.>%w...?.L.T*.L..0/C.\.$..../...r.R8..H.R.W...T*.2....Ip.fN.......6vwwW.>..<....PU..M.m...=..:=...D".h.X<hU@...H$....e......@Q..Uav.I...............Z%.-..N...-....H..z{{oc..T.C.$_..dY....Y...L.4.....Z....8..pb%(#..~m.@&.Ic%C.)>~nnn~l.@"...4.....{zz...._...@+..GFF........A.T*}_YYy...._...C.&.....m`ZU..7M.....i..-.q..@?p...>........^..!p.+.v..;o.X%.i.....>..Y.....,].|>.-...........8.*X.|bW.....[....E.....7999644t...)...U..tncccgii)Y.V.@.......y...i.Uc}@...Q.......%........M.j......HXa.%.n1.)VY..?D........B5T........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\radio-off-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):345
                                                                                                                                                                                                                          Entropy (8bit):6.84632699510936
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPZXQiUjdKctDfFqiFS7Q4whGOfLT7sWmZWYOJaUVhlo/dbbVCiWDjup:6v/7yiUpZhFhI7qh9LPe1cl+/VAHc
                                                                                                                                                                                                                          MD5:25F33F058F12BE72C8D01DDB7FC35B85
                                                                                                                                                                                                                          SHA1:4240647F1013F79D2C8B2C97EF174D7D44021524
                                                                                                                                                                                                                          SHA-256:170193F6373CA0E4902AFDDC46BD15B3BFAB082F0FD438468884BCE28759A3C6
                                                                                                                                                                                                                          SHA-512:E22F8593AC3C4897D2948F09E9165D0B0E365E68FD4502167605814AD1284701B1D746B5D3156D6CDBE0D9AFE0AB600D8CF682FEE184BD69D04D7B9EA466E1B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH..... ..GE..._.*..X.E..8..opY..N.1..Cy.W`..vT.z`...h...u..F;r......s.#....q%.IB.+K-.X0e...^..3|A/.khmV$.n.w..TG.$ANK.e.Q.C|.zc...).."...Z.lY.@.s..)....Uv.a.kL.)..H..lv.dB.@...N.o...x...Qrev..L...^....3z&2:.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\radio-off.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):754
                                                                                                                                                                                                                          Entropy (8bit):7.575023734655896
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7yiUpZc/W9JO7S19CDoELG/uDFLuPF02jwLYC8ziOYRBlVKrQQdgCdrZNIa6g:liUp6WjX1tyKqFyPG2joDitilVajdrZL
                                                                                                                                                                                                                          MD5:2C5F3EF927D242A39050EA082D106C53
                                                                                                                                                                                                                          SHA1:F6D5211F72F5489D2A05C3C5B91A4089F2CF894E
                                                                                                                                                                                                                          SHA-256:D3134DB8449E56C7933AB4B145710B05D9E025CBB71D1040C8502DBC01DAFADB
                                                                                                                                                                                                                          SHA-512:D50011BCDA569B70BCEE16AFB16EB45CCB08E07B28680AD926BB1058DF705D7B17547174373348061D2C863BCBCCB56380FBAC182B3E4BA5E8FC81ECB08A7546
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....oIDATH...OK.Q....gB.....t..".u.V.2]...U;."t..KTJ.|.m..Z...Z..Q..)#..,f..N2mb../..m.I/...c.9..w.}....C..S...+P...N..eY..ZA.|....n7..v3... .>..e..i..5.r..y.T*=...[.E..C...R...H..I.....-....#...yo...&..w"..L.Ry.]r.J.....#.b......l6..o[u.....G....E.0...l..po.B..</...q..H;..>*...8.4...N....7M.....@R.$..4....d2+H.T....q.....W..........D.L.(...=..kR.Z.v2....O....8::..........nt`jnnn.^...z........"0.....[...}=..;;;....j@$.$....`.q.O7......p.[.*.4.7Ms..k....4.. /\...Dt`...,omm..}.b......../.eYk......F..'Eh:...lnn._]].....R..@..V.........._<...hH.;...P.J..3.QJ.&.....&.].jc/.W.6.>!B. )a....~...AW.!.........Gh.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\radio-on-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):988
                                                                                                                                                                                                                          Entropy (8bit):7.656117431081259
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:liUpX3ZTrT4sY43kmw9H4gOR5glL0fyddt1:lNpZT/dN3kmeYgO8lL0fyddL
                                                                                                                                                                                                                          MD5:2613B1834796ACB65E1665BC10F76EBD
                                                                                                                                                                                                                          SHA1:6FE7584551309D6BA77A8FA685E1CB9E61D47BCC
                                                                                                                                                                                                                          SHA-256:AA77A18D01620F646045F7DA83617B41C60814EB3B903EA53AEB3FE975BE3EDF
                                                                                                                                                                                                                          SHA-512:97FBA6838CFDEFA2F7866D3E3D8D80DAC4442E54E379F9E49C43E85B2FBBCE3A76529C458768A837C3520195097197AFD597ADC654EDE664ABC73E5EF89EB54F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....YIDATH...]h.U...;3;.3..m.qwM..b.."./}.UA...b.R.Rh^..7..A#..b.Q.RiS.+B%...).....d........0..K.......{.=....{...,..vE.*TkY.....m....@.5@...........}L3.;.M..h:N.Y...2?;>...'...T.V.....u....q..AkphT...B....SS..q.... Y;M+...V&.......;...|.,....F....i.V.....g......+.R......s.X..@S.$...:.....;.l..@...5.|.\>.. .d.......=...Qp).]..........4.R..?.........L...,`.......l...)...R:..d...b..2.o]..`....|.. ..6m.Dp8....Mk...{,[j..Xb...%...b.N..'..lO..IQCF...4.?...W..".v....l"0...gq...0^...u\...,.....vW..\0.....x.........ak'..B.Q.4.b_.....v.[..c,[.x.7K.../.......[.]..'....k.3....~.s.q..[.....=s...sgN..b^.8.....v..|x.#[C...F.+W&.....@.....@.\.t..?..3..t.V...<15rp........W...~.p.\.t..u.p....P......T..|y:.../...P.....d..8....H$....{b...2....H..pl{q%?=[...:........r@....4m.h.l.@.H.w.=....o..T."0...[..........1.VX.5.....]...7.0.....,H......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\radio-on-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):916
                                                                                                                                                                                                                          Entropy (8bit):7.6795036958973055
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:liUply56OBjFrzLsUd/BBHP5hhxaX/uqItaXkDVb1i9:lNp0r/FpHbhAX/qty8Ti9
                                                                                                                                                                                                                          MD5:BE29E318E08D072E65EFA2FEC6DEA3BD
                                                                                                                                                                                                                          SHA1:C617AFADF3425EC0E4FD45BA53BCB3DF0A0E0B5A
                                                                                                                                                                                                                          SHA-256:DB7FAC76F28646EA31EBC63BF807C82A48A1945039F0F3F15BA686CC98C61DA8
                                                                                                                                                                                                                          SHA-512:C6B1C522C3AEB46A7D1852FBC6C61C39D59DA7EA9AE99528976B6312FEC797DAA6333CCC94A3DEBDD2AA0A0083CEEECD44DBA13774B9FE5095EFECB364860553
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...MHTQ...3.|......`.}...-r-D.p."..M ..... 00.*.....Zi.dE.T*....e...9....o^..W..7....{....}....l..~...1..x.X.41"b.#.s.P.'...*.s.`K.... ..!....~........ .....Z.R..QMq.iT. ..,,L...E......d9.X............&.^m.6N.4.....h..f ....2.....6>z.c......D,.D..hn.e..u...g...|.....@...L.+.......|O#......e..k..f..g.dk.u...v."....-.F.f..Jr..(c.....T.....\..@Q.A*...F.....rf-...s..t...7......A2.u..Amn......e.Z7.....h.%.G......J....$. .....Oy.......E."6..mz...G..._<...G.>.....3...K.xX`............i.......g&..An_{..7.g..,..A..gD.O3.......?....]...x.....".`a..,.v.SP.Z.x.......^ ,.d.x.d...........%gO..k#....4.X.6.%tM..{.LA\%N.6[B`..,..:.z.C....."RP.d[.. .(.n/...~v..I^Q>......p.M2......0??...S....(.X....).. ..$H...Eq.^`.....sbM..5M_..$....h...".....4$..a......4.4....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\radio-on-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):512
                                                                                                                                                                                                                          Entropy (8bit):7.3368069787851935
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7yiUpZQtVcijmR3LyKaof4+3hCCh8Lou46Zm2FKeF/c:liUpejcd2iAVHIzU/c
                                                                                                                                                                                                                          MD5:599CAA6B3398E6834D837EE77590D48D
                                                                                                                                                                                                                          SHA1:733BF2AAF8E686D68C1597E60BEF3FAFDD6BFAFE
                                                                                                                                                                                                                          SHA-256:CAE0C84686E2FDDCC32ABFC48F35F423ED33A4A53BB4BF9E7293C90E198F9BF7
                                                                                                                                                                                                                          SHA-512:8BE0B35D87928F7E6AE1202C9C7001A0FCFB52EBA0A775F39084E2A0F43AC2C33C06B69936EED2BC480CBFDBA4DBAB30B21D9D2E61F6A02FC5E795F551C3664F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....}IDATH..UMo.@.}...ZM..S..h...zn....s..6.D.'...,,.......i|..^...f.sG...}.....&l....(.%..!........I.1#..0C.1..u........4.W!E...m.A.....D..u...j;.<Zo0..;.gX_....g..=.. .>.f.a.(.......x..^.#K...R%Z~.(..l.J.`Z>D...."./p.....k.D.E.B..w..hb{.V.h....Va."}>wX...U-[.ZE.z4...".Y@.@....z.E.c...p.}..J.....j..k..r_.._.._0C.....X........Q6p]..Kv'H.T..?....G.V..Y8..>C.(Hee*..ZIL..+....%]..5......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\radio-on.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):877
                                                                                                                                                                                                                          Entropy (8bit):7.63682534647624
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:liUpIeYQdAHl7V1Ry0myCcw4GYVvSz/+vwzRiqFgte:lNpIeXAFJ1Rxmkw4/ugwNiqFgg
                                                                                                                                                                                                                          MD5:3EF2984704516FB9FD934F116F3E230E
                                                                                                                                                                                                                          SHA1:4BB86A756BA2BFC326C638EC988B283B36FF2B36
                                                                                                                                                                                                                          SHA-256:DB86085F1FF95DA4747F74D2E4F3D2EE697CEB54F180A4D2CF3A59DE0D6A62CA
                                                                                                                                                                                                                          SHA-512:CDCDA4D834981A437EF060D76E18B6B6BECD18BAF33E3A0B1CF07270754859779CD77592DA685A225A8B78D8DAD800ACCBF6D35BE0F0464C1B048140B6724654
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............w=.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH....K.Q..?3;;..%...Q!.E..`".dP...=d..D....bVR..EA.T..=..O.....(.!.%-.6K[.......wv.u&K..0w..........9...-'.D.c...%...+R8P].o.6.bd)'.g....2>v....x.6i!4....U.u.`i.8.k.C.1..~..4P....%.X...EE>.<k".{eNp..k%..r.y.Yk.....%.[.<..j"..N`;...g{i..6313..7...78@........\..)MqI*..c..7-wy#.%...L.........(J...*..$.....NsTY..l.K..\Z..U.......[....L....N.'..R."3.]+.u._.'x}.}03PP.,'....,.e.}qS\..$..=H....].....`ZT`J.c.i..[.../...33q,E,Pgb...w.]...C.T..Z.!.......E.F.......r..H.....&...N@G..(....>..C..E.47>."@4A...........j&.i.$p...H<~0@Yy&..u........0m.H$N....o.).I.znP....6.L....,!.`.k3..|E~.g..kp....xjj...S....}.........P...~...8X_N..2......m..........\8.....!.....o-S..2.....1V-...hZ..S..+..mO6....,..WH..(0#.5..X...u...v..G......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scale-horiz-bg-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 40 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):210
                                                                                                                                                                                                                          Entropy (8bit):6.182030132499559
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlVrtBajaeTprtxBlly+r3U8G9RthwShLKOWGEVwVsRVIDDO8+2i+q1:6v/lhP6jaeTpQiUjdKcViplLn5dmJop
                                                                                                                                                                                                                          MD5:EDB3BB0FD11B91F178AB5939482F0DFE
                                                                                                                                                                                                                          SHA1:DCA1585C6BFC76377679E7CA824E66C506A084AE
                                                                                                                                                                                                                          SHA-256:F4FE099129E831E05A3A74746AC0B7AB344D6181F8A92F8F34B9C150D8E6CCC3
                                                                                                                                                                                                                          SHA-512:689F4FF5E93F6B3B10E5937504B5786665B46B220565EAD648382B79BC5BC8DBE931081636683CFBE41E483197C66FDA36EF1C96CD553562488572C2ED9BACC7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...(..........F......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....OIDATH...1..0.C...r..f..LY....Fo....3...B..*p&w....RJW,7....."d.....y.H.kf.+.....i.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scale-horiz-bg.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 40 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):216
                                                                                                                                                                                                                          Entropy (8bit):6.103684291361389
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP6jaeTpQiUjdKcPNsUhgXlbeDwwqOAPvbp:6v/7yme2iUpZWUg6sYKt
                                                                                                                                                                                                                          MD5:D5D8DF987B8D8B3236EE3215438D7FD5
                                                                                                                                                                                                                          SHA1:A10BEB52471F5F8D82E4360D5F82941F79FDAD3F
                                                                                                                                                                                                                          SHA-256:4A942C95A279AC685AE1B59E7BF2A3F7449EF9E079F648706F0843F73673681C
                                                                                                                                                                                                                          SHA-512:2E95038D16225430753EB97225D78ABB43738A9ED22EF84891E0604B2A0805611A79084119C5446A87501AC9979A01488041B214EA9CDFFE9D55F3F2E60A07E2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...(..........F......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....UIDATH...1.. ...Qbc<..?.....F[X....'.O.3..[..."..~....h..f...{.r...`..'./..w..>..d..'R.u,....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scale-slider-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):483
                                                                                                                                                                                                                          Entropy (8bit):7.214283907954203
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7KiUpZv1vIQVOzhJ5K65WOytKeCm2N+W0z8fN7:hiUpvIQkNJ53txgW0zK7
                                                                                                                                                                                                                          MD5:246D6914AE056487F4AB82C199A8EAF3
                                                                                                                                                                                                                          SHA1:E5C540F5C256D00E87500642862A838B7D97CFEF
                                                                                                                                                                                                                          SHA-256:0755E8C6020D577C583C4A5D36FE4DC0DF624D3B5F0CEE7739BB3D6E9B38F3D0
                                                                                                                                                                                                                          SHA-512:C4378419727DC23A53F15CEBD06C9779FA572A9FBDF8EAE2F3D9B3B503A7F67F2556001F05238F29702447588166404FB3ABD67ECC335E13421C9A935F472265
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....`IDAT8...?K.Q.......E..g..Rz....BJ....?.D...z..m6Y...O...iQP1D}~.=....G..H.....ID..+.......`...]..z.2].../........"....lP.k.7.\..S.....v.`F.%1..n..nb..7......l.T.....8X..........1....|q.!.:6.j.D].!f.m.4..3..B.....M.Zq.4...v.D.d,+...\.>}..H..HfeN...I...p.... [.:/......A.b..F.|3v.L..........jz4. @T_...I....FE$....#RA.-+P.H.?...9.v+@.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scale-slider-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):483
                                                                                                                                                                                                                          Entropy (8bit):7.214283907954203
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7KiUpZv1vIQVOzhJ5K65WOytKeCm2N+W0z8fN7:hiUpvIQkNJ53txgW0zK7
                                                                                                                                                                                                                          MD5:246D6914AE056487F4AB82C199A8EAF3
                                                                                                                                                                                                                          SHA1:E5C540F5C256D00E87500642862A838B7D97CFEF
                                                                                                                                                                                                                          SHA-256:0755E8C6020D577C583C4A5D36FE4DC0DF624D3B5F0CEE7739BB3D6E9B38F3D0
                                                                                                                                                                                                                          SHA-512:C4378419727DC23A53F15CEBD06C9779FA572A9FBDF8EAE2F3D9B3B503A7F67F2556001F05238F29702447588166404FB3ABD67ECC335E13421C9A935F472265
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....`IDAT8...?K.Q.......E..g..Rz....BJ....?.D...z..m6Y...O...iQP1D}~.=....G..H.....ID..+.......`...]..z.2].../........"....lP.k.7.\..S.....v.`F.%1..n..nb..7......l.T.....8X..........1....|q.!.:6.j.D].!f.m.4..3..B.....M.Zq.4...v.D.d,+...\.>}..H..HfeN...I...p.... [.:/......A.b..F.|3v.L..........jz4. @T_...I....FE$....#RA.-+P.H.?...9.v+@.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scale-slider-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):454
                                                                                                                                                                                                                          Entropy (8bit):7.155545009663227
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7KiUpZAms1XZ3T/4gehQCypby28ImLyI:hiUpWm8pjggehSFy/IqyI
                                                                                                                                                                                                                          MD5:C110F0C31301CAD65EB31970F55EFA62
                                                                                                                                                                                                                          SHA1:91E4E293A3CF692F13996ADF0E017C1F4CC2BAE4
                                                                                                                                                                                                                          SHA-256:82A48EBE56C4BCB1ED9D6126CE7A4ECA40D3B89FB5733E80A7CE9EAA8CECE06C
                                                                                                                                                                                                                          SHA-512:A051C93C72F19E4B6D17A56C2A0AC88A52FAFB0C976FFAD900801B90C830E38B97E068138575E4CA189400EA15228E8DCBD15FFC89CBD3A3C483F00931EABB60
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....CIDAT8...N.A....;..s.&.$.-.........k^@.{.k......4.....gCc...*..s;..Y8..[.t;...L....`.Ef...(.<..=K...R....k,0.i&.6....."...Vm.X...$..u..I.w"..9...<%....t0.q...u....~.c..A#O.e....PY;.....a....5...... yh...!.@...B .1.E...d.........V..R5....PI=.N.&..j"r.M..B ...."...\.q.s=..zni..GE.n.....\.RN...E........`.......>.../..i.$S......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scale-slider.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):454
                                                                                                                                                                                                                          Entropy (8bit):7.155545009663227
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7KiUpZAms1XZ3T/4gehQCypby28ImLyI:hiUpWm8pjggehSFy/IqyI
                                                                                                                                                                                                                          MD5:C110F0C31301CAD65EB31970F55EFA62
                                                                                                                                                                                                                          SHA1:91E4E293A3CF692F13996ADF0E017C1F4CC2BAE4
                                                                                                                                                                                                                          SHA-256:82A48EBE56C4BCB1ED9D6126CE7A4ECA40D3B89FB5733E80A7CE9EAA8CECE06C
                                                                                                                                                                                                                          SHA-512:A051C93C72F19E4B6D17A56C2A0AC88A52FAFB0C976FFAD900801B90C830E38B97E068138575E4CA189400EA15228E8DCBD15FFC89CBD3A3C483F00931EABB60
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....CIDAT8...N.A....;..s.&.$.-.........k^@.{.k......4.....gCc...*..s;..Y8..[.t;...L....`.Ef...(.<..=K...R....k,0.i&.6....."...Vm.X...$..u..I.w"..9...<%....t0.q...u....~.c..A#O.e....PY;.....a....5...... yh...!.@...B .1.E...d.........V..R5....PI=.N.&..j"r.M..B ...."...\.q.s=..zni..GE.n.....\.RN...E........`.......>.../..i.$S......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scale-vert-bg-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):218
                                                                                                                                                                                                                          Entropy (8bit):6.1890308574344886
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPysQiUjdKcNAIKGqyF9DcjE+rsjp:6v/7wiUpZNoly4xsN
                                                                                                                                                                                                                          MD5:51FBCB2E2C42EA11A4387F40FDA5EA8A
                                                                                                                                                                                                                          SHA1:ABAA7352DB25BDF4D61A5C1C8BB65AE4959372BE
                                                                                                                                                                                                                          SHA-256:CFC1FDED8069A0E3D2D49C99433A6DE688C363ACA093686D823F9A474A589B29
                                                                                                                                                                                                                          SHA-512:9AD8713868BB0A13F7165D6DABBAEE8116C47CB12017A7E7217721163AE3EE7F1DE0A07D22B9975C2AFC54BA7A7BC3149BAB28B98161AAD064D800E088246823
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.......(......1......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....WIDATH...1.. .D....?...ZHa!.BAB.WSl^......f.b.;p.....tg/....n..%P.@..g....lq.+p..*...n.{.=........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scale-vert-bg.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):226
                                                                                                                                                                                                                          Entropy (8bit):6.191646223213977
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPysQiUjdKcFNscHZhaCdNKSwp97VCnTp:6v/7wiUpZFNsgfaWpQpw
                                                                                                                                                                                                                          MD5:FA82CAF1B06FA37A2A2047F7761E1032
                                                                                                                                                                                                                          SHA1:BFDB5E345AED6E37CAEB74E1C7427F39C827E339
                                                                                                                                                                                                                          SHA-256:22C9854AAC3CBAB71EAC9CEBDC9AF6737E5DDF296B6AB3E9A7C08CD0534923C0
                                                                                                                                                                                                                          SHA-512:C6427A50FE42ED855ADEF30E85EB7096AD45E3DC196634EB201C7D6A9F48FCE372EDEBA08266AA42444E1E91B10C6C3AB8EEF7FDB71A1774DE2DA8233ADEEFCB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.......(......1......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<...._IDATH...1..0.D..F<...t..*.X.2..& .!...k...o.v. .....(.....aW.Sc....A.......s.I.30...7....v....O./......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scroll-horiz-bg-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 18 x 17, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):168
                                                                                                                                                                                                                          Entropy (8bit):5.603492353587422
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPloQ/7WsrtxBlly+r3U8G9RthwShLKOWGEVw/BxdoWFZkio5NJvS0FS:6v/lhP2QNQiUjdKc/9oCaiOhtF4p
                                                                                                                                                                                                                          MD5:E99CA55B3237EE54E1589E5A87978539
                                                                                                                                                                                                                          SHA1:E16B929A7F5A1B50043CC9A0AA97934D0D764F7D
                                                                                                                                                                                                                          SHA-256:612CE0324F643E0B7E958F1E9F36010467563E283194BBB74A795109C11A1A7A
                                                                                                                                                                                                                          SHA-512:676571667BA311F9AAD598E6793BC8D404E3A4462F7E7DD1F7525D33CC3F751B7D90B2C861A95E64CA9DACEB6F4A6D7CB4FA6042C43A92FB6F40AF788F8D40ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............Z......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....%IDAT8.cd``.d..`.....j..D.CF..5h..l...W.6.. .....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scroll-horiz-bg.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 18 x 17, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):168
                                                                                                                                                                                                                          Entropy (8bit):5.603492353587422
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPloQ/7WsrtxBlly+r3U8G9RthwShLKOWGEVw/BxdoWFZkio5NJvS0FS:6v/lhP2QNQiUjdKc/9oCaiOhtF4p
                                                                                                                                                                                                                          MD5:E99CA55B3237EE54E1589E5A87978539
                                                                                                                                                                                                                          SHA1:E16B929A7F5A1B50043CC9A0AA97934D0D764F7D
                                                                                                                                                                                                                          SHA-256:612CE0324F643E0B7E958F1E9F36010467563E283194BBB74A795109C11A1A7A
                                                                                                                                                                                                                          SHA-512:676571667BA311F9AAD598E6793BC8D404E3A4462F7E7DD1F7525D33CC3F751B7D90B2C861A95E64CA9DACEB6F4A6D7CB4FA6042C43A92FB6F40AF788F8D40ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............Z......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....%IDAT8.cd``.d..`.....j..D.CF..5h..l...W.6.. .....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scroll-horiz-slider-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 18 x 17, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):265
                                                                                                                                                                                                                          Entropy (8bit):6.596710310426762
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP2QNQiUjdKcdhK8m4TzGBUSsVmV+JrYZmBtTUDRFVp:6v/7kiUpZy8Puy3hJsmBtM
                                                                                                                                                                                                                          MD5:3D0D1EBEF02D5AF12322B24A584B5880
                                                                                                                                                                                                                          SHA1:6EC268365CD052A3DEAA413280F37F0128F3E7A9
                                                                                                                                                                                                                          SHA-256:AEFA59DDFFFFAD9F5E89DADF9D3D89EBD979DB2E4F6059B3D75FDCE4B0A59D44
                                                                                                                                                                                                                          SHA-512:28FB90CA4C0160D3ABE14489FE6771CB2701B4A241BF4FB6D57FEFEC166A9BC078A7980EB4AF11C6C62A2431253016E775E7CD117B9E616F4FC80E161307679A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............Z......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...1..0.@.O.....(^.].y..=.W.I.-\.Dt....$dr.,/?/?a.o.2.A....^.1.Z.jp.:....86O.v..p..e*.."?.5...5.."t.......>......p..?q.....i>.4..U`w.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scroll-horiz-slider-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 18 x 17, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):264
                                                                                                                                                                                                                          Entropy (8bit):6.501317879219233
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP2QNQiUjdKcfKdflRjQC82P0+/xiM0xprqJGVp:6v/7kiUpZydfLU/2ckSl7
                                                                                                                                                                                                                          MD5:FC7E0A30F55C7A5A14F91856617C772C
                                                                                                                                                                                                                          SHA1:602260A1D1DC3561C25D6976B8BC08E98F45EDA7
                                                                                                                                                                                                                          SHA-256:4BAB2C65BB9B4B51C3D98AA0F8743FA86274470B1012AA44374EC40B44BAFD2D
                                                                                                                                                                                                                          SHA-512:0205037633EEC3361F15ED903AE57240677AB1DECDC5A701690CB0590A97C85DE5A98D4F58BF06065F7E0324E33180AB341854FF4B7ED27BFFE962C49B815454
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............Z......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8.....1.@.OE.;...p..qt.[B.a..n.;+QK.c...,..A..?/!L..Y.7..b...#.\kB..Xg.y.........v.L..B..&....Xq.R..|>4...X.2.'l.Z....=n..N$y.u).2b.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scroll-horiz-slider-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 18 x 17, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):256
                                                                                                                                                                                                                          Entropy (8bit):6.506372696019124
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP2QNQiUjdKcnAz/tZeY2NR6xlEkMXjp:6v/7kiUpZ+w1S3W
                                                                                                                                                                                                                          MD5:9429E7A3EB6D9F3C0CAB5D567D0CF190
                                                                                                                                                                                                                          SHA1:933261C3FAF45B663543846DD9E3EBD6F761A790
                                                                                                                                                                                                                          SHA-256:EFE45F16FA546C51404C025C9717A3D3B248D10D2DBFC5F8EEF677611A363143
                                                                                                                                                                                                                          SHA-512:23204759B097D77415F54110865DB2D3CC6D8279705B4371917FC6312C6934C5F98226D425AC93E1DA22D3210C579925DED443D5CB6F9BE80296975828B346BA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............Z......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....}IDAT8...1..0.@.O.............B.p0..i..N}..%y.?;...[...D.0a..&....H....c.`_..{.T.B]!.r...D.4U.{....n.....P..8.>...c..w'..b...(.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scroll-horiz-slider.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 18 x 17, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):262
                                                                                                                                                                                                                          Entropy (8bit):6.557996621226572
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP2QNQiUjdKcZKdW6/OaniAAk5sZjz0/Vp:6v/7kiUpZZKdZAAAhz0/7
                                                                                                                                                                                                                          MD5:2639CA5E6E3C83480DE41A1CAF973125
                                                                                                                                                                                                                          SHA1:029DDEC39E0F8604DE8CED6917342E808ECCFD6E
                                                                                                                                                                                                                          SHA-256:0388C12E27773366CC60004DFFED0A997FA8871016BCD11BE3091B0582C48593
                                                                                                                                                                                                                          SHA-512:B813987F0CEDE162752E10A781D058FA6A06821568AC8AECC5BAB754A9AB06352B894465B899D20A46D418D47A74E2F45914D2D3F2E0E87EB7FC3447365770A8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............Z......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8.....1.F.O......7......F.n.....,.k.0..$...W....0.7...C.up.F.......\..).-.......L..B..&T.&4V..5...Cs<p..*3.`...f.....$o.L.j.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scroll-vert-bg-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 17 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):166
                                                                                                                                                                                                                          Entropy (8bit):5.505552048554462
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPl8hllfkansrtxBlly+r3U8G9RthwShLKOWGEVw5s+oWFbaWj92rUxP:6v/lhP6hnsQiUjdKc59oCp+IN9p
                                                                                                                                                                                                                          MD5:8A4C489069BD40EA4CADC29F782D1CA4
                                                                                                                                                                                                                          SHA1:A130FDCF02F0EB7908E163017628D0A481A0D7DF
                                                                                                                                                                                                                          SHA-256:99F74604B278925114A0DD49CF39C0414EBD99E0EBAEB2A6F0EACE4508AA45CC
                                                                                                                                                                                                                          SHA-512:CC25850A9B9F55FD2F04793F487BEADDC67CA077C8E0CC013AAAD1F764CAD99A436D792404FFDCE0AF077DDE58EDF7478B2899259C432DDB9B40418FBFCFBD54
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............5T....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....#IDAT8.cd``.....3....%.G..5d.QC.m...a. ........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scroll-vert-bg.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 17 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):166
                                                                                                                                                                                                                          Entropy (8bit):5.505552048554462
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPl8hllfkansrtxBlly+r3U8G9RthwShLKOWGEVw5s+oWFbaWj92rUxP:6v/lhP6hnsQiUjdKc59oCp+IN9p
                                                                                                                                                                                                                          MD5:8A4C489069BD40EA4CADC29F782D1CA4
                                                                                                                                                                                                                          SHA1:A130FDCF02F0EB7908E163017628D0A481A0D7DF
                                                                                                                                                                                                                          SHA-256:99F74604B278925114A0DD49CF39C0414EBD99E0EBAEB2A6F0EACE4508AA45CC
                                                                                                                                                                                                                          SHA-512:CC25850A9B9F55FD2F04793F487BEADDC67CA077C8E0CC013AAAD1F764CAD99A436D792404FFDCE0AF077DDE58EDF7478B2899259C432DDB9B40418FBFCFBD54
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............5T....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....#IDAT8.cd``.....3....%.G..5d.QC.m...a. ........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scroll-vert-slider-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 17 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):268
                                                                                                                                                                                                                          Entropy (8bit):6.5749730782984575
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP6hnsQiUjdKcTAPd9IZoo98OPMqWtp:6v/78jiUpZCIV6EWD
                                                                                                                                                                                                                          MD5:B75323C0632F6DB87641CB8024664543
                                                                                                                                                                                                                          SHA1:A9AB358946B47577F9AD2D17F027F01E92CA157F
                                                                                                                                                                                                                          SHA-256:4936732DA14116E1A384EC33E18BB52110E28BAADC9D33AADA271CEC4BF239C8
                                                                                                                                                                                                                          SHA-512:172DCC124EFD8554EAF7C843C8B5732CF94FC84E5115DC6151AAAB4EC0219D06853B8483B1972DBDE0DB103A6CAF9881EB9717E1126A2370B97EC7680FB9B22E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............5T....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...!..1....8.....p.<Y.=.{....do..m .....m....o.2I..3+.5.....Z.....?...<.t?....2.........j...C^.7.Zd( .Z......X.2.36i...{a.)).A(..........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scroll-vert-slider-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 17 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):267
                                                                                                                                                                                                                          Entropy (8bit):6.483819133604533
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP6hnsQiUjdKcq67T6xKwRoktrZT0Jk7Hsgchp9rBJp:6v/78jiUpZqeT6xBCktrZTw+K9BH
                                                                                                                                                                                                                          MD5:854657FB9616A8E1EC72C9DAF168D38B
                                                                                                                                                                                                                          SHA1:4DBD6462D740D1D24952E3862410F5C6D723C38E
                                                                                                                                                                                                                          SHA-256:6B4B9481A925A1FCA3867F1E144735684A9D28E60BA9C63F6BEE501C3ED34A12
                                                                                                                                                                                                                          SHA-512:EC9832DB0C9CD421E1255F3DFD73E6E4C0995A7C50A4E1DDF965E13E5F04DA5B523F268B193B3630E92D53C0A8E288A2C0FD8F1BB9D1AD184A6BE39FD4CF868F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............5T....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...1..1...6jg.GX...q..^B..h!.......0.`B.....!..0%fV.k.M..=n.H.=.....y..~.R..e.i3=lk.e.Y.".%...o...P@..H...1#N.\d..gl.q....SR>...6.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scroll-vert-slider-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 17 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):258
                                                                                                                                                                                                                          Entropy (8bit):6.556511754866583
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP6hnsQiUjdKcleqlHRAoGt5rF5O/vrip9vQm5xo+p:6v/78jiUpZl5HmoGt5ra/vm/v95xb
                                                                                                                                                                                                                          MD5:AFFE1DDE6649690FFED3ED317AD5F3F1
                                                                                                                                                                                                                          SHA1:1840F4E94330D31182A72EB4A733BC0FB0289DEB
                                                                                                                                                                                                                          SHA-256:04268B79FC4F09A91DDBFA5D1391DD55A1BC2C203A041B55053A66412D43F13B
                                                                                                                                                                                                                          SHA-512:CD0F9D5FE6ABB17C48732937ED7E1F923CD7429C864893DA47A6536CBAC7CB8B6040E6191A08B29E5D706CC2F3DA0ABF02381D31477ECA8759C8DA7F1DF2E389
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............5T....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...1..P...OEH..`....ccez%.`.6.Z..g..-v....MQ.J.a@_..#^.........A..2........'>.Z!k-.,.....Tn~..2U .V...q.f......|.~..rS.../..bJlr....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\scroll-vert-slider.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 17 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):265
                                                                                                                                                                                                                          Entropy (8bit):6.509436441811011
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP6hnsQiUjdKcd0fQA6zO+ivMbeTgRM5Ongeup:6v/78jiUpZoYivcfRJgz
                                                                                                                                                                                                                          MD5:13A1E1C70DF0FC7EC3D98D149934F693
                                                                                                                                                                                                                          SHA1:BB081C6B1EEAF227FE2C4B6F75C1C62827359CE9
                                                                                                                                                                                                                          SHA-256:4593574439BA5D80FCD7908FD5349CAF4DE62C4863AA837720426C4256577130
                                                                                                                                                                                                                          SHA-512:3810E8F977F38BEFC07DC1D9150B8C23B42995F9EDFFFF255DB4EFF14249E7E91EB21852E488CD7E388C9716EF7637FEAB7E196D7DB5C4B6B322F05D8729E50F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............5T....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8.....0....HPA.."6A............T.Q..h\..e.......<..A.6..z<k..g.~.%......Rw...i........".D..f.E...E...1....q...|.|.p./...n.Z.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\spin-down-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):236
                                                                                                                                                                                                                          Entropy (8bit):6.394534379500799
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPUygsQiUjdKczedUrDLE/mxXkJyp:6v/7KiUpZZrD93
                                                                                                                                                                                                                          MD5:702AB1CD10F38F91F275B7FE5FA03EBC
                                                                                                                                                                                                                          SHA1:9D36CB39B1D8F997DA2281919CC194C1087B3650
                                                                                                                                                                                                                          SHA-256:7A89997B1355275ED4D53E27E62449148D858135802D338ACA5C5944DC045C88
                                                                                                                                                                                                                          SHA-512:A84894F1E45BE2C7183788B571A872F7347F24EE8D25CF8114F5DA71054A9436456AB2A0768E92CAE78DA504B5FDE96EB4819248BA2EF5E1DB266958B608EC20
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....iIDAT8...!..0.@.7......q.^.Q.. .d.......=fH..o_.RZlP.a..n...6....#..2`....9?b.GL.;.V8K...W\p.qZ....{....q!:..M.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\spin-down-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):234
                                                                                                                                                                                                                          Entropy (8bit):6.349822736082157
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPUygsQiUjdKc99OqcR5WNQUZnXuHkQPop:6v/7KiUpZ9q5glXhIC
                                                                                                                                                                                                                          MD5:19E64D13EFA2B7E31D3A1844139D6961
                                                                                                                                                                                                                          SHA1:9EC8B72A1E256358E6639CAD1ABB652BF3A6E5F0
                                                                                                                                                                                                                          SHA-256:380A00B9239DBA64360E94D26465157DEA9CB521908863FF6493B3D49339ED40
                                                                                                                                                                                                                          SHA-512:D47C4212F8263AFE739E262B8911C64C7E5EFCF5B84390050CC6729EEDD267912C93E5CF3771292B8B0CAAFE98F3BEB950CB1D88A4BDACED19E32BD0CB8E876C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....gIDAT8.....0.@..Y.+.b.T..........!4..C.H~.koWk..PD.p......v....K)#&|.X..>...OL)".....F..7..BP........!.7..e....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\spin-down-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):182
                                                                                                                                                                                                                          Entropy (8bit):5.626262999621559
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlbdoil7gsrtxBlly+r3U8G9RthwShLKOWGEVwpshkxjFrltWrrrbGP:6v/lhPUygsQiUjdKcpA46rS1l1Osp
                                                                                                                                                                                                                          MD5:7C616E20EECD275C90DCEA53E05BAFAE
                                                                                                                                                                                                                          SHA1:D5D9495A28E18E078EC87AF1E3116EE6C6EBC475
                                                                                                                                                                                                                          SHA-256:A5424BD4C107CCC156063ECBDAE7E9A52F059C749DA9838854AC8913A7E61175
                                                                                                                                                                                                                          SHA-512:4A897DA219909C290B90A1EDB840B54E0F4500DB3660AF5AFF6FAAA62858001C3B117ADBEC906C7C1DE6E3905C82F83C4D05421E10E0D6943B50E17E983F1C6D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....3IDAT8.cd``.`........D%..`..Q.G..5ph......c``.N.s........2'....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\spin-down.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):229
                                                                                                                                                                                                                          Entropy (8bit):6.31701833816194
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPUygsQiUjdKch0m51pg/hMmTgSjXR2Xbp:6v/7KiUpZCx/zQl
                                                                                                                                                                                                                          MD5:8BA4533EB14D0AF874F2E914CC569742
                                                                                                                                                                                                                          SHA1:5DF0B02FC4B6CDDAD3816767526F978538648BE4
                                                                                                                                                                                                                          SHA-256:237A9CBEE6B421AADA1D910B26E58159BDB105440CE8BBA7C5B2FCD87C42038D
                                                                                                                                                                                                                          SHA-512:5F3CFD212B6A31834964AEAAC0A5B4ECCEB0ECAC7B9413C1DE6647061A52B3427440C0727BEEA446A65EA3B17E270E091D7CADD3BFBDF71070E8A938993441D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....bIDAT8.....0.D..B.#..\..6.$R.`;..P..4...k..+.l.(.p.......l`....9.0..RJ....+j..Gk;^-x.{..N... !..*..T..7.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\spin-up-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):255
                                                                                                                                                                                                                          Entropy (8bit):6.4157705974269055
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPUygsQiUjdKceHfXsMIPplGzKJu5apB+kVS9bp:6v/7KiUpZe3IbkGuLkM1
                                                                                                                                                                                                                          MD5:2CE7B3330F34D7323FA947D5116CA31A
                                                                                                                                                                                                                          SHA1:A66D0FA143CD39A7EFA9EBAFAD91A90D412843CB
                                                                                                                                                                                                                          SHA-256:240FFD19B56959AAFE54F02150EF1FFF68738909F4928250C367A562E2C32BA5
                                                                                                                                                                                                                          SHA-512:27940E6177562B540BC5058183170FF12A00508CDCBCF7FE319C066EB08E6A6B9DDC08A56DCEA35B516E187BB200705A76372708BB99ECE264A6EB9FCDEE3D84
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....|IDAT8.....0.@.g...B.A..2.}Va./....84.MA\...t.=]@.{.<.wO8...x..r....r..{).:............G.. ...8a....k.v...-A.....n...'...g...'.@....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\spin-up-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):243
                                                                                                                                                                                                                          Entropy (8bit):6.341336039022934
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPUygsQiUjdKciZnvu3kg18zYOxNvdp:6v/7KiUpZipCTOxNvz
                                                                                                                                                                                                                          MD5:A936B6A0C4CDC536AA76DBCD9B95C222
                                                                                                                                                                                                                          SHA1:85222EE16525E8D933548013A18F63591C4B52CE
                                                                                                                                                                                                                          SHA-256:E3113D3C7A80D58C43BEF6060A94D9466270016A9B1CD193B783E7C543A7DD0A
                                                                                                                                                                                                                          SHA-512:B7C8DDEF94DCBD60425D878ADFCB19388321B8C4A6D445CC9BFB49F4D200E63D5DD7AB5C0C986E607D5FF310B7D2D79BD2867394C826BBAFD64FD64EF848E92C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....pIDAT8.....0...gR.@)hX.....d..=....6.P........@...O4.Skm.Y.{...r..\.....z.....n..............N.`.H.R4..p.7.?..t....."4....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\spin-up-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):191
                                                                                                                                                                                                                          Entropy (8bit):5.7901127830283174
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlbdoil7gsrtxBlly+r3U8G9RthwShLKOWGEVwmKS9Jut2U4LzWfjBi:6v/lhPUygsQiUjdKcbOJ5ajBitpVdp
                                                                                                                                                                                                                          MD5:3A713CF91E2DAA201921DE88C195FE38
                                                                                                                                                                                                                          SHA1:18FF862A5346E8391D9CF79A651E49BAEA000F08
                                                                                                                                                                                                                          SHA-256:36D6A31E97A2D59CFFB01FD473A63E65441AAC4921228F44B7B692794F3A1C1D
                                                                                                                                                                                                                          SHA-512:5FD8F2BDF7DF92DFAFD727D0AEE04750D6035D33DC7BA41A29F6928333DBA160B26331C85C5607A2818B16278CE29898D2E58D4A8C7D8EA07CF99F50AE7EE98D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....<IDAT8.c`....A.B3.100|g``......D...fp"s...0.......8j..1....1.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\spin-up.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):234
                                                                                                                                                                                                                          Entropy (8bit):6.3605633881418875
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPUygsQiUjdKc9v7Uzo5lMDgA3WSBuRlkup:6v/7KiUpZ9vQE5Q3W6uRec
                                                                                                                                                                                                                          MD5:7A05AB208F8F9BC9B3AAE198B3E8DFC0
                                                                                                                                                                                                                          SHA1:420B19AE032D2FF7D8BA7BF524AC837FB0D34CFB
                                                                                                                                                                                                                          SHA-256:89C0FFA62E048EAC40027C4B2DCEDFC7F69E06C32A089A8114F117C65F20E146
                                                                                                                                                                                                                          SHA-512:566121F47770CDDC09B7B3D4EA786F19FE17FC220770411B7E8A42BD40D094B73553316361DE58A13B0EE836408EA0DE923FCB2BEF95607CF033C1748A59FE09
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....gIDAT8.....0...?...6..1.Ky...'.<.p.....>.../..._...5.g....n)..8. @)Ec.+pL^.@D...I..u....z..:........(.b...d....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\toolbutton-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):262
                                                                                                                                                                                                                          Entropy (8bit):6.355560337248264
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPzsQiUjdKcZiXZPjLaCLlXTpqKVt6WHJQHJQHJIVJYHBxejp:6v/7niUpZZiXZbLflNqKH9HeHeHGVCB2
                                                                                                                                                                                                                          MD5:B4902E63444F1DF65BFFFD89908DF6D4
                                                                                                                                                                                                                          SHA1:D22B8CC8D7AC18FDC29D081C93B45BAFC1EBE3E2
                                                                                                                                                                                                                          SHA-256:0A060B75CD0C93A805602E5D600931520FD8F993672872573E17262FBAFC2092
                                                                                                                                                                                                                          SHA-512:8F658F6768ADAB31FD78CC904CAD84460F1746B98E80AFFD009F0F6391FFA73774AB4B6CD5D2A05ED43BCB74D8241482B4986FB6FDC538B3DCA1F8751B906B36
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...(...(........m....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATX...1.. .D./..x...:.`.....Ll......R..pZKs>..l.,.........8x..\B...j._.f.@5...T3P.@5...T3P.@5...T3P.@5...Tk.y..]...0.{7.Q..N..?...R.g..7h....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\toolbutton-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):6.258613779267072
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPzsQiUjdKclhk8WuoTtbRWqytpmzJQHJQHJQl3iqvGmop:6v/7niUpZ7bWhBweeHeHeti+hC
                                                                                                                                                                                                                          MD5:EEC4D9CD091ED6BE5F2B506C33928206
                                                                                                                                                                                                                          SHA1:F5B0A7C88BA96A98F03F4912068A4C005E2E5E71
                                                                                                                                                                                                                          SHA-256:BB65D71CFDFDECB93004A80BB275D7E7BB4B8228DB238714891F2A4914FAF10A
                                                                                                                                                                                                                          SHA-512:43FA56D9D5CF781291021E9917E5B83F4CEE5C532A1DD710B32BE7F0BDE12E030D396311992691B05A8DCDF76BC4402AD782636F2C40665DABAAAA3D8C8CD232
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...(...(........m....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....~IDATX...;.. ....T.....B....4....T...+......(@^diU....4\D..c(m...(uK.z.!...T3P.@5...T3P.@5...T3P.@5...T3Pm..e.w....Sm_.....n...Ynt......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\toolbutton-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):159
                                                                                                                                                                                                                          Entropy (8bit):5.085674953721753
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlVXtVsrtxBlly+r3U8G9RthwShLKOWGEVwGBx92vFPqOC5tt2up:6v/lhPzsQiUjdKc+SNPqOC5Oup
                                                                                                                                                                                                                          MD5:FCC71F170442D6AEB65B538F08BCA820
                                                                                                                                                                                                                          SHA1:C377B3461B1D9C86BE8CCEC5E6B3E279A65EB53E
                                                                                                                                                                                                                          SHA-256:55716E167013A8FA6F8CBE7A183E3820A95560DE9D0E8E84E62EC2D57FC45A0B
                                                                                                                                                                                                                          SHA-512:60A808B1B8ECC7E2CB32F952292DC0382FF3AA07A63AD25A9BF2B42594AAAC82BA053C0854EFC1DB6B0227EB11ACCF8E72340D7F1602F0B3F9176CFA74ADCB2E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...(...(........m....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATX......... ..nH@......|..(...X.H....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\toolbutton.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):159
                                                                                                                                                                                                                          Entropy (8bit):5.085674953721753
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlVXtVsrtxBlly+r3U8G9RthwShLKOWGEVwGBx92vFPqOC5tt2up:6v/lhPzsQiUjdKc+SNPqOC5Oup
                                                                                                                                                                                                                          MD5:FCC71F170442D6AEB65B538F08BCA820
                                                                                                                                                                                                                          SHA1:C377B3461B1D9C86BE8CCEC5E6B3E279A65EB53E
                                                                                                                                                                                                                          SHA-256:55716E167013A8FA6F8CBE7A183E3820A95560DE9D0E8E84E62EC2D57FC45A0B
                                                                                                                                                                                                                          SHA-512:60A808B1B8ECC7E2CB32F952292DC0382FF3AA07A63AD25A9BF2B42594AAAC82BA053C0854EFC1DB6B0227EB11ACCF8E72340D7F1602F0B3F9176CFA74ADCB2E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...(...(........m....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATX......... ..nH@......|..(...X.H....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\treeview-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):354
                                                                                                                                                                                                                          Entropy (8bit):6.522410471808577
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPzsQ9hm+jdKce+cwNawFx+Ou+LgkAwzZallMu3JwTkzJRHyrkzJRHUKup:6v/7ntZe+swFIzkAdMu3Wr6U
                                                                                                                                                                                                                          MD5:82ADC405B207FA3AA0B6BD14DDB052A5
                                                                                                                                                                                                                          SHA1:830850B870416A791D126E3CD223864A8073553C
                                                                                                                                                                                                                          SHA-256:CD420F347A3F445D6F71C8F81E1A82E84A481D1ACD624D8179CBC4C7C99E2766
                                                                                                                                                                                                                          SHA-512:F4B477EC7A4E051491ADE58D1D3C9806D39D7910E209EF54FBA44E5CCED44C93315BEFC5E070BB640D9805BDA5BAB4268819A3235281E5975E34091D99659EC5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...(...(........m....sBIT....|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<....RtEXtCopyright.CC Attribution-ShareAlike http://creativecommons.org/licenses/by-sa/4.0/.Tb.....IDATX..... ...@..;...:...".|.6....(.M..v..2p'L..x...Z..d9.p.b.~..+..G..(.R.. KA..,.Y...d).R.. KA..,.Y...d)..@....Z.>^.L.l......h..PH.p....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\treeview-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):344
                                                                                                                                                                                                                          Entropy (8bit):6.343005839678017
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPzsQ9hm+jdKce+cwNawFx+Ou+LgSsegBolrcpk4ElaE9u999qONp:6v/7ntZe+swFIzmgycpxMzu999vj
                                                                                                                                                                                                                          MD5:062384AB0B37E811CBCB5599E62E3577
                                                                                                                                                                                                                          SHA1:B521A942E223881DD2DC0C44932BA126139BC67C
                                                                                                                                                                                                                          SHA-256:B78F8880C4F455A559EAE782200172B3BB727D8D678C081FB5D020F086A27EAB
                                                                                                                                                                                                                          SHA-512:508EA8FF449E0F52752AD0F07C417DB6F2706162B889A71B900BCB0054CE7967E8C5E7CA53D68F85895D6A8E4C2FA82D22867D4043BCE3F42A5E21389CE9AB5B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...(...(........m....sBIT....|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<....RtEXtCopyright.CC Attribution-ShareAlike http://creativecommons.org/licenses/by-sa/4.0/.Tb....wIDATX..... ....Pg.-MR\,.G.2/bE.;.|?..=G..T.j....'.....8..+P.o.W....f...j....f...j....f...j....f...j....7..3rp.......p...GX%....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\treeview-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):253
                                                                                                                                                                                                                          Entropy (8bit):5.566506038073833
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPzsQ9hm+jdKce+cwNawFx+Ou+Lg3SNPqOC5Oup:6v/7ntZe+swFIz3iH6D
                                                                                                                                                                                                                          MD5:C927E3789502F9C67B296125F15D3667
                                                                                                                                                                                                                          SHA1:620D816440EB0D3A15EAE1C5237EAB5B92F45261
                                                                                                                                                                                                                          SHA-256:238CF363702FE39C7808D3CD77CB4B40C3782257E9814B25A564CA7EA42652EA
                                                                                                                                                                                                                          SHA-512:76907D07CC6802A09001B3A839F8041F4994057A631056570358D72893804E210B0513D6D8751D22608E6FA45CFB55E353B27D5E37E7329CA2856A8CEB9A1C67
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...(...(........m....sBIT....|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<....RtEXtCopyright.CC Attribution-ShareAlike http://creativecommons.org/licenses/by-sa/4.0/.Tb.....IDATX......... ..nH@......|..(...X.H....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\adapta\adapta\treeview.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):253
                                                                                                                                                                                                                          Entropy (8bit):5.566506038073833
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPzsQ9hm+jdKce+cwNawFx+Ou+Lg3SNPqOC5Oup:6v/7ntZe+swFIz3iH6D
                                                                                                                                                                                                                          MD5:C927E3789502F9C67B296125F15D3667
                                                                                                                                                                                                                          SHA1:620D816440EB0D3A15EAE1C5237EAB5B92F45261
                                                                                                                                                                                                                          SHA-256:238CF363702FE39C7808D3CD77CB4B40C3782257E9814B25A564CA7EA42652EA
                                                                                                                                                                                                                          SHA-512:76907D07CC6802A09001B3A839F8041F4994057A631056570358D72893804E210B0513D6D8751D22608E6FA45CFB55E353B27D5E37E7329CA2856A8CEB9A1C67
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...(...(........m....sBIT....|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<....RtEXtCopyright.CC Attribution-ShareAlike http://creativecommons.org/licenses/by-sa/4.0/.Tb.....IDATX......... ..nH@......|..(...X.H....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\LICENSE

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):35147
                                                                                                                                                                                                                          Entropy (8bit):4.573442652974749
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
                                                                                                                                                                                                                          MD5:D32239BCB673463AB874E80D47FAE504
                                                                                                                                                                                                                          SHA1:8624BCDAE55BAEEF00CD11D5DFCFA60F68710A02
                                                                                                                                                                                                                          SHA-256:8CEB4B9EE5ADEDDE47B31E975C1D90C73AD27B6B165A1DCD80C7C545EB65B903
                                                                                                                                                                                                                          SHA-512:7633623B66B5E686BB94DD96A7CDB5A7E5EE00E87004FAB416A5610D59C62BADAF512A2E26E34E2455B7ED6B76690D2CD47464836D7D85D78B51D50F7E933D5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview: GNU GENERAL PUBLIC LICENSE. Version 3, 29 June 2007.. Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed... Preamble.. The GNU General Public License is a free, copyleft license for.software and other kinds of works... The licenses for most software and other practical works are designed.to take away your freedom to share and change the works. By contrast,.the GNU General Public License is intended to guarantee your freedom to.share and change all versions of a program--to make sure it remains free.software for all its users. We, the Free Software Foundation, use the.GNU General Public License for most of our software; it applies also to.any other work released this way by its authors. You can apply it to.your programs, too... When we speak of free software, we are referring to

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13334
                                                                                                                                                                                                                          Entropy (8bit):4.185459095648785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:phC/a7gqSC38SC3u3D3uSC3CBC3NIiSCCiCpn/u7zJTIOeGSSQ/gdrSff7d:PC/KgusGziRnCpnm7zSOoSQUyd
                                                                                                                                                                                                                          MD5:C5C395FDCD8D6CB329C77E7B18C15869
                                                                                                                                                                                                                          SHA1:5DAB56A43229BFB12D07E0608E82DDC3E7785EE4
                                                                                                                                                                                                                          SHA-256:0CE418D1F73F3A393E124CE1F4E24EF9E2AE06D1C8DBB0BF2C6CC3389FCAE8F2
                                                                                                                                                                                                                          SHA-512:FF9D972129A9440D979CDE098CC0FFC9D55E9F92D599545EBF095923AF6A9ECE071B7A85775861E40F5700FF99239111D98A4A8100C88E7BFBFDA8A2187120B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Copyright (c) 2015 Sergei Golovan <sgolovan@nes.ru>.# Derived from https://github.com/horst3180/arc-theme/ under the GNU GPLv3.# Thus this is available under GNU GPLv3 also, as described in LICENSE..namespace eval ttk::theme::arc {.. variable colors. array set colors {. -fg "#5c616c". -bg "#f5f6f7". -disabledbg "#fbfcfc". -disabledfg "#a9acb2". -selectbg "#5294e2". -selectfg "#ffffff". -window "#ffffff". -focuscolor "#5c616c". -checklight "#fbfcfc". }.. proc LoadImages {imgdir} {. variable I. foreach file [glob -directory $imgdir *.png] {. set img [file tail [file rootname $file]]. set I($img) [image create photo -file $file -format png]. }. }.. LoadImages [file join [file dirname [info script]] arc].. ttk::style theme create arc -parent default -settings {. ttk::style configure . \.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-down-insens.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 9 x 6, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):334
                                                                                                                                                                                                                          Entropy (8bit):6.722108746762168
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPKUQiUjdKcRu0MZJrei0l6NKjwlAetNHgeeadUTp:6v/7SriUpZRuTZEi0PKAeJXE
                                                                                                                                                                                                                          MD5:00853557C9116AD0756FE4A63390E56E
                                                                                                                                                                                                                          SHA1:61E8F6B3C5BBAF3CF97E297E8F92E863C7CF47D8
                                                                                                                                                                                                                          SHA-256:F7C6AD2D2BA7BB2F1C175F2290C949EEB3B9E24ABFACFA0625590E43C906021B
                                                                                                                                                                                                                          SHA-512:B2380DE8F6AEF8867152EB3E73528EB8A494AF807841DB884AD659247CF621C997A9A46DC2C412352599DDE439883C51D6458F7120B25F92DFA5CF4823C49226
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..c.M....xz.)...@lb.;...s.....0....... &!....?..{L...\.....#..gtB.....C||.1.#.7.#..Uy..........l..o..10.2..s...........3&O........................../.f.?.;....3....\...jx...E......'|....X.D.4..#....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-down-prelight.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 9 x 6, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):306
                                                                                                                                                                                                                          Entropy (8bit):6.732319679266099
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPKUQiUjdKc1N2nZs3Wc97Qdzk8z93Qs0qcqRHpdqkp:6v/7SriUpZ1NmEb97Qdz1RAsnc8X
                                                                                                                                                                                                                          MD5:7F444DE174F56B7116CAFC56F3EF387F
                                                                                                                                                                                                                          SHA1:9AEA1A0ACD98E4312C6E9C0E480CB76990E4DFB2
                                                                                                                                                                                                                          SHA-256:2459137F7BE26BFFBAB317DCED779E413453145A01586E7952BB17001BA74493
                                                                                                                                                                                                                          SHA-512:64E0E99D71312DEECE7E8EF968D670DFD579B4D21BC1F3ADC378202B7EACC85E9E6C255B66A136CA421ADDDBFCAC7CBC552219C683E675FF83DCD64E7769491E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..].?..a......'%......-P.K.DD........;...y...`...yLW.?}....a...#.ru8.....0.t8....t...I.2o....zz...tP7..8<......d%..).ai.6p.^T.}.!.~....+q.)...N.{...@.h.8w..j...|*1.....9...P.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-down-small-insens.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 9 x 6, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):287
                                                                                                                                                                                                                          Entropy (8bit):6.619702696722686
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPKUQiUjdKc/hlC/2myRs+tvPcSRJmiKI16XHlTTp:6v/7SriUpZplC/Nj+WSLmKM3lT9
                                                                                                                                                                                                                          MD5:8E62D8303C3E9704766D0DD2D68B3A1B
                                                                                                                                                                                                                          SHA1:08F5BCA380E57162B25ABD93ED5F158208BFA7EA
                                                                                                                                                                                                                          SHA-256:DC3E6DB7DA1568998A14CC32ED8500730B483CE80B1431BB21E1EE7F69544890
                                                                                                                                                                                                                          SHA-512:70CE9BCB98DD993FA923C1ABD189E5941AD727193D4C0632A29D8E87EA627B6590B1947E231C0D3D50CCD160167BF1F83AF21BE89F1FD16188B668D14AAA184D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT....;..P.Dgn.F....,.qG~...BP.....;AH.0[.M..A.B..FH.9...........L..Z.....@.8.G3.......U.....9[......<..B..]LR.*..>).Vf..%.............iM.."I....?.g-.j......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-down-small-prelight.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 9 x 6, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):285
                                                                                                                                                                                                                          Entropy (8bit):6.649666938532743
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPKUQiUjdKcJTd8K3/iqw9T2nqXp6wsDx/jp:6v/7SriUpZw0w9T2qcTDP
                                                                                                                                                                                                                          MD5:0AD751EE359228B9A3227C8DD857789E
                                                                                                                                                                                                                          SHA1:1EA786E1E7A8D3C83DCFACD06F6D9FCD66066597
                                                                                                                                                                                                                          SHA-256:448780BF2D254C6C3EF3EE871CB28251323CD88CBB2D36633FF679C08B199E7D
                                                                                                                                                                                                                          SHA-512:8A0F7058E6EE087D097B5136AF862DF07EBF8CB5C2B2DC0027E047B311CAB8325DF620A5FB7E378BED3047D8A5DBFF11D526BD7BA5F11A024FABECDD64BBA724
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT.......`.F.[jcr...L............D... ...........54..<.y.......-............t...|.u....h.*...TU.U..z.2.....:2..$..7.."zR(j.....*S.a.m....~0.../..j.6...'*....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-down-small.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 9 x 6, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):285
                                                                                                                                                                                                                          Entropy (8bit):6.518080998810505
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPKUQiUjdKcJTOoCf1vAF9liyY0UvN93EVv/O8nGp:6v/7SriUpZxCFA3la0UvN93q/pnk
                                                                                                                                                                                                                          MD5:99F80A0410DB78460702E6EF4FDF4D73
                                                                                                                                                                                                                          SHA1:346EF31E133DC133EC290330A8148047F1388728
                                                                                                                                                                                                                          SHA-256:51171732307F3DDB7E56F9F6AD4ACC24DF9B84F8E024C2E0D60CD184E44A4106
                                                                                                                                                                                                                          SHA-512:11004BFDDDC10DA778757F28B715748B018F32F2563C6F3B18B3990044112C19234B85B4953EE08F72CBF0C9A18B7B4AFA366A3D0192E2734C412D5E4F9C4738
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT.......P.E....0..K..(.....mP...7..?A..G0.(.....a...+.'..M.m.QVL~....i~.0.^..~.l..QR..*.T...J.."#odn..(.~....z..C.....G..l..Z.w..G....^A0....ao..4... )....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-down.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 9 x 6, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):311
                                                                                                                                                                                                                          Entropy (8bit):6.727185334196263
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPKUQiUjdKcXicRq41/9J3oekI19OUigOyWI12tDh42yXp:6v/7SriUpZfRq41X3oekIv7Ym2Hnu
                                                                                                                                                                                                                          MD5:F59140A6109B92770D0AAF8E2C944321
                                                                                                                                                                                                                          SHA1:663B889EA4D1826A7BB29933C56731AA8A31B39F
                                                                                                                                                                                                                          SHA-256:87BEB6424BD145F9A5CF747D13784BD3013951B446F74CB60CB1E82CBC692997
                                                                                                                                                                                                                          SHA-512:74281BEAA96B726EFA1F1FB9BF90BBFDA58E4598356F5D0B9A7D4B3B5450F9A43A39D88507C02D5EA6E52F457612386BA27BC8928E4673DCF991C4F2037B8FE6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..].?....@...d.Mt)..7P&wr.nq6.Ye.)6]...P...`..Y....J..^O.Z.,H8..:..A....UhW.....n.R...1R.G.X..w.....f.....q...........cA. ....a8.H./.~&.Ll..8.M.0....f..v....-.0....".."..RO:.RnO.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-left-insens.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 6 x 9, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):326
                                                                                                                                                                                                                          Entropy (8bit):6.725415763432792
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP68wHsQiUjdKcZAE/Y2gS48yBurfGU4JzEtOF/WeTZp:6v/7S8wiUpZZKT7DEtO5WEX
                                                                                                                                                                                                                          MD5:BAEBD0744CF5270287C2F34C18278942
                                                                                                                                                                                                                          SHA1:C292F6E3BD84F58AB7A54FACDD999190B1C76B72
                                                                                                                                                                                                                          SHA-256:83ED0DD88C3029BC48F81F9CB9A86517C3E089E16C71492623526321A4991580
                                                                                                                                                                                                                          SHA-512:6A3E499C0360FFD34D9864B02D1B02CFD90FD0F0D80F41D8A3493B7ECA6924A2A961EE40E2C3E92F23861661CBCE78959AD011C154A3C6763171F4EA1CDBA972
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............].....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..cd@.....9...202.1"...8..$00.Wc...."X....'.....&..K.N........4.F..?.....?.8.....O..h&......;.|...0....cY..?.K..&..|S....'~..\`......J........]........D...U...w3.$N.:.7......E..3...F.F.........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-left-prelight.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 6 x 9, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):319
                                                                                                                                                                                                                          Entropy (8bit):6.763312038385235
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP68wHsQiUjdKcFkmM2WKCaVzDGFm3/rfpU3quvyttGeZ9LgX8p:6v/7S8wiUpZFkm76QGFy/rfpUq+y5fLX
                                                                                                                                                                                                                          MD5:7DD992E55801C9A38911C418C85095D5
                                                                                                                                                                                                                          SHA1:D77A698B4E377C879BE0D9D5270915E482E80EAA
                                                                                                                                                                                                                          SHA-256:AE04CEA32010C47ED7958ECCE0BE5B919F097A2EE6374D9DCD005F55F855B3BD
                                                                                                                                                                                                                          SHA-512:45FEE4C744315CE5D6FF586F4719920B2862D33E0D37690FA80898556BE79DCC5D1CF44AE1632E9E36C82FB6B9CF8797B14881A0641AFE38EEFB50884ECD59C9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............].....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..M.1J.p.F....`.S.P...R....8T._.....qi .R....A.g....#.54.N...{...?..U.<....~L...........<..Q }..2....`...]Y...d..6..8WV...........V..?&n.iqU......N..../.......E+h....<.. M...%....c6.tT.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-left.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 6 x 9, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):329
                                                                                                                                                                                                                          Entropy (8bit):6.736017667448199
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP68wHsQiUjdKcdhk/9od6YEzPuIalr6GJi3SKp:6v/7S8wiUpZjIYCPulk3Sg
                                                                                                                                                                                                                          MD5:39C499A4C29605524C1F546F54B43929
                                                                                                                                                                                                                          SHA1:49750B08C74A150EC31A1D16666843F29AB08E2A
                                                                                                                                                                                                                          SHA-256:D770926C75148E5CF3551BA18114978E688D7C5E95338B458D52F73BE2935474
                                                                                                                                                                                                                          SHA-512:C5190F3DDE9220A2BEF6D190AD158B7A160C8088C594A95210B4C2DC0C6AE60C6ED77FA9EA020FDABF485C45BD9FB4C861969C6FD198DFCF4140E50EC324A75B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............].....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..cd@....l.<o..g`pf....p.g........?C.#...CTT. .;....F+.F..%.&W.$$dI.a`...._...!}........02-e`.............._....uF.....$.....?..[/g.....!K.........]..T.........N....p.......\.._.....h...5:...|.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-right-insens.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 6 x 9, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):337
                                                                                                                                                                                                                          Entropy (8bit):6.698233557523476
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP68wHsQiUjdKc1sWSpvdt/L7NkOVwPel/bHoFxlpVyFDTSsNFWp:6v/7S8wiUpZSJdt/fNkO4ozoFiFqF
                                                                                                                                                                                                                          MD5:7D14A3B8317F2C33F3A65F5390AFAE74
                                                                                                                                                                                                                          SHA1:716BE35072967524CE994D3C2BF734036A2A6FDB
                                                                                                                                                                                                                          SHA-256:10DC6A233E357B86080AF0682721EFFEA0463CC5169F35C21F5B6C38533F21F7
                                                                                                                                                                                                                          SHA-512:FD2D57F6A927F4C6733C3D2B5EE2858DEF8B3138BABDCAB8CCC5D56CA15D21C4496A3A7809224D4A85F2D2E36A8DD9271659B6119430D3D71A57812806E61890
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............].....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..c.M.c..p..W..W..e..&...g...L8..%..6..$./]8}....7##..3.7u}].+..]...S...c....0....?.f1.$..?.L......A...oi&.DtB.)......L/..cY........o..._.FF..?>...a../L..9........pW..i....00000...`.....'.....v.J..<./....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-right-prelight.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 6 x 9, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):314
                                                                                                                                                                                                                          Entropy (8bit):6.7786340496946424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP68wHsQiUjdKctAQcK/Pee4/Zy4cOpEnZlYDATeqp:6v/7S8wiUpZtbm5cOpEvYDAT1
                                                                                                                                                                                                                          MD5:E6B2378AAAD6355CDECE693FDA6B1FDD
                                                                                                                                                                                                                          SHA1:FDE14A092DEDF2029A6F29E2EF8498B78E33B1C9
                                                                                                                                                                                                                          SHA-256:C9684AD9F111855FC062D6C85A1AFC2C054AB115917EDFFB1A2C9503CF1AECF1
                                                                                                                                                                                                                          SHA-512:C507BCD9A29BBBBC7AF0ED16D9B853DB793F3AF44B49B7B6F261C775EA508771424B7BCE412CF7DC229F9D2A2329572CB56A68E97B38DA3BEC6741E06C12CAB5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............].....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..=.j.Q...wN..b...M.^..!...Fa[..8.9)eW.U........l"6".....N..3..teb...[.^..=...Q/....O.....$.L.......5.!y.%....O9....`".....U..`.Nzv..I$,..=J.N..t>.}......*Q...p.6...v.8nn..+).B=.=L.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-right.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 6 x 9, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):333
                                                                                                                                                                                                                          Entropy (8bit):6.7464319001872814
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP68wHsQiUjdKc5TN8CukiF6ixGsQyJwuJHVqPa4zIQo9AZXirPgRVp:6v/7S8wiUpZz8dF6XsxJ1EZXUIV
                                                                                                                                                                                                                          MD5:4599CA938B8BA74806E23A586A7A6EF2
                                                                                                                                                                                                                          SHA1:862726F6DBAA38A1BCF619C3511D8F969C1D16CD
                                                                                                                                                                                                                          SHA-256:C40EA32E01BEB479049D93BC02AC566896C4FFCC2F06FDBE67EB28A63DECE14A
                                                                                                                                                                                                                          SHA-512:717C9A827CC6A080F2807933C9FADD3CF9F507C745FF4F6B549CB97ECA7D4D5276F64B14C50D63A46D7F0EF91B75B279C1E1C9ECD83A9E64446564706B6C45DB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............].....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..c.I.~..........~1@..#.....Q..o6..p.$./]8.W.....#c..._7m3..W....S.......8......fF7f...../....020.0.g0@.H.Mbd.?.........L.......y....022\`e`._1..c.......'200.ge.r.?..k...............0z....f4.9.=!. .Q....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-up-insens.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 9 x 6, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):330
                                                                                                                                                                                                                          Entropy (8bit):6.86378024757523
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPKUQiUjdKcdNTLK8Dt3tXa0HhiZyiGIv8Fyndk75Vp:6v/7SriUpZdNHf3tXbBisrIv7ndeB
                                                                                                                                                                                                                          MD5:5BA979CFE713E07BE554A9EEAA6F5693
                                                                                                                                                                                                                          SHA1:BA87DD309CEA83B67653FD6A7593C08CC376E80A
                                                                                                                                                                                                                          SHA-256:4CA3124CAF750B5CE81C72D84EF467CF8E4B4381D51FE5CE365EFEFCA12C00BF
                                                                                                                                                                                                                          SHA-512:026BEC4FA2C71B18F2AB19896D29CE37B9A103FEAFF644850A979668E07A7DAB32FF19A14598A15CCD5764553FCC835D17E94D8D5632EC9BD480DD45A5EDC668
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..M....q..?.....%.M..K.%....~.M......~..+dPV.I1*n...(....A.....!.!D'..........+......0.g..z.>../..O.S.A....@...k.....".P...I.IW.bj..z.p#...A.^....Xi0.Y.......m...|.!.....2.)Hl.#s.?1..-@+"$.7.;.>.T.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-up-prelight.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 9 x 6, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):319
                                                                                                                                                                                                                          Entropy (8bit):6.751251158189269
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPKUQiUjdKcFGAmkBs5ygfxXze0mQab2Mahu0fMfYE1YP1XayJSdFqmbp:6v/7SriUpZFGAmgUyOxXyoC2bu0kfYEx
                                                                                                                                                                                                                          MD5:6D7F2E89B76DA241509CBB0F298A651C
                                                                                                                                                                                                                          SHA1:9FEBD8229F7FD195506DB882988E9229CC7A559C
                                                                                                                                                                                                                          SHA-256:27D9D7D1E3AF540BE31334C144423DF6AEA152EF7DB6013B834B018E9479AD60
                                                                                                                                                                                                                          SHA-512:FACEB52639E8CC9DE822ADF51C692A233D9247511E06CC12D6807ABF87F5654B789064B3AF554EDB362939CD37A600D24EF68DECDEEF0ED4F01F3DED42D858EB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..M.1k.P...}M%P...:.].........../...$tI..pKA.M...k.G.....L..$..S4X..:V...;.O..sWg.ssS....... ..=...V.U-...*.....|f...@....u......Gc.n...|vKc|9.yF..X$... .w.....5.<.i..is"....@..Q.9Q.Y......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-up-small-insens.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 9 x 6, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):288
                                                                                                                                                                                                                          Entropy (8bit):6.52522343211968
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPKUQiUjdKcHuiZOYuAh+EwaH0dV4NRY/yveOup:6v/7SriUpZOgzuAhTsAk/yGOc
                                                                                                                                                                                                                          MD5:A43AA6156509D2E002BB8E1FC5AD856D
                                                                                                                                                                                                                          SHA1:0FCE64E1FC1263D112BFF303B1CAFC111EE826C9
                                                                                                                                                                                                                          SHA-256:DCB9B4871943CDCE156A2BD6F4781D7215CA56044ED1BB40645F4F18878A39F7
                                                                                                                                                                                                                          SHA-512:8E52D911774E25ABD71B96C93C2AC54FD6A56C23C002CD35A198DE04E0EAFCC502477C125412197A5986235586749BA21571599BC6CF710A83623F220CE344D4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..cd@...Y<.\LQ...-.4o.g.83...........F.%..6%.3.sg........U.x...0F..BL...2.....=.....pEQ...L...32.Y4k.#...22.W.I..+bb`4e....yS.1000,Y2......322.2.....5C.5......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-up-small-prelight.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 9 x 6, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):280
                                                                                                                                                                                                                          Entropy (8bit):6.4791342043541285
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPKUQiUjdKcPAEav8+pjntn0Yj28vV5zfmTG93AE+ttUbp:6v/7SriUpZ2pjtnAbTGtAE+ttW
                                                                                                                                                                                                                          MD5:4A6AA35A419E18660E049A17EF430695
                                                                                                                                                                                                                          SHA1:F8BCEDF50EDFDF05491977BB9B7ECE69CFED70B1
                                                                                                                                                                                                                          SHA-256:E9D53486AE6A173296D22A199476F028D0C35F31E35978345F43171BFE374307
                                                                                                                                                                                                                          SHA-512:D8F7845399393DDECCFF5A323E34B9CB2D7D1E8C4E007BC0F171D234F7FAAE3479B0FBD69C943DB565F038939DDBFA72733730712CF5A8A6B00C9D9A92C18A6A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..cd@..&.............R_..`....9~....?....F..}}.8Q........9......3Z120J.e.........o..V........K..N221.020....v Lb`Ldd`.(+L.....P..x..?c..#C.......04........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-up-small.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 9 x 6, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):277
                                                                                                                                                                                                                          Entropy (8bit):6.47946923473667
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPKUQiUjdKcRuxtxiXQzppGHX2Ja5EvfPTup:6v/7SriUpZ+kWHQCPTc
                                                                                                                                                                                                                          MD5:405D8038F3A1CBA1FFD61C16ED82AB8E
                                                                                                                                                                                                                          SHA1:C379F1578123752DA896D709A42433FAA09E883B
                                                                                                                                                                                                                          SHA-256:D5C214E48FDE3F6DE69B534C7FF32776A4D3098C68A85C4402199185E15557B6
                                                                                                                                                                                                                          SHA-512:73596FD5FCE6D406E312819A49723CFD1CA0CCC8185110F61B10E2D9C861F9C105B9A8A25011C31C2E093A6E89448949C0D90096C6A8FA0E6D14691FF5F06E10
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..cd@........_.9n.../a.L0FBB..o......\......Z..........F..L.........7440..E'.202.....{.....g.a`dp...M;.$F........L......t.....a.........j,.........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\arrow-up.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 9 x 6, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):325
                                                                                                                                                                                                                          Entropy (8bit):6.664293132300363
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPKUQiUjdKcBuNP7RetRr/lmaV7S92UQBFH00lYhEtVp:6v/7SriUpZAd0N/ntS9BQNWm
                                                                                                                                                                                                                          MD5:BA6481E4B90CA3A873CF2B10CE84D69E
                                                                                                                                                                                                                          SHA1:1B541A3F4CC4D59A1303A969BF6BEB832B95DA2E
                                                                                                                                                                                                                          SHA-256:20179A8675B463535FFCE7E8D0288EFAECD634D63D16E4D45535DB490D137F6B
                                                                                                                                                                                                                          SHA-512:6EF29B380513F52A1A9D030814DFD44D1D0786DF86BDA53DAD74451322DC5034CB20D12DE6FC6F901FC43718BB3B38AB44203815CE4932418A66FBE1D8EC9FD6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..cd@.qq....Y..a...b...0q&.#!.@..3.V...'.....)..(.bcK..0.........$...%..6'%..20000.....g.........!k.......'20.7........f-=............2..........200..gdSb........c.)..X2.J.#.C..FF;...<C..;!....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\button-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):326
                                                                                                                                                                                                                          Entropy (8bit):6.840960232406435
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPnhpQiUjdKcZAjLg7iAAHU9ZSo/jmK3EWi9irLIzRPC8KJp:6v/7vh6iUpZZf7iAoU9RKbWEI8zRBC
                                                                                                                                                                                                                          MD5:6A08A2E8578E4CF77DE63490598F2B52
                                                                                                                                                                                                                          SHA1:8C0B8CD0BC618ED1DD61DA5DA1234A7397834BE8
                                                                                                                                                                                                                          SHA-256:A7309C460F359582CA51EC247354734809F41C0C0CE15EEF315454E451A37E05
                                                                                                                                                                                                                          SHA-512:5B2A8D2E905D0E461BEA97A3E82030AF2812E7DA944547314983BEEB16FB8E73A0BFBC1059AD8667BCB8EE0EA83428091914225A90FF4ACA6A9B5EEC19826936
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...M..`.....U..]...4a$F..].:.%......O.j.k@....|gtG...]../6..Z.j..1..X..d4.n=..5.........x..4....BzO.......DI.....7..........k,d!.Y.B.........W..J... ....za........V(_.......`.x.J..S.;Z.5;........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\button-empty.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):156
                                                                                                                                                                                                                          Entropy (8bit):5.4632256192943185
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPl1BlzjHuCAadCmy+r3UiMXkxR5ttUhUNDQQp8S0JllllB1p:6v/lhPnjHuC19H6kxRzMQTArtjp
                                                                                                                                                                                                                          MD5:2764A2853B2C848605108576CBB7F5DE
                                                                                                                                                                                                                          SHA1:B76B4CC0C895CB1EEE31D4982EAC5F48ED8DAA9D
                                                                                                                                                                                                                          SHA-256:BEC7B4B5CFCA06390C61E4B8FFA64C8FEF2F14B1AD8A5053A3AB885ED9E1D9A1
                                                                                                                                                                                                                          SHA-512:4D5EEEA47CC2D9AAB3015986783B9C4B4A7FDEAADFA1C397CADBF02B73A1A4FCB230ACC4C6F9EB30D3A878C57D6A8ADC4B222CBCFEB598DFB09AD25858FE6191
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................bKGD..............pHYs.........B(.x....tIME.....#..7.....)IDATH.c......:.&.:.Q.F-..h.Q.F-..h..i...w..}.i.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\button-focus.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):351
                                                                                                                                                                                                                          Entropy (8bit):6.944420191903475
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPnjHuC19H3oy1iohbW7I1pgG1FeDv/n6tD7oHVIRu+hR+rSofmUKrbJ1p:6v/7vq2HYR8b3UvvmIs8bfmZrdb
                                                                                                                                                                                                                          MD5:76BA0F10078A94A637E0C3E106B546E5
                                                                                                                                                                                                                          SHA1:7C9045BC7DBF64A6F8F8B03C7E0ED14E8A7A9161
                                                                                                                                                                                                                          SHA-256:A9C7A4629E75AF6BD960BE90685592F550D95B290F8686227364F58CF3407FB6
                                                                                                                                                                                                                          SHA-512:D6C09200CAABF1FD16B2EB529C78529BFC4F183149E433CD50D009B2B12F800D4128ACF91D4BA2080821CE15E6B2BBAB8E4EFBC6E5EDD42676FA896947B9B1DD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................bKGD..............pHYs.........B(.x....tIME......5..Fv....IDATH..j.A....9..$(.M.....S..P.N....X..6...lNd.k.@.s...B.....a...G...US.. .@...o..{..,...i..U..#.......v.j.,.>..&..n.,....s.M..s.&...^.d.M"........4.'gs....]....Q .D.(..:...>c....E...1.y..R...=>'..fi.l..nt...d`.,.iV..n-.F.G..Zp.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\button-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):312
                                                                                                                                                                                                                          Entropy (8bit):6.622472193618876
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPnhpQiUjdKcv+g2HCJyR20K5fIacZ+qyVxmyh5fQVaUgp:6v/7vh6iUpZ2g2HCJLm5+fr8Q
                                                                                                                                                                                                                          MD5:20EB856EDBB98F1C6AEB615F9343B713
                                                                                                                                                                                                                          SHA1:040E973D6D002A38434048EFE162004E971561FB
                                                                                                                                                                                                                          SHA-256:2EBEC95A951DDB429D455E9A1BF4D0F7FB33B20DFE65E9A143484DC3670C63CE
                                                                                                                                                                                                                          SHA-512:6F568779D45B4CE2CCAEF5340C9A6524B2C6A28B598C8049C9BA1EDF33737A9484B9ABB56EBF5FF6BC8FF9E2943267BA76860A89C717F790F503C5DF342C474E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...!..@.......*B.b !.$.$'.nU....I...dEMSS.i.....#'...1...O.4Q..0..7.i...)....t.*gyffA.I....7]..R...B".fFY...t%@2."...+...&B..P."....zI.......vw..Cb.p...+@.0..o.j,.!..Kp.x..+?.........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\button-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):307
                                                                                                                                                                                                                          Entropy (8bit):6.683617343885661
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPnhpQiUjdKcx5OjgKWTPSql/vADgS8IlDYHd9090/SrGRKk45l/jp:6v/7vh6iUpZx5pK8l/4Dgdguq06CRKVJ
                                                                                                                                                                                                                          MD5:8883DCBD21B048AE83B86C3373945056
                                                                                                                                                                                                                          SHA1:73AE43631A783B0CC0242681F8F39529B2864EC3
                                                                                                                                                                                                                          SHA-256:E5B32426B97A01B9FF1AC7E475D4BD07F7BDA5D682A54832B240DDEC17634E97
                                                                                                                                                                                                                          SHA-512:38A3BC2E61AF5459C8057C6479E4D2F100376AF4F45CBFC71EC26DE4492EBB5ADBA5247D03E5F1A541D2B7C67F8F7CE2011D67F3769CFF39A304D53DAE7A8B83
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...!..@......6)5H0.....I.[......*$..&]..fCP....9..O.y..v..-4....3..<.~1.....qT.e]....E..C..]l....Xk"..@].3....H{U..#...y.8..P.2......E..Sf.@..>..&&..o.N...%.|..T$4..u.....u9.........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\button.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):313
                                                                                                                                                                                                                          Entropy (8bit):6.740078920235856
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPnhpQiUjdKcNMnjYJFlC2AJ8JnwpMG3l4tnSCgMc0d5/yr996p:6v/7vh6iUpZQ8JFlqJ8JwpMv9w0d0Q
                                                                                                                                                                                                                          MD5:D9051294E1C76FFA270402C57D8EFB69
                                                                                                                                                                                                                          SHA1:2C02DF1C270BF27BB0E7361C147D60BD599B3435
                                                                                                                                                                                                                          SHA-256:93D04F35B8601D375FADBBDD10E50756DAB51BF8203746913BD73A69DA4E963C
                                                                                                                                                                                                                          SHA-512:A3FBF10F22CD02BD629793C496D65EEB53577A8A100DF4BDDA48337678A437C085DCD46890E0D53885D8FBC99A96BB849B5A339D68415D0C0FC57C539123039B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...!..P.......*B...`.h....U9.p.$...4O.4...LCP.'.o.f3.X3.p...&.....g:.*8n.2...9....$M..").\.ru[....d[.....g..... ..^.o.....S.....(@...?A.$..Cf....U.)}b..\S.....G.W..P$|......x]?.E5.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\checkbox-checked-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):402
                                                                                                                                                                                                                          Entropy (8bit):7.090791081870002
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7wiUpZpkfCkTCnXWJF1VYim0hvURQuDaz/K3Tl1:XiUpvmyXWJt40hcRQ+az+3
                                                                                                                                                                                                                          MD5:39EF2A644249E0B589B372796E200104
                                                                                                                                                                                                                          SHA1:6E15E98FC17E40572DCE8F6BC9D3EC76D93A45FD
                                                                                                                                                                                                                          SHA-256:D8A2866684F527C5128B4FEC33EF5075B51758429936009552DD3B283F8252C3
                                                                                                                                                                                                                          SHA-512:3DF2E12C2D3203C7B2EC010B933D51F3120799F6D3A27FCB20C5A4602099BA00B589249A8193ECEAAED8AA5BFB481EBB93E300F7CEC30E097061FB7475F1BA5B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................a....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...AN.@.......AXhcW.Y..g0.h....@ z.o...2nua4..E.R.g\..R(E.......3....aO.y..\...k%A.b.^..Cq.@....@..+N.P....r%..*S/$P..~......Z.`k..d....d.y..~g..W..N6y..\.24L.i.....t.....K..#.2.|E..4.......y.GT=w)<..I_..D<'.x..Yaz.V'.u......|p.......M2.XI..$.....i6..bmT...]....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\checkbox-checked.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):423
                                                                                                                                                                                                                          Entropy (8bit):7.134863397056401
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPysQiUjdKcMzsnd3IrV8mtZ9SKS7lDR2W37nM73ocyvkj222Zexzo21/7ko:6v/7wiUpZh3OlteMw7nI4HM9Wex8Y1
                                                                                                                                                                                                                          MD5:57C11AB357318471F6B2653303F990B1
                                                                                                                                                                                                                          SHA1:D8867182906E41F1F86CE0DAC669F24573EFB5AB
                                                                                                                                                                                                                          SHA-256:AF1BFE7C0915A9C639F54ACDF50AC5F07F959B31EF69E79B930507F00050D1C7
                                                                                                                                                                                                                          SHA-512:558FEED556A3844ECDBB796E2407CE2ED9F3EC390884B23EACFDE459C8CE2ED181DA744E656E60DDBDEA9E24719AC56E69597AF098FD10E0067A12F95B2A94D7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................a....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....$IDAT8...O/.A.@...Vz.Jh..qp...A8..{qpEp... ....D">MC.4...lww..e.5...L...?...'.e"y.......o..%....!..... .!.R2.+.)X..S...,S.Sv.^vX...9.5.......R.....Rm..@....s.6F.=..g.h.y..l.|...Fr...?PL;..W..}...S/x.*v/Z..L.3=........rt.!.......VN..Sm.l.5...NW+k...'..I..........w.H-R...i>.xqbk..M....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\checkbox-unchecked-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):277
                                                                                                                                                                                                                          Entropy (8bit):6.601012544792289
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPysQiUjdKcRrMobZcDOnZD4RZP//QT7YSx9wWoXcRg9Gjp:6v/7wiUpZuobZc6nuIFoXcRg9GN
                                                                                                                                                                                                                          MD5:0D5C84520CD038DD564242C8D7AE90B5
                                                                                                                                                                                                                          SHA1:3B404FE507CCA83D2909EF0404B1ADA13EECEC3D
                                                                                                                                                                                                                          SHA-256:D7D3FA1E867AA132F865D5C80F7126A1584404ABF562FF747576A9AA89C8A438
                                                                                                                                                                                                                          SHA-512:65D49599A44B56B841386D5879CF2F99E06E53A8166A481744559D0EA19E86F756843E03D9BBCFEFC6F001B80117BADA07D01DBFE56CFE5607F48791E0834064
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................a....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...!..P....7/.D...`@q.....M0.)..&.R..."...Y....f.....p.k....H...Z-.u.P..bV.jh...t......ZDo.R..c..o......i;.&Z...si...9..f.C.!c..........+x........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\checkbox-unchecked.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):269
                                                                                                                                                                                                                          Entropy (8bit):6.538311771648168
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPysQiUjdKc5hk+MSooWL+vM6xpyAiAr/ktuPpjjp:6v/7wiUpZ/7MxoWLQxpyPA7ktqpjN
                                                                                                                                                                                                                          MD5:5D4C32282F24CE126B48D0A210A8D268
                                                                                                                                                                                                                          SHA1:D2BA99608D2C1CD0483CDC37F745734AD1C3F50E
                                                                                                                                                                                                                          SHA-256:81322949E3751508410C646EE53C0565D5D741CE08CAC4BB589A32DCACEF47A2
                                                                                                                                                                                                                          SHA-512:B64022A1786E60E8E35649D31735B8B89829149ADDE0340083A9C45E94232607982F267B43249456B0EF42B98C352BC5F37E2BC86690D36748EC6EB341B6D14B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................a....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8..1..P..g?9.../ V..H..7...|.`..H.`.n. 6...L....X...(..N.....5j.....@U..w.9IIcum..l.gAr...d..dl.....W.^.W...._Y$..[w.s&d........AOH.gkV....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-button-active-rtl.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257
                                                                                                                                                                                                                          Entropy (8bit):6.382243414991483
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKclhkHmOyrvkM/pi/KudP4ODnd/bp:6v/7IInjiUpZ7sVBfdPHd9
                                                                                                                                                                                                                          MD5:3E75564CC64C4CA1799A68345A990FF7
                                                                                                                                                                                                                          SHA1:75A1B55E8D55AC423F4A500F951DDF43955CC219
                                                                                                                                                                                                                          SHA-256:ECDFEDD15E1F9A4C8A5B631EA530BB71534AD5F90F949A77F51BF6925B4F0DCA
                                                                                                                                                                                                                          SHA-512:7A3CF8670E69AAE1E874FD463FF1B9862AB7271947A395F699E6D18CC0BDCB4C475008F4AD23C08D16B2A2FD511907701E7D1E0944568C8F6D51BF0130901D49
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....~IDAT8.....0.....A..a...L..`.J..J.H.....(NC$z....O'.u..1...@J`..I.kf..#....v.y.`.%.O!.=<f"Z.*...........H;....[..f^...b...N...[.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-button-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):275
                                                                                                                                                                                                                          Entropy (8bit):6.5311762650959695
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKcHNfx9DDmjhNX6P5WBtvvSapp:6v/7IInjiUpZpDDmnqP2Tn
                                                                                                                                                                                                                          MD5:ACE6553F633B0B4CA3EE0FC5C26AC8E8
                                                                                                                                                                                                                          SHA1:F5A2049D3BD6FADF3B955AA8C961A50240A27C98
                                                                                                                                                                                                                          SHA-256:CE4875D0F974B6163F296AF7C765524BE621D5C3924F953153FB2017DF2C334C
                                                                                                                                                                                                                          SHA-512:563D15C009F4613F96D3CC98D90A2ABC02C708884B3C949DECC18DE06A004652BC369992B5DCC03B7B7426244C355531DF8059A7B96ED38A762CD2BC4A77AF9C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...1..@.E.;&...VA..q..*.Hv.>l.-..X.&c..... .3....8....O..kJ..xhR..z.$*d.........^..b..l.f1P......3.PC.5..P..S..4J..96....?.PW.j.......&.i..G....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-button-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):226
                                                                                                                                                                                                                          Entropy (8bit):6.279403595024375
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlilDnAadCmy+r3UiMOUmQsyxFZFxMBK/EijqPNoOPoSWEjczlAupNp:6v/lhPQn19HQKM/tqFog9gJ1p
                                                                                                                                                                                                                          MD5:85976A6AD6D5CCF5BC0E3B07FBEBC6D5
                                                                                                                                                                                                                          SHA1:6A2072811208CEA609EB2F4937D7BFA1B043CE4E
                                                                                                                                                                                                                          SHA-256:42EA37F4A1E4ACBBF377F97942221C3E87B5654E187CB7F16207E9BCAFAAE891
                                                                                                                                                                                                                          SHA-512:EEE510AFFC9AC5321FF2F67D3C0AA569F2844B9AD67AAE112AA2D2A096E00B0FF3030BBB18472F4155D8EF86F043A45567DD59756FB00621B81076999CBE02DC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....bKGD..............pHYs.........B(.x....tIME......+...X...oIDAT8...;.@P...!/Z.P..`5.Rg.:....i$....W.....q.f....*.y..=.qZ..y..f*.\...?.2Q....EQE.UT........e...t.*u.Z(.n.9b.&......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-button-insensitive-rtl.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):249
                                                                                                                                                                                                                          Entropy (8bit):6.46458830504056
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKcNXNB3MJCseVxHC/Qm/mv5/Np:6v/7IInjiUpZx3QQKmB/j
                                                                                                                                                                                                                          MD5:D702D4D3899BF26C9A1C4C69EFCD2E4F
                                                                                                                                                                                                                          SHA1:289A52ADBA3D4B2CC08F6A745BB6CEBF9B2D8B60
                                                                                                                                                                                                                          SHA-256:4762F6126DA2EFB7F69DCE4DAC83F1B27F77479D5D5EEF7905B5E5DAF4A31819
                                                                                                                                                                                                                          SHA-512:025BD9F17D5999FE1EA36D85EFF8E8596AA218849ACB7E3EC360C3FE4B45D320789036159809D1C2D51753DF921CDB29C8CA7A1F515F3C875ED6AFDD37BBF845
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....vIDAT8...1..@.F.7.l@.C..F....x..&..`DX...~..W..}.........<..<.....x.2p.......U.....j..j....[J....|g-X..W.:..=./.....y...x....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-button-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):266
                                                                                                                                                                                                                          Entropy (8bit):6.575196077990688
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKcdALEqEFsmybZJ9BIDTjp:6v/7IInjiUpZd5pFVMUp
                                                                                                                                                                                                                          MD5:F33D3A44FCC2C52C5C6D103B26721401
                                                                                                                                                                                                                          SHA1:03C4A7158E93FB8C73A023D65137DE302B0E7FD6
                                                                                                                                                                                                                          SHA-256:090D3203D1E4A3BB249938FCF9FC34713FB5807B8F6161F5C3CA236CFF1CF58B
                                                                                                                                                                                                                          SHA-512:ADEDD9CC43CFECA9F4F04EC9A249BB2A34007046F022FE5752A6981AD10AE497D5B9C4DD770520559B0D40C3599B2146704F2F8D18DAF21F1A9C866CF2C60E13
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...1..@.@...16.Rh.]..\.c`.6...0!..4..-,..........\g....>..).$Q.B.|..v..s...9.m...e...~a...f....j...S..<J..a.(-@.=_9\Aigh...,.;.!.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-button-rtl.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):253
                                                                                                                                                                                                                          Entropy (8bit):6.520517072403741
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKcpdp78PLMd0zH7O5Shldp:6v/7IInjiUpZ9QLMdoOMzz
                                                                                                                                                                                                                          MD5:5A855B179F852EEDF9E9D13D0BE92631
                                                                                                                                                                                                                          SHA1:A1F36C92B24FC53DCE6E4D7242CF6A51187EFDB0
                                                                                                                                                                                                                          SHA-256:214C3C9F25B0B5CFBD1C7780A15A3F5F189F535031180F5E1051CCE3E405C1DA
                                                                                                                                                                                                                          SHA-512:B9BC57F6709CF3428673705551F26524A928ADFC2A565CC27265846942C969091CDD7D0E95E74779F2FD1FA031EC5527A9C50C2549D2BF9F90D89F0B09729410
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....zIDAT8.....p....8G..t...k.O.Oc...?`...^....~._=.x.......X.......r:.3I.....t...6.u...k...h........B...}{..x4m!....... ....[{.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-button.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):271
                                                                                                                                                                                                                          Entropy (8bit):6.52333865376226
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKc1LirZKXMg9zQ/QLGpHyObk0nrd0kup:6v/7IInjiUpZ1W1KMglQ4SpHVL01
                                                                                                                                                                                                                          MD5:9C01EE158DD973355312E2101406039E
                                                                                                                                                                                                                          SHA1:7B952150DB224F244ED6490D8169DDA335E6BF3A
                                                                                                                                                                                                                          SHA-256:46D8AD0EF743AC75DED8957F6BCEC01CC3BECDCE2171953104863E8D17B25DC3
                                                                                                                                                                                                                          SHA-512:F69261C3BCD31A88225FC2E84D740CFEBE17ABABE0CAA2313F1AAEB7655C614A18D5402873EF206D68B07855AEA832746F50F0BD8ADB672B096378758A9CC095
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...!..Q.......5.D.A...,..NtW........axa.`.r&.`...._..i'../1....N.~]..f.|.F..R.."...p...$..j9............QG.u..?C%....V`........Z.=P....&e$E.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-focus-notebook-rtl.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):287
                                                                                                                                                                                                                          Entropy (8bit):6.65205896658197
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKc7epIlkPwlw2jGJQqsjrzYvtfg/kH3VY1p:6v/7IInjiUpZWcEAGJQqsjr01fg/Oeb
                                                                                                                                                                                                                          MD5:27CA8BDDCE47B739C0DD5ADFC5E08B2B
                                                                                                                                                                                                                          SHA1:8C9590BEBB6DE9FF77303BFECB9E253C6B70E728
                                                                                                                                                                                                                          SHA-256:073EE105258E736C53C561A998CD258F77083CAD965D61A564E9F3F9F7403CC2
                                                                                                                                                                                                                          SHA-512:C82C0E630C1F43CA5D40AFA3D33496F7AB5090A11F19A546CCCE4B55E3D4D62026902EF69E8BFC436B16D842EB464E6AEE4DCD73851FA5CFCAFDB35DE74EC384
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8.c....?......A^..!...D....R.....B...YY.'_{.kR..?.U...............r..=.....T54.]....k(...:j.... C.......H]C...3..Y.W.Y[..]}..?....ZU...+C../..<'....(a...'....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-focus-notebook.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):287
                                                                                                                                                                                                                          Entropy (8bit):6.605706583348592
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKc7oT00/q5i9HgmcR6XcytEevop:6v/7IInjiUpZ0TSMHgVREGevC
                                                                                                                                                                                                                          MD5:7F9F54D7FC77DA198BB56D996206D637
                                                                                                                                                                                                                          SHA1:E6EAF35A9563C21EA268423FDDBE921134406173
                                                                                                                                                                                                                          SHA-256:52DF0B85617359192F8A3A2C18862822BE29E5C98173D1234AEFF4F4172E3970
                                                                                                                                                                                                                          SHA-512:1B03AC0481C383E50DF6C87E201A919B2DE8FAC032238CE8A61B1F1741C5CC6088CB3D427C9E7DF1D787033CCAD88C7ACE573D99D12FBC654973FA31E57C3C66
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8.c.....3..3.>.........g........g.'.~...p..r....JW..?...B....L...f`..s&5.e.........m.....:j..0....a..g\T5T^.....=...2......g..w..V..........JU4.@YD$.<.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-focus-rtl.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):287
                                                                                                                                                                                                                          Entropy (8bit):6.605908748819477
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKc7eEVqymR7qsjrzYvBJD11HqKp:6v/7IInjiUpZaqsjr0VF
                                                                                                                                                                                                                          MD5:99E0B4A237E9A750B55591A458834211
                                                                                                                                                                                                                          SHA1:292A1B9433D6E67AB0262493713F96155254C02A
                                                                                                                                                                                                                          SHA-256:FFE61EC469B66F1B96C2549AD6095BB46B8ED39C8F7916C3381C02DA6CECD8B9
                                                                                                                                                                                                                          SHA-512:7F84CCEFC39E46D7F69277B40756C7C0E2FB3F7A05641E8246D1A05D243F6387E7E46B81A201EF76E3D290E77FE13C1FBA24398F6D93697248A802F4A663B152
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8.c....?......AV..!...P....R.....B...Y..$_..gR.57.U...I.^.?z.........?.....T54.]....k(...:j.... C.......H]C..c..d.^.gf&.v...D.n.FjU..B....\..2.....*.x.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-focus.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):6.435595173581557
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQd6K/staqcmDGdF+YC6kelvt5gpBQSujuVp:6v/7Id6+s4mDKMYZlvt+pBQfju7
                                                                                                                                                                                                                          MD5:E2C05F7A3A3701E5A40B7E0841ED47A8
                                                                                                                                                                                                                          SHA1:4A6D728444F7280D144DA8006197A79D0AA86CDB
                                                                                                                                                                                                                          SHA-256:DE8825A569B9DA309F5BF4062640B5EE4D4E61EE774F211A453D16A7A59AA18D
                                                                                                                                                                                                                          SHA-512:F76D27126276DFB78BAE161DB8AC60531D3B2E787BEBCF7A933F0AEBAA1FE6AA9395A970594A3AABEAB3AFBAD97FF45A180F9A38B65384B4226712313CDD0D26
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....pHYs.........B(.x....tIME.....#3v@......IDAT8.c.......2.?..........g .0.YGn~..>................3./..../.....2=..A[..........,..5...`..QCG..5t.....HI...PYAf...~P..@C..i{.3.{.j.f.U....cxD.*.....O..yp....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-insensitive-notebook-rtl.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):252
                                                                                                                                                                                                                          Entropy (8bit):6.548183685013482
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKcj9o1il6IMtMYasD17134sp:6v/7IInjiUpZusl6sK/
                                                                                                                                                                                                                          MD5:97A83ECA0F749FDA77EAAD33F97E9C34
                                                                                                                                                                                                                          SHA1:28F35E0F3A9ECA24C54336F905FD7F7AF980FCE7
                                                                                                                                                                                                                          SHA-256:4206EA6030B4A3969751568A18DAB56A86A7124D0EA1E117065B437CAE4D90C8
                                                                                                                                                                                                                          SHA-512:7F034C3C79FD2C5DF36247BF6FCCCA52E05BDE0C7B15A8CACEC927ADCB79B96795D5689364A6D27B4A94B65C06A4DE64E178794DBB8BBE59FC67399E6F75DBB0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....yIDAT8...A..0.@.?vl.....O.q...&....$..;...=9.D8/.v..H..?..*).....8...Q!..*......E.3..Lg.O.........S.F.....|.."...5.W....+.n.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-insensitive-notebook.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):246
                                                                                                                                                                                                                          Entropy (8bit):6.447939849181254
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKcp8F9QpLhVYgJ2EERQA9eup:6v/7IInjiUpZpHTYgJ2E5S
                                                                                                                                                                                                                          MD5:B78E80CCF29CD383809A4F01D14825C2
                                                                                                                                                                                                                          SHA1:392AD4287B6AFAFE6A348D35D6384B680B940DA2
                                                                                                                                                                                                                          SHA-256:3E2E35E97BDAF542F000FED911BADA9E065B47AE0BB562D0A4F2BB32E1D0E61F
                                                                                                                                                                                                                          SHA-512:4090A5AB2FE20AD347AC5D60736314783919B7A0EFE233D8B011DC10ECE771ECC3B2EDB20B52DC6E77CEC003FC1EBC51DBB113B5DE212A5B29E7BCC5E2CB6334
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....sIDAT8...1..1.D......?%..im.6..\#Q.....Lq..5...[@.{[D.{_....-.A......T.".....~.?h....D..-%.=.....^/'.CS...._.%]....4..D......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-insensitive-rtl.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):259
                                                                                                                                                                                                                          Entropy (8bit):6.489727836540481
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKchLZvpg1GvFiV8mmMQTgA66u5zEXm6Pxp:6v/7IInjiUpZhdqCF285MQ0R6u5zTkf
                                                                                                                                                                                                                          MD5:B2F355BAA53B1B829B9D45B21A4A75E5
                                                                                                                                                                                                                          SHA1:F726A1FE9F60B9256081EF0268AB4FC83E41F6A7
                                                                                                                                                                                                                          SHA-256:AD003D6C8D3BED9123EDEE2F3A69D568C143D2389E74E99D95BDAD4E516BF8FE
                                                                                                                                                                                                                          SHA-512:05B38285BAC6865ED739083B33A47A15D0362D48F4128AE771BD3D753F6CE3554145C8714DB019C1D1555F040C9526C2FE5F6C003BC9A4841F80D9F0C60B7C97
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...;..0.E.+.....iRP0....A..+.:|.p..zr...`"..pY.K.H.u.U.\.{:....{..#.pV ..<...y.S.7.Nt.....?.....,0U..?.....-..}..o...(.y`.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):256
                                                                                                                                                                                                                          Entropy (8bit):6.549063269821547
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKcnALTTLapscE6azhydxf9Fg68gcp:6v/7IInjiUpZYTuyB61dxf9Ct
                                                                                                                                                                                                                          MD5:11472D5C80BB453B0BC8BBD273E66806
                                                                                                                                                                                                                          SHA1:A418584A634EFDCF8BC01727608C9A5D055E201C
                                                                                                                                                                                                                          SHA-256:592278A25A7E24F617A3B2BA20FC7F90EB666E35739F2AF8BEFD3E6D235068C4
                                                                                                                                                                                                                          SHA-512:69FB67AD66C9A00221C2178CB3F3A1C79F908E1B3C36E653B8F5D23C3D045815E2F0C790B350A35B3843F84B84C8E96740F3857EDB41674ACC51D48CEE38EB43
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....}IDAT8...1..0.C..b....L...cg).I.m2c...TI^k..:.4.f.q8Z[g..m&iD.....^/..O.....f.L...@.:......vh.Bm...'.....X.F..d......1.=.S.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-notebook-rtl.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):279
                                                                                                                                                                                                                          Entropy (8bit):6.65493064382777
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKcGYxSowyLzmSp6PLrCHgbVbNyllVp:6v/7IInjiUpZGYxzbLzFiLrQGVbN21
                                                                                                                                                                                                                          MD5:EA7F63F4D6B5E5FC327C02DB4F50DB7B
                                                                                                                                                                                                                          SHA1:74E2279D14A09A3C548192F7CB9B6F99E413D15F
                                                                                                                                                                                                                          SHA-256:BA24B81EC29CD5FD1A34DB8F84721124375611218F77EBF3057EA1AA2F61167B
                                                                                                                                                                                                                          SHA-512:E8ACA1C9AB31458AA9F02A47FB91D95AB649F64887B2070840187C9F694B4EF1F026996E0A1EFA4CD6DAEDCE1ACF15A887CD7A30342926DAF3598A0207100ED0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8.c<.......###.';........;..A..W..?y.y.....>}..(.....7...HMC_.x...../L.4TBB.......j(...:j.... C_.z....H]C..e...`..aW.^e{..]...c.Z.... .....".9...P#....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-notebook.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):276
                                                                                                                                                                                                                          Entropy (8bit):6.634693098036574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKcLKNk3jt679+IM6LlgrueW2jWnaCo23Yp:6v/7IInjiUpZmq8DM6LWA2Cn/m
                                                                                                                                                                                                                          MD5:9E2A215B28F9A62B57AFEB0EB5F30BC2
                                                                                                                                                                                                                          SHA1:6C3DFD5CCF469EE7150AAEB773AA80B3D1E83DE8
                                                                                                                                                                                                                          SHA-256:77BAE4ABDEA04FC9D780C392FABF3EFD46EA7CC8363E3D3069EABDB5B80F33DC
                                                                                                                                                                                                                          SHA-512:CDF9714BBDF18DEDB81E0A19A16D25B75B8905D1C77B48CC257F6A13BF76EFC358B1527B19C514B58E906656C61FB22C190A81FE5F6EE0C1695719CB46885A46
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...A..0.F...(.....W..{..]T)5..*.6.......l...|.G1F..........=....}....Z/....k..`....dp{Q.....DQI,..MhB..%".c.h....o$.i|.K....}..a.=.(....M..E......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry-rtl.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):287
                                                                                                                                                                                                                          Entropy (8bit):6.707808095501831
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQInsQiUjdKc7N4xUcCCu8iczE+h3MO0xsnqQTp:6v/7IInjiUpZSVCCurKh34cN
                                                                                                                                                                                                                          MD5:9779EC9A40B1CE96DDBFB44D0483B797
                                                                                                                                                                                                                          SHA1:A935C49DD08EE959899D24ED89623332093B150D
                                                                                                                                                                                                                          SHA-256:ECF84B52231206F6E958F3F56685C93677147C49950AB648D6E0BF99BFC0E9FD
                                                                                                                                                                                                                          SHA-512:59B82C204AE73ACE5EAD0CB63FC92F9102D4AD8A6A72F50D1632847D9F0FA535B9D3C68BC7BB28C40E23071E93F2702C1C4939EFC10CDE7CA50477DADF822E7D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...1..@...yk.k..%..~..{...Y.V...u-l.A......u...c........&V...$.....Z...r~o_..H#......g.y..9..+7J.......E..4..........A.'.s.4...g..}..e.F$.h..O....~.-2.7......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\combo-entry.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):244
                                                                                                                                                                                                                          Entropy (8bit):6.640346114775987
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPQd6KogtUumC+dTsbrgH5qrFmHKPpb6CVp:6v/7Id6x6+dTcMH5QFmHqbZ
                                                                                                                                                                                                                          MD5:0C8FE3385D951B36737FD68E765AFFB3
                                                                                                                                                                                                                          SHA1:724940E2549D4D4F226BDE56FC67B0156DDAA030
                                                                                                                                                                                                                          SHA-256:C89EAEBE4DC8DCBA6ED45D17B9C1206F8EB7B1DDBEE3E928AC009920C4C88D8C
                                                                                                                                                                                                                          SHA-512:B3ED7FDD64FEEE3105B70F99AB55A1EC57DAD3C821043DDB005CAFA808482497B7C0E8D61A8DA5CFF0058222E62F4DB44AFE71D5F3E059FBF0712A6BD8422DC6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................H....pHYs.........B(.x....tIME.....".$_......IDAT8...1..0....B..L..(.....A0...5...."8.........G...9.u#B. ".2z...s...h....@DXX,\7.t....Z..&4........;....f4.....]..nV.....~W.|...X.b.':....U&.O..>_...e....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\down-background-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):186
                                                                                                                                                                                                                          Entropy (8bit):5.799815098749008
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlHztZlp3qCAadCmy+r3UiMxVyEAw2GZ4jfslVrBpc0UnuHakecXn94:6v/lhPZ3qC19H8VHAw25odS0+uHaAtl2
                                                                                                                                                                                                                          MD5:54804F48A0BEB94B622539DFE825E559
                                                                                                                                                                                                                          SHA1:EDB8F25589B1AF4852BFC198A4F30A394021A05E
                                                                                                                                                                                                                          SHA-256:5BB39655764BD845F62770EE928D3E154D3A76919DCD35B642AFE4539ACBC470
                                                                                                                                                                                                                          SHA-512:2BEDAC52416DFD4F9A5552BF860D353F41722EDA1734E5884EC45D66445FDD0F7FC75F82E04392EB31543BC46197F89D6FD70A5EC394CC825B0C7639F7013541
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............[k,.....bKGD..............pHYs.........B(.x....tIME.....,;...v...GIDAT..c.|....<........L.D.Q..Q.K.?.........|e````y..#nSXX.....1000...g...E.F....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\down-background-disable-rtl.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):204
                                                                                                                                                                                                                          Entropy (8bit):5.97810167970233
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPZ3AsQiUjdKcTdwuxfygdoimP3Sdp:6v/7h3AjiUpZmuxfymmP3I
                                                                                                                                                                                                                          MD5:7D798CE0510529F9C053D8B8E1822833
                                                                                                                                                                                                                          SHA1:0C6D694D59996377E9F13D1C0375C5AA637923F8
                                                                                                                                                                                                                          SHA-256:9F6EC4781B67AC1CC16ACF61AAFF0BAF994121810FDBBF9131B388DE9B7B80DC
                                                                                                                                                                                                                          SHA-512:D0B211311E7D462006902EE9115D74C6C3F8E403DC22C3E221A1CFEDF519F2016DA3C369FE02847D60DC0B5EB9AAA721BA596AB0AB0E0D8FD59ED7543B0C85F2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............[k,.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....IIDAT..cd```x....IQ^.|....BR......)A......}....bF....{...00.a`d.c```.........5....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\down-background-disable.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):207
                                                                                                                                                                                                                          Entropy (8bit):6.168646246857242
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPZ3AsQiUjdKcuyEhlkMIFtj4FC5Zianjp:6v/7h3AjiUpZuRwXj0CN
                                                                                                                                                                                                                          MD5:C630E694E350421F4E3A915FABD1DAC4
                                                                                                                                                                                                                          SHA1:8AE554997399504C63E2003826E669B97F05B93C
                                                                                                                                                                                                                          SHA-256:2719C3BE63F23D9A6B2309238994DDB587FAA2BC69A5831273BA3D9CE4229555
                                                                                                                                                                                                                          SHA-512:4BA136CD6232DD57EBF90D16F2CBA6C16B6A1EEFA07BFC819500984C21ECB3E84CED2E3DF5D9FD7F68A1B9E96E978AB2324A76A97B45999DCEB3A294FEBAC33C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............[k,.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....LIDAT....!..0...k..@b.;>].... H3...C.....M3'....K..z.......P"$..4...Y.i....I....o......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\down-background-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178
                                                                                                                                                                                                                          Entropy (8bit):5.875473003971313
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlHztZlp3qCAadCmy+r3UiMxZBphkxRvASlSy2Ua9OFR9sfjpJ4m8Q6:6v/lhPZ3qC19H8n8Bj2k6pJr/vgdp
                                                                                                                                                                                                                          MD5:1324BC76E95821F7ED6180D0136FE542
                                                                                                                                                                                                                          SHA1:1030184F15631A97E3DE5B433CFF2CF8A8E0F4E6
                                                                                                                                                                                                                          SHA-256:78CFADA6F25754DFE44738989A2596CCEED8C3A5517E717EC476A34608923ABC
                                                                                                                                                                                                                          SHA-512:C17EA3E16EF17495F698B0D9C095667CCDF5145FEDB74EFEB56B0DE434AB0C6DDB7D431E4197DE540CDEFF973F041454219AEB26DB9A9B6B30E9663A17A6A340
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............[k,.....bKGD..............pHYs.........B(.x....tIME.....*8*..J...?IDAT....+..@...A...W..6..V..y.?..<.`..@.?~.I..r../.P.]..5.p..a4.._.D....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\down-background-rtl.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):198
                                                                                                                                                                                                                          Entropy (8bit):6.101464642179876
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlHztZlp3AsrtxBlly+r3U8G9RthwShLKOWGEVwZs611xThQsW5Va/y:6v/lhPZ3AsQiUjdKcZLVhQsW5V0Ijp
                                                                                                                                                                                                                          MD5:C6C21E2DAA7793DEEFDF1B0183BD51E2
                                                                                                                                                                                                                          SHA1:F86552265796BCA73BFC20EF164A18E55DEFD01F
                                                                                                                                                                                                                          SHA-256:40E232D41A4F646CA9F99F71B9F0CF0DA96E0EBD3FA05F43D6D696B3D8A3606E
                                                                                                                                                                                                                          SHA-512:0C6CBA168CADCD650C1E59BB16E7FDB2E64BBFCAA8175BEEEA2B106F9440C8875F3EB89D5D91411E84C8D57AC078632A13803187FAA66A91101052AF9D287AFB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............[k,.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....CIDAT.....@@...=.6t.R...>....Lr.0^.6^...-....)^..!..8.....:..F.O..FE2h.%.c....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\down-background.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):181
                                                                                                                                                                                                                          Entropy (8bit):5.819988259425435
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlHztZlp3qCAadCmy+r3UiMxNpA/lnBxRpW1BBoh+A9hdCy+71k8Koo:6v/lhPZ3qC19H88VBsijhG1k8Kp
                                                                                                                                                                                                                          MD5:46FE0A7B93B209650D97D545E9CF75A3
                                                                                                                                                                                                                          SHA1:871AD919283396FFEFC7A7BD39C60A436DEDF8A3
                                                                                                                                                                                                                          SHA-256:5B1E69B42B3A11C68F1FD251D88CB7D181A98A5D9D60DC968C49F60E59C70FE0
                                                                                                                                                                                                                          SHA-512:402546F324984EFD38B91F092D022DFFD86B738BA8EB3A44E4DA3801B86D014BE288FF907B6DF278F98BFD89F3F8D66024C9DABC7359BDA83F277B438F7A119F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............[k,.....bKGD..............pHYs.........B(.x....tIME.....+$'..D...BIDAT....1..0.D...B.Lg#.[+1.7X.[.~..w.5-{...~..^P2.sC.2.-{.........[T#....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\empty.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):71
                                                                                                                                                                                                                          Entropy (8bit):4.369857568567909
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPl6AMCThA6QT7tsg1p:6v/lhP8AMveup
                                                                                                                                                                                                                          MD5:B2A6D64911CDE2956941E30866A76E25
                                                                                                                                                                                                                          SHA1:BAEC0E51594D0DF39BBC8D8EEE9B6E8A8BB46AF0
                                                                                                                                                                                                                          SHA-256:47B1FAF8E8D6E2E6ECD37CB98B204372BA503E8D9167E3C8A504AA1D49A34AFD
                                                                                                                                                                                                                          SHA-512:3CA8FF70EA1E527F7309CAF621A150EA2B70D31F7B3AEB2AEBFDC19E327CB5B19357BE011D2608058B8A4197568773F3DE26961750C0DEA55D147A42157B3C6E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............w&....IDAT..c`..#...............IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\entry-border-active-bg-solid.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):364
                                                                                                                                                                                                                          Entropy (8bit):7.028185017631272
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPnhpQiUjdKczADJGpWPzhGZBldmCvSCWnR4+E/5nxOTgJX//Azxu+S4e9sz:6v/7vh6iUpZCJIWP0ZBnFSY/5UT0//Ax
                                                                                                                                                                                                                          MD5:4A8E20E991B55C72A3F6525E2B87E660
                                                                                                                                                                                                                          SHA1:2E5839C68FE249F935E80A23DA15C7A7A7C810AF
                                                                                                                                                                                                                          SHA-256:9B5DFCF9D68EB179F7EEBA23EA5D271D506FB01A36276E8DEFFDEF08307AA5F4
                                                                                                                                                                                                                          SHA-512:140A022DB8EE07BE65632F616D37DCE3BBC417887A6B15A148D34682180EE37BCF25883A73D7B7344162E41CB5B543BCE7FCF4E19B659BC88628926D8325551D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...1n.0....v$.la....U"....ct..@......l....#...NPm..-.bt.$.G/?=/..I.g|H.R;XG.Q$..T....Y..,.x]..<I1.....YG...,W..a.V.V.j......"^~;.{..)n........}.".`...&\....(@..K./......,..WMk....1..E.`.!U.u2..R.xYi....rn}J.....t..y..C.......L~.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\entry-border-active-bg.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):398
                                                                                                                                                                                                                          Entropy (8bit):6.943909573052176
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7vh6iUpZuewmMmZdZrVHwH06CBOoWfaOs:XiUpgeLbKCMRyJ
                                                                                                                                                                                                                          MD5:DAEC6F90DFE82E4769E34C8ACECCA5D1
                                                                                                                                                                                                                          SHA1:914763391C7621EE3EB47CFA7A83B1904FA556A8
                                                                                                                                                                                                                          SHA-256:2EA986777A55A24711EBA01A64A60308A0A1AB5996DA545E8007F5BD42B0F32D
                                                                                                                                                                                                                          SHA-512:6E883EC62E71F72ECE636BA21F92D73D5A479D69674373D9258A80BC6680DFBFD0F880DBE15EE4C06532E5AFCAF78AE650C91B63E790BE2DAB0EAFC47704530E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH.c.......2.?..........g..`afd..df.4.b0.eg`<r....G..1Vd..b.?#.Q..5,Z........>..`...P.....{_.P.pl`..W.%+..gz../.(...ZY$..0.....L...g.Vpa.a.b_.....D+....E...Z4j.EC.".fF.U._...%'..0320..23.c`..E.....d.4N.....H..F...Tj6N..g.=..wS..7.#.....7.GTnn..13..r1..3...tmv(..l....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\entry-border-bg-solid.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):339
                                                                                                                                                                                                                          Entropy (8bit):6.9067445166524415
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPnhpQiUjdKcCuspXW4/hoPGVjPcTCqyMJxXiSbgfrDVuhyBLROp:6v/7vh6iUpZCNpmohv9hJAxXiSskhMLa
                                                                                                                                                                                                                          MD5:EF53A395964406E29EBA48D52B62CD03
                                                                                                                                                                                                                          SHA1:B8FC6AD96A55DAEFE4D5E639D669B797924DC9DA
                                                                                                                                                                                                                          SHA-256:C35FF5A3F63E6E7779B5B33F996268D8379A9F8E81CCCE206A6C472ECB31D5EF
                                                                                                                                                                                                                          SHA-512:F97B9703DE1A065128AE672DDB5890E0876A925AD22ADEC55312A0DA7300C73F922B96A9DB044C8F887130F947FAFB68281207E731C5ACCEC7B4D3B9E11F17DA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH......0....B5.....B..... ].Y....",..xX...|L.3..F..L......#..&.w.(..g....(...D.T.......S......W......5........Q....%.+FU.}.D.U..&.u@.t@.t@.....^m....0...4..M..]2....NQ'SU..D...s.....{$.....9E.....^..b.0....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\entry-border-bg.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):368
                                                                                                                                                                                                                          Entropy (8bit):7.0293786860825955
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPnhpQiUjdKc3NgM9hjA5GbYXcxie/CGDBlyUZXtWLR8Bk9bXJESqgVp:6v/7vh6iUpZCM9h3bYXcxH/C2NXM6MJz
                                                                                                                                                                                                                          MD5:802D288567DB59C8291BED3BF2269720
                                                                                                                                                                                                                          SHA1:EEE206358DC838170C1270147192AF57647DF79E
                                                                                                                                                                                                                          SHA-256:D64DF8FFA1040E3931804F2982048A532323CCFE8DFA9627B2F1DF3420D981EA
                                                                                                                                                                                                                          SHA-512:BD41A0A6ACA44D78C71E6B30A1433CB5A30ED7618F2D4B8FA1BE9674FBDC8DA3EDFFF2EDA07BC8989FC95CF551293F5CA3C04D8C8D12A7D07C4C4E4A833719FD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...J.A.....3.......-.`'.`%x...Y...j...0......B...E`..8...r_IY5p...m..A...R.]..g..O)vU.k.......C@.Z].|....b>.a.)d..v....m_w..m!\.=.cY......nz.. .....E.<.....P.".......Z=......8U..]..}..:M./N.N.s.-..I......~s....P7.s+a..2...sKq.0.Jd....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\entry-border-disabled-bg.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):302
                                                                                                                                                                                                                          Entropy (8bit):6.675572003130109
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPnhpQiUjdKcxAlK/Tufbtpwl9EeV5Ak57PrwDVJtljp:6v/7vh6iUpZxr/KjtpE9F5PrwDvN
                                                                                                                                                                                                                          MD5:A3BDB329C8D42F7A041E4DD3578843CC
                                                                                                                                                                                                                          SHA1:50FF9AB90A49650EEF14B2DB84F60836E29DE0DC
                                                                                                                                                                                                                          SHA-256:084A015DBD3A00E706C22368F4022FA6E40A3135E4E5F2E86F955F928BFA9865
                                                                                                                                                                                                                          SHA-512:C8612AC663EE1D517F9B9B0B4077C3992E0DAC55D4EABCCAF0D69C8240ED8D7A2A9F3C6C1065ACC6DE62031540D48B2A4E26681F0E4DA45525CCE4B1A917F14B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...1..0.@..` ......$..Ej...R....)^lyL..11.H..3.$...:.4Z.kLLs..{.Z......E.1@.:.....^.p..{.{...h..{m...pfd..D.1....T....@......}.*',[..Z.H...ye..a.Y.f.a9...+.s...TU.2|IM....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\entry-border-fill.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 5 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):154
                                                                                                                                                                                                                          Entropy (8bit):5.4583183202005126
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlgbllt1rtxBlly+r3U8G9RthwShLKOWGEVwNsewOaaLVl7uvYiXsup:6v/lhP+h1QiUjdKcNdwQLKTp
                                                                                                                                                                                                                          MD5:AA97D02943BBFDCE697E983924EBE3DA
                                                                                                                                                                                                                          SHA1:C210CACE4923F69770C1C4CE2F83952FD81625AF
                                                                                                                                                                                                                          SHA-256:BE1A186D0FFA8DD254E690BA6507555370091FDC727D38C8E52EDD1FA1765480
                                                                                                                                                                                                                          SHA-512:C333F5DBACF27FA39D7BD9760D816B4E69D8E9274886E5B812891CAA20D7D5C30C05D9F3CFEF219E274AD1C1B8AA363E6EA379C0A998CBFBD82C5ED776E1A649
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............2'7.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..c......4...0*8......,........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\focus-line.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 5 x 5, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):165
                                                                                                                                                                                                                          Entropy (8bit):5.490449038206444
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlgqTAlUsrtxBlly+r3U8G9RthwShLKOWGEVw4sTv/jDLJBND7ekLZp:6v/lhP+qTAUsQiUjdKchTv/jDLDl7pLX
                                                                                                                                                                                                                          MD5:6E16F000C55737E4D6286D755926064D
                                                                                                                                                                                                                          SHA1:9BE0EFB7492EB2EB7429D0C95154AF0452684549
                                                                                                                                                                                                                          SHA-256:6189F4054D8494CA1C64D3139C3B41B5A1518B002268E409901D12C885A2E583
                                                                                                                                                                                                                          SHA-512:9EC685D5F183857FE4E29206E6D0B6788FCA654CEB09A16C5D975DC495E73858F6651F611BC42A2C2A3C41E363AA477DE4A010F59F552410651C68A3BD845DBB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............o&.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<...."IDAT..c<w....t..x..5L.......2b3..^.....D....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\frame-gap-end.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 2 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):149
                                                                                                                                                                                                                          Entropy (8bit):5.369203613981836
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPltXlvrtxBlly+r3U8G9RthwShLKOWGEVwIshkxhFxmEldp:6v/lhP/1QiUjdKcRhkXFxmETp
                                                                                                                                                                                                                          MD5:C147BB9D3A8B19AEB47D9832F2DDDEB6
                                                                                                                                                                                                                          SHA1:9F73BE64D3097770B6AECED7AAF0CF86987C5BC3
                                                                                                                                                                                                                          SHA-256:423B0EB57E0A122D004B44295B447B5A270B25748E527BEC77C304B9261439BE
                                                                                                                                                                                                                          SHA-512:92B853C7A783F724C3C23C9569BBECADE57B220A73DDD678A8CAFE5968AA9F478526D4D6E8B2203E1FB3FF4224F66B26D6CC7B92B22AA06F10DD2FF6CFB7650E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............."......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..c......?~8.. Q..!.C.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\frame-gap-start.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 2 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):148
                                                                                                                                                                                                                          Entropy (8bit):5.3605022097805115
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPltXlvrtxBlly+r3U8G9RthwShLKOWGEVwLACB4s6ltjp:6v/lhP/1QiUjdKcLAEajp
                                                                                                                                                                                                                          MD5:99157988B7BC16164F00B6FD459985E3
                                                                                                                                                                                                                          SHA1:01F61CD67954C18E45BAEC9030CFA61BA796B992
                                                                                                                                                                                                                          SHA-256:54154FC5E3A3234A3A01F9B1539851DA901B98ADD2D941B5795C0CD75212EF09
                                                                                                                                                                                                                          SHA-512:4495D31F95C7A66026DAF28FDC4B1F61E0AA6074D5BD02D0B796507CF172CF15AEB1BD8BB23309B2651B48C4236B37573F8E9C19001FED147A447479C505EB38
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............."......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..c.~......~.......m.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\frame.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178
                                                                                                                                                                                                                          Entropy (8bit):5.641907236720765
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlH1tjar7prtxBlly+r3U8G9RthwShLKOWGEVw1sewQ+rAkUnjjINgk:6v/lhPUnpQiUjdKc1dwQ+rAbACSp
                                                                                                                                                                                                                          MD5:FA7B5A80EAF36A25729F19954F3C813A
                                                                                                                                                                                                                          SHA1:67ADF2EE64A20FEF0D940E684F65D52BF9F74355
                                                                                                                                                                                                                          SHA-256:70D498C2BB77A554578D2016F39113A3733FBD08D0364A936FD3D76CE3E4B300
                                                                                                                                                                                                                          SHA-512:1008D0C52657DDE79709E2E3AEA3B8B9FB5C292D456B4041279E390316756A5999BC24199E49721CAE6FD514A81E9FB147921473737D1355A5A5F1BF87A35209
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............2.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<..../IDAT..c......".........^E..<``".4..........N......T.s.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\handle-h.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):160
                                                                                                                                                                                                                          Entropy (8bit):5.541366322616081
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlJtRgllvrtxBlly+r3U8G9RthwShLKOWGEVwHAolkr1qdGYmOjp:6v/lhPA/vQiUjdKcHA4g5ijp
                                                                                                                                                                                                                          MD5:D45CC744BD8CBBFF8EC6D395E62A38B4
                                                                                                                                                                                                                          SHA1:C7198743D50F46C530E468222E2394AB33ADD2BC
                                                                                                                                                                                                                          SHA-256:08088B0C0182D08CA04691B0DFA1B745484FFF3CF27A29C5CF6440D5CAF7827E
                                                                                                                                                                                                                          SHA-512:495AFEAE1342FEC1DC23A8EAB6787E0B2CACA2053B00FB05CECC9D11028EA768A1BF524BEAAE9F33CC896BE495A90976DC321C30E80E3EE0FDE9DE05E0D0735B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............B:......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..c`..._{....g...C.L.$......?[.?.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\handle-v.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 2 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):157
                                                                                                                                                                                                                          Entropy (8bit):5.468097267717534
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPltBlecSnsrtxBlly+r3U8G9RthwShLKOWGEVwAsOVFiUlPu8dp:6v/lhPqDsQiUjdKcJaxjdp
                                                                                                                                                                                                                          MD5:794A4B60D5D77F64C1BB275FBAB70D61
                                                                                                                                                                                                                          SHA1:F173C5901C6A4FE3E3F35519E01AC5430C2D56E7
                                                                                                                                                                                                                          SHA-256:914D49E59A02AC480BD4845B449A2E62F921281384C449EC77D723FA145B34DB
                                                                                                                                                                                                                          SHA-512:10F5B3F45E4685B832124AFC696F2ED68E8D1EE665D4B0DE3DDC25E449C497DE264D58D491D3D5D7426A3B98B94B9F409EDE4FD7EE5A0BDBB33614C6756C996D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............,.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..c` .0....?.....*......W]......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\inline-toolbar.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):193
                                                                                                                                                                                                                          Entropy (8bit):5.790152992978564
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP3QiUjdKclitSKRq0yRyGXjjnwpTp:6v/74iUpZAqZ0G4p9
                                                                                                                                                                                                                          MD5:D8AFC1E5BEE1E6B540548D8106BE4E6E
                                                                                                                                                                                                                          SHA1:9F4A3C2C37328CB01062F96DB692ACCBE2436435
                                                                                                                                                                                                                          SHA-256:EFC691C1726A65281DBADF6328F55D343FA0221416F3E8C24CDFE4D3BE623673
                                                                                                                                                                                                                          SHA-512:30CC7B3611F2DA8060D3419042B40189A824C22AFF646E533E42BD146BD2F59A86F70CFC457120141F362C85B2D54BD347FFCF2CB10B5C75B81AE8EE9F337473
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....... ......^.8....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....>IDATH.c.....a~..Z....00..d$0j......Z0j......Z0j...#.....H3.V..7....f.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\labelframe.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 15 x 19, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):5.882473627728492
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlZfSlKh/rywOiXM7Ge/HR9QEC3kiryxUXZZ0g7QOyKF3TqNJ1Br/+Y:6v/lhPLuKhmUMR4ECv5Kg7byKxTqNJfn
                                                                                                                                                                                                                          MD5:FDDD58D7171DE7669E3C94E8CE8AFC9B
                                                                                                                                                                                                                          SHA1:E6E5F0CE1531ADB4A0A42299B03A8B178223813C
                                                                                                                                                                                                                          SHA-256:94CB2A37F25BFD934572D115DB4A319DFC24315CEB11286A9FA3F375A6B4076C
                                                                                                                                                                                                                          SHA-512:1F49B6514CD1DBD3617E366059579D870A951C9B81641C6D054E995F103E3BF0819E2C8F1E38778142226236AB91643AB7042A18E90DD82D7B023736295D6391
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................pHYs..........+......tIME.........v.....tEXtComment.Created with GIMPW......3IDAT(.c|...........,.?~... F.../..H...GU.-.,.dN.j......N......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\line-h.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 2 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):152
                                                                                                                                                                                                                          Entropy (8bit):5.263191437710063
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPltRt0LCsrtxBlly+r3U8G9RthwShLKOWGEVwPLlnjerF/llyPbSTp:6v/lhPI2sQiUjdKcPRnjyFtlyDGp
                                                                                                                                                                                                                          MD5:087C8BEBA995EAF2888940E00BD92E6D
                                                                                                                                                                                                                          SHA1:86FBE2F0B04F5B6F7ED1FB966223955B689D81FF
                                                                                                                                                                                                                          SHA-256:0036DA9A5FDA6660578EF692274F3A41BE6EFD2BA8C2FADCDD6848EC2CAB3E52
                                                                                                                                                                                                                          SHA-512:BE4FA909BD855BAC85C64D8DB8E3502C3AB35FCF7BEA969DD1910F2B069CD4DE1A2038904756C3F1A6AC7D4691D69438D8585C5B5F6DD088A96A82541068806D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............r..$....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..c`.......g```...a..:l.F....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\line-v.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 2 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):152
                                                                                                                                                                                                                          Entropy (8bit):5.260623282936621
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPltRt0LCsrtxBlly+r3U8G9RthwShLKOWGEVwPZajj3pAlVp:6v/lhPI2sQiUjdKcPkfZop
                                                                                                                                                                                                                          MD5:013306B4185F4BCAFE15E88C9927198F
                                                                                                                                                                                                                          SHA1:7C0D0467C2BE606ADC012930D49EBCF4A487368A
                                                                                                                                                                                                                          SHA-256:10003FCAEC96449C39D756D94EDBD4FD532566FE95E29D28B09D5057650B3680
                                                                                                                                                                                                                          SHA-512:0BF578AB5A5C848CB01B2366DBF9E36C1D381A71C66A2938FB51D5261975C6B5A982EA65ECF9BB0FF9654AFD1CBBFF96E70403C3C4F7F5829F91314126081FF6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............r..$....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..c.........&.(..7...=.A,....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\menu-arrow-prelight.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):281
                                                                                                                                                                                                                          Entropy (8bit):6.6175772095310785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP+KUpQiUjdKcthkRDOD22GWYSJ91ZVcnnbvAe+7+p:6v/7tiUpZTsO19zbVGbv4s
                                                                                                                                                                                                                          MD5:775AB7E1DD40B630CD06FA517559C36D
                                                                                                                                                                                                                          SHA1:CBBCC974B373B6FE4501D328B217E8B2643AE2B2
                                                                                                                                                                                                                          SHA-256:8DEB89AB8B3387171E36790F6C95ADC622DADD7A46D90E1BD659AA61BEBF57AA
                                                                                                                                                                                                                          SHA-512:3EA5B87925F9F7C0220ECF568CC52E6DF38327D2600D5C9872AF2C4153A20BB2B11B79501D92FDDD1CA6A3D3724AF18FF3C8AEDD02B076012F81C54936F4F1D7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............1.5;....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..5.1..P.......0^.C{..L...$.$..F...-l..-m.K.$V.o...........^...(....I..g.}..5..........I....0y.,L.+.y."..%...7LG@.R...n?....d^.....b*..X......3..DG.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\menu-arrow.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):281
                                                                                                                                                                                                                          Entropy (8bit):6.6175772095310785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP+KUpQiUjdKcthkRDOD22GWYSJ91ZVcnnbvAe+7+p:6v/7tiUpZTsO19zbVGbv4s
                                                                                                                                                                                                                          MD5:775AB7E1DD40B630CD06FA517559C36D
                                                                                                                                                                                                                          SHA1:CBBCC974B373B6FE4501D328B217E8B2643AE2B2
                                                                                                                                                                                                                          SHA-256:8DEB89AB8B3387171E36790F6C95ADC622DADD7A46D90E1BD659AA61BEBF57AA
                                                                                                                                                                                                                          SHA-512:3EA5B87925F9F7C0220ECF568CC52E6DF38327D2600D5C9872AF2C4153A20BB2B11B79501D92FDDD1CA6A3D3724AF18FF3C8AEDD02B076012F81C54936F4F1D7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............1.5;....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..5.1..P.......0^.C{..L...$.$..F...-l..-m.K.$V.o...........^...(....I..g.}..5..........I....0y.,L.+.y."..%...7LG@.R...n?....d^.....b*..X......3..DG.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\menu-checkbox-checked-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):400
                                                                                                                                                                                                                          Entropy (8bit):7.049290028617814
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7iyjiUpZo05ZRqovDltEj0+sKXErNNyLAl8hs:+iUpfLXc0+ErTl8a
                                                                                                                                                                                                                          MD5:B809DA26AF52E9BB98E8546C88A735FB
                                                                                                                                                                                                                          SHA1:818DCDD8EFDB038EDD443EAAEB5C98BC165A9373
                                                                                                                                                                                                                          SHA-256:FBB511B62600CE2B74E6EBD6468465B6A4629187653A323954A059631AD23B48
                                                                                                                                                                                                                          SHA-512:3EE70B834C56E99EE43BCBB69C50D0876E752A7762540EFE9D07216C51F89D9EB840FEB82423F4ACC6B733D8704B2262B350AE7D1E1F230F2461813855ABCF2F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............r..|....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT(...J.@.........[.TD...\}.......R.Q..[.j...|..B.!.. ...wN..V....}.......C..)..uetb$.%4...B:.......r.X.?...)In.j4.6.^.-...$.f..ksrP.&f....M..[...%.......G..[..mz.*..v..#.....}^.?....N...N..D..aH..rh.jz..?PH`.):.A...>M5..G.Fw.........o..?.W..'....(V,........O'.^..D......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\menu-checkbox-checked.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):383
                                                                                                                                                                                                                          Entropy (8bit):7.023197955341232
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPfCysQiUjdKc3xTccVtAeDDN7+4GDGhvmnscAfspKcnGAr0Kxp:6v/7iyjiUpZh7H3R64AnscAhURHf
                                                                                                                                                                                                                          MD5:5DC9350FC78F3F165D8B37F1B8DBFD15
                                                                                                                                                                                                                          SHA1:8B150863ACA96F744E9C91DF6110C1460C99DB12
                                                                                                                                                                                                                          SHA-256:429B24DFFEC85D5CCD83552D2A2FD081892D0A9A1306AF9E116262B9E2D92B45
                                                                                                                                                                                                                          SHA-512:1EC7395C898A9C6E22974CEE0D1070AEB1C82033368BF164053731C424D224588D6F926D34841BE99424225623B9D2E378EBBF89661ACBEA95C975508B49AC05
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............r..|....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT(...J.P.....*.......EDpw.\...|.,>A.j..AJ}.Q...p.6.4E..B..:H..........J..Z'R.......)"..'.p....7kR[..,P.-..8.[K."..t...e...:....E.O6X]Q.Nc....M.z.c.1j.........i.+TK....9......x.e.Z.L.%.`!.8.......T..#F....cJ.n.....)..9.P.........V....|....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\menu-checkbox-unchecked-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):246
                                                                                                                                                                                                                          Entropy (8bit):6.344771165982229
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPfCysQiUjdKcpmLiB8v/Ik2DkxvQ1p:6v/7iyjiUpZpgXI3kxvI
                                                                                                                                                                                                                          MD5:328315E60199B4D3663E56AFCECC31D1
                                                                                                                                                                                                                          SHA1:A9D0D84D66DC5A1646B1389C9D41581C55C32142
                                                                                                                                                                                                                          SHA-256:670CAD00961E12B7C66A49394FE942E70B21579ABAB7D4DF815877DE59FE9C7F
                                                                                                                                                                                                                          SHA-512:311E39ECF1A3363BCE173FDFEC7C0DE7CB59C5B1AF63B01CCA1837B87C7EE0BA71835842DF0EC3429B6F10AE69774B20E94284EB11F658AC18793E6FA8BEEAE2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............r..|....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....sIDAT(...!..P.@.7s..........S..A.f..9.<0c...L......u..AM&......Rs>N..E.....N.A]....................Y.W..C.9.Y.QE....(.2ew.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\menu-checkbox-unchecked.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):236
                                                                                                                                                                                                                          Entropy (8bit):6.239056081023515
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPfCysQiUjdKczNV02EOt4lIhXsX0CPydp:6v/7iyjiUpZ/rh9hXsX0C6z
                                                                                                                                                                                                                          MD5:38D5F363136E816BCD0B06A71311089A
                                                                                                                                                                                                                          SHA1:DDA58D3C8A0A1759275872214824604805367129
                                                                                                                                                                                                                          SHA-256:69ADD349D3FD81D2EADD4977612BFD58AF268EBEFE59570F352705563D76A77F
                                                                                                                                                                                                                          SHA-512:5586374CC9CB3B9838F779A51039A486D4CF96D85D3183581736DBE4541004CC74D6434CAA01175F6E3977DD48F72A3937364E2EDD8CFF6A667B9E79BE7793E9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............r..|....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....iIDAT(....0...Yo...F.!....@....&./}.^G...t...D...5'.DX.k..@.5.5.....rA..."..n..RZ...7p(.4.6o.<:...Z.GDPD......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\menu-radio-checked-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):443
                                                                                                                                                                                                                          Entropy (8bit):7.159663777948101
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7iyjiUpZtwxrNzSSIIYlgynDtOnFCau84Vz:+iUpjNlz8FCa7I
                                                                                                                                                                                                                          MD5:6BCA81C806910D0F8851A9169207FC23
                                                                                                                                                                                                                          SHA1:6F8F2E3EE9A363C7D52AE8375A13673EE15CC1D9
                                                                                                                                                                                                                          SHA-256:924CEDE0108781A3B4BB6AD3988788290CD87A20C45975D5EE63CA98A905D082
                                                                                                                                                                                                                          SHA-512:7EDC020336E3C08900D1FDF1B1428BCEE086B1D8C647046B2738D0315BE848042A6BD1BFB30F4E637EF043042DEC14EE5145CB533E3F8D213439CFF7C0DE8AFF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............r..|....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....8IDAT(....N.Q.......(@c.n,..R..5.B.aM|..ACx......-mV..bB....@t)...s.....v.v.je..D.bn.j...p]..>..j.b.g..sglAL...t..z.....L..}...d....@..%.qU-...s.8~5K1..e...0...........W...R..J.0._.n..xjB:*.s.v.".V1fQ.e.`Wm..t...4..........9..d3..q...P.N..x...q.6....o.^.d.....\....U.4?.H......3Zsq?..H.........4.........~)j......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\menu-radio-checked.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):431
                                                                                                                                                                                                                          Entropy (8bit):7.205286586384325
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7iyjiUpZZaqATzlHM6VNKd8G79I22p:+iUp6qATqKNKdv79z2p
                                                                                                                                                                                                                          MD5:CD8A06041E8CEB743274EEE2E73747D7
                                                                                                                                                                                                                          SHA1:ED87F561DFF76373087FBF9EA7BA3C11F2622626
                                                                                                                                                                                                                          SHA-256:EED90D7B8937ADB56CD41388F48C9DCF94263C5561A44263A35EF9912CDE113D
                                                                                                                                                                                                                          SHA-512:E42C41F4AB7606AA55CEA4971B84F55401C4370B44852944D2FEC1FA24404378390041F799DC1814634C3E7D11B407FDB7546D71CAE3F56D1A35A2D5B44BB83C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............r..|....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....,IDAT(....N.Q.F..,...`!Pa... .7 ..P..w1...`...v6.j.4.oa...X(f...t..w.mF.Pp.9\..2.*.Ch.8..dc.....c.?....Y....-_.lO-....U........vN\..M.b\v-.....V,.|..x.....>..1......%;.fs=D0 l%B.{.....z.t<.k...3.5@...O|....z...M*.#Z.1..j.q..E.!.goY..X.,CE..l.P...sSJ.....-.....A....hN...........4...NR...'M.h..R!....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\menu-radio-unchecked-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):482
                                                                                                                                                                                                                          Entropy (8bit):7.190576605014764
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7iyjiUpZqmiKFxrLr1/SZgWA2XEQwhFM6kXs5F5c:+iUpEmi0r1SOWDUFMm5nc
                                                                                                                                                                                                                          MD5:45D0255BBB899D663D216D28275D629D
                                                                                                                                                                                                                          SHA1:B9F0910A560FDD0EECEF9FCF0B14AF9E4FDFB91F
                                                                                                                                                                                                                          SHA-256:EE548E8AF142071B7B00EA74A303AAE945A0FC89708A36620AD59D50CF239B5D
                                                                                                                                                                                                                          SHA-512:79CF8963BB59A59A5F0B50502225B944540B66A2EF109B1FE50085122BB056093E1A6AE7BF9D78F52D94A0882525F9C3EC751302B9001A39ABBF5C915BB2D814
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............r..|....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<...._IDAT(...MK.a...s_g.q..R.#......v.'..'......... ..&Ie...G..". B..r....~..q.sY. ..:.C0.i&J.\.....0.x...[[..A...45.@.0r]..z.2..Z8N...$.x.._n...L"....o.F...............2....V.>]._...e..`.....7..\T$..i..Bij..b....O..`....!.NH)G.`!.5..{...L.]"....R.=..0]c.f.BPI.r............Z...Of/y+.X-.j....I6..B...]J...k.N..r.J....c..Br..L.....k.T.[....!...X_.[....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\menu-radio-unchecked.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):480
                                                                                                                                                                                                                          Entropy (8bit):7.251123217936778
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7iyjiUpZwi4v1PKleuaSDoS219omhPstHl66A2NWi:+iUp+iI9KlpL2Xz2Nl7wi
                                                                                                                                                                                                                          MD5:EDC126961D3780FBD94BF344715737E9
                                                                                                                                                                                                                          SHA1:1059B2B38EB1EB4BA9F66F60254C401B03234B4F
                                                                                                                                                                                                                          SHA-256:341DA4A13662A85A03E76E8ACBA8CB48E836BA2150F131D52575833A62A261B0
                                                                                                                                                                                                                          SHA-512:69C82C4A1341584355E0E725D78C360CE9B6EE401315DE17316FDB1122D4517F56EB9D54FE78F0DE340F94B21127840204C2805002E68D24D110FE8D669021BA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............r..|....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....]IDAT(........E.7F.Xh._'QB$b.Z*.x.o....L,...(.,Z.m$..1.2#.2:..hbA9.{r....8+.....@.4.<....=?.8h..`wW..He3..Z..bN_O...q....(..x........e..8-.[.....5....../:6...R4bn.N.%.~~AU...OA... k...I.....+V.%iS ..1...7.=.L..q..9.C.. UU.....P.*J.......j.o.%.5P..?..tn.^.xI........x..;y.Be.......p7...H..8.S"2.J....u.d..N..F...Fm..."-I....Q..,.....a;..K8.;.r.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\menubar.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):183
                                                                                                                                                                                                                          Entropy (8bit):5.746935515426793
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlLttZXrtxBlly+r3U8G9RthwShLKOWGEVwuBxtZbwicgyRyG/jQljp:6v/lhP3QiUjdKcmp7cgyRyGkp
                                                                                                                                                                                                                          MD5:ED3000C7B6CFDF81103A4EE4A78F233E
                                                                                                                                                                                                                          SHA1:E3E17AE9F17E9464B65B15E43B26E4F8F7BCC2E3
                                                                                                                                                                                                                          SHA-256:B7377F655E1A1380822C17E64A39BC98314491C459C5EE7969AB9A9713EC0E50
                                                                                                                                                                                                                          SHA-512:46809FC02AAA65D6F77FD14E07210970E77FB242DB7C7436DBE0F944B9C382EF05E1CAECA64E78C53CC855738A270C5865CA78951CC4F4E2DAE90DA8AC740E10
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....... ......^.8....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....4IDATH.c|.......&Z.>j......Z0j......Z0j...#.....>.....;..q.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\menubar_button.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 25 x 15, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):179
                                                                                                                                                                                                                          Entropy (8bit):5.704359846403098
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlcwtZlll/CsrtxBlly+r3U8G9RthwShLKOWGEVwqKKTYjLG0erhjWf:6v/lhPJDp/CsQiUjdKcnKKLgpWBEup
                                                                                                                                                                                                                          MD5:B7AE3350BB82524242D0FE99AD266C9B
                                                                                                                                                                                                                          SHA1:6CD9AAEA1BEF760170981BC46CCCF7C0531996C4
                                                                                                                                                                                                                          SHA-256:1C1A8EDBF80E9C01045941CBAC8A54B1FC37ACF5FA53FECE3A221FCCA1901331
                                                                                                                                                                                                                          SHA-512:4199FE699A0C8A1F9D7AEA2EB6E6C3DA867073639910816DF3A39E081ECC39472B8BE0038DCC0D972928FD7E06C4431021FDCDE3F335933CDC1BCBBBF061090A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............fd.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....0IDAT8.c.q...........uUy.Yp..C.&....F-..d.QK..%..N....Rp....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\menuitem.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 15 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):176
                                                                                                                                                                                                                          Entropy (8bit):5.747627646328724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlodllCsrtxBlly+r3U8G9RthwShLKOWGEVw3by+Kktz+V0FLvF++lN:6v/lhPKd/CsQiUjdKc39XtLpvoup
                                                                                                                                                                                                                          MD5:16D64F49C2C6DD107D3F3C466ADDE2CD
                                                                                                                                                                                                                          SHA1:C7AB7AE198E49F1D578349498145D2FCB8BE45B9
                                                                                                                                                                                                                          SHA-256:E2E2EB0E301B5927949D9DF2F64E0E75FDAB5D79164B03E1721F1E2484297768
                                                                                                                                                                                                                          SHA-512:40AA0709BACBC93895FA81AD2DE966BBA6D1B78330280D71EF94DF0B96C4CA9A3E2220EDE9C51ECD2E1C7C993D301D5D3ECBF9638865C9F06ADE6C5E473B0BD1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............Yt.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....-IDAT8.c|.....2......z....9.yT..Q.#Y3.o.....J..........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\minus.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):307
                                                                                                                                                                                                                          Entropy (8bit):6.801466418542564
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP8AMBsQiUjdKcxcClrWqxVnVLDEvytuxOLLf4BDJ3yTp:6v/7kAMBjiUpZxcYrFVnhDGxOHQNFG
                                                                                                                                                                                                                          MD5:82A68B0DCEB304A2EE257CFC236E1290
                                                                                                                                                                                                                          SHA1:F2E02E9E33CA962F426B9E05BA7532481E410E07
                                                                                                                                                                                                                          SHA-256:F9F3191B020BF48880FE6A0AFEA938640C39CA926D91939B9314C4030EE5C884
                                                                                                                                                                                                                          SHA-512:0937648FDE48C5B8E3EF3DEE75963FB7A15A862800A98939C51FCEFEB57EC2BF6CFDF9C84C68A661DEBFFB0E7515A799A6ABAB9927AF36B237970601DD8E4B04
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............w&....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT....A..P.E...(..AP.(..h.e4h..j..F%.............]8\..1...%0.@|"..T.#..}VTb"+*9.."0q..Ka..XP...6....V]..{X.../.W...X.g..D.. J...@.E$P*...{m......'......A.'R.O.\~..Cx.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\notebook-entry-border-active-bg.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):397
                                                                                                                                                                                                                          Entropy (8bit):7.12784252464124
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7vh6iUpZpH2ZybkF+dWTlsFKLdVh+P9Zogc:XiUpWobkF+gpRLSNc
                                                                                                                                                                                                                          MD5:B7AC01D42693C2EE4AF54721E7EE1D31
                                                                                                                                                                                                                          SHA1:FA7CFCF221B2B46C917ED5A0A4DAB5A75FF6EEE8
                                                                                                                                                                                                                          SHA-256:C51A646D0381B70F9B4D10A307562B934B526F8612D0C3A1A3D511C47AEB021E
                                                                                                                                                                                                                          SHA-512:DAE9A8A3AB9CD101FEBC3D37C251BEB60609F65804CCF255348FE9BCC18E3CDB35DC260E43C5EC87DE7D9D606214C5C19CB36AEAC4E397B42EBC920488761AAC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...MJ.@...g>B-....9..[...G(Up...+.#.....;.fU%g(..RH[...+7..d!.......C..*..x...)D..#.....W..(..... .Gn.y@..V}...G....A.<..z...8..q|W....?Wt.LQ.Y?/.&E/.SP.).z...Fd.4/.o.2...d...qF.......I\.:...e...or.-......h.{w5)zZ....o...q.......i.[....C....@l*.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\notebook-entry-border-bg.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):354
                                                                                                                                                                                                                          Entropy (8bit):6.883496196834352
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPnhpQiUjdKcFN5kW8tWI1lahmk+ZGhblx/bdCAN5xKgW3o12jCVp:6v/7vh6iUpZFN5Wtn1AYZZGhRxzdCAN3
                                                                                                                                                                                                                          MD5:1AF59D510A290B61CFBA7A3F1256A59B
                                                                                                                                                                                                                          SHA1:BD57BADC013BE0F13158E34BE1F549AFF0773B07
                                                                                                                                                                                                                          SHA-256:DFD2E4A14AB9AE1EDD6CAFA79283CE958033E0E5E6A0C3BF44B7FA17451A37E8
                                                                                                                                                                                                                          SHA-512:9736F0F9C9FA14711D08752454F61C37C4BDC6C15A508A258D750ED6DFC992A48F986842EFDBF211195D0651B5C9034B20151A8C633E4D30BCDFA9957881054C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH....j.@...s..$t.2.b.....|07.P0.iF.CH.$...J)d=Y.s^.[...a.nP\.a.....#".q.....H.S.xw(.ge.Zk.D.....2.....2.....Y....Y.O..l.#...TP.v......R.z*HJY33....<.!.y.CO...\^.xeYfD. .#4.....[.~.I..'.2+.q..e..qB...(k..qn%..o.....`..M.J.w....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\notebook-entry-border-disabled-bg.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):307
                                                                                                                                                                                                                          Entropy (8bit):6.780532491571178
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPnhpQiUjdKcxTg/6JKMph77kU1EwQf9Iy7zDR6p:6v/7vh6iUpZxTFXP7oUaTf7DRQ
                                                                                                                                                                                                                          MD5:1A393037E20EF200FC49A8E9C3096BA1
                                                                                                                                                                                                                          SHA1:A95CEC344377432CD1FCA06112B3403A3797B982
                                                                                                                                                                                                                          SHA-256:75AB5EB7A036B07D38E9A1D60CAE01F43E388D02FDBE48DA0172996D29E6D410
                                                                                                                                                                                                                          SHA-512:22AB3069E07A70BA4D5713C1188230F7E6452F3E57B6331E93571D7058D00E19C3C51DC1C17CB019530A185DC77CC7972C437A35CE381FEB3A9C65B89B37CDFA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...=n.!.E....,.../1R.k...gx)."U*("q6.....{.\....*C.a..<.Yl..G:y...oc..J.x.'..||&.w7...=_.......}.]...._.b.+.-hA.Z..'$2.PU...P.5...c7...9R....9R&.........w.Z!.=7g..K.R.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\notebook-gap-horiz.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 4 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):154
                                                                                                                                                                                                                          Entropy (8bit):5.2916559659730344
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlJ9tBGYtsrtxBlly+r3U8G9RthwShLKOWGEVwNsO8SFFFdbpHpH6XX:6v/lhPYYtsQiUjdKcNN82FFdNHpaXqup
                                                                                                                                                                                                                          MD5:452E7025CA50D4AEFE31EA9C175849BE
                                                                                                                                                                                                                          SHA1:5A115B592DB5E787B6971CD0CE0B34A964B7656F
                                                                                                                                                                                                                          SHA-256:1B4796FF96451B7191E068EE5899F3D4F5346998D50530A1F950F0B01FE8B0E7
                                                                                                                                                                                                                          SHA-512:D5F2C42572465B9E3D4E8DCB2067BE78E3C90646FC2B278C9AA342FC84A2E698283B4E4C3254D7F3FEC1A55507D2313546D621191C5A33042869D7F3F1FB6B5E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............}c....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..c````.......L.h...x...2 n....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\notebook-gap-vert.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 2 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):155
                                                                                                                                                                                                                          Entropy (8bit):5.242476082275629
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPltVlhprtxBlly+r3U8G9RthwShLKOWGEVwCuSlnja8CF/9akh3tH1p:6v/lhPfQiUjdKcLWnjLCFV53Tp
                                                                                                                                                                                                                          MD5:F75C69C46EEDEB4860001A3DF84A31DC
                                                                                                                                                                                                                          SHA1:4B62EB896C3532DD5F88C639AB10AFB2FA0302C6
                                                                                                                                                                                                                          SHA-256:7D8BCA3EB989F3224F88313826F5000313878DB281FCA2AF4946AED64BF1C86F
                                                                                                                                                                                                                          SHA-512:ECE8831BC0CDAD8FB2CDEE4311129530BA267A6C9DF8D2FDC8DFB5A432C245041BCFF36CCAE05265056764A6652ACAC4AEC3DE5DCBBAFEA045E4D731CCF72E81
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................9....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..c`.......g````b@..b.....4|....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\notebook.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):5.773575793564763
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPljllafZuCG1ctAr3UiMX8ofjhpllNS5y3103C/FfXNDUUt/2up:6v/lhP2QCEci68ol3lNS5q03SZZ2up
                                                                                                                                                                                                                          MD5:B3CDB0C10EECC44ABB9518C9F3F7BF26
                                                                                                                                                                                                                          SHA1:11907563B6634422990DDE5084965C0C68BB6478
                                                                                                                                                                                                                          SHA-256:622BC109CC375A3D1DDD6266239CC7F35D7F5E8CF3601CD67B23183DC3E6C833
                                                                                                                                                                                                                          SHA-512:CD7C911FAF3FDFA2D690BE28EA08A98F2774C8CACBDD6C730C2E18FBCF94CFDE2EEB874FAA80ECA25873C8D7042A3E57F6B0BEF28C5B934F9649CA701D13722D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............;0......bKGD.......T4.....pHYs.........B(.x....tIME.......'G.....EIDATH..... .....`../.........$.|.4.:.P...j(j...)```````````..w2.........1q.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\null.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):148
                                                                                                                                                                                                                          Entropy (8bit):5.2810647672028175
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlJlawvlpgsrtxBlly+r3U8G9RthwShLKOWGEVwLAgFCSWCLWlp1p:6v/lhP70wbgsQiUjdKcLABCWbp
                                                                                                                                                                                                                          MD5:93DA3FB2A75EFE8103197AD63FCDEFE9
                                                                                                                                                                                                                          SHA1:6E81CB91929D02BE577D518AEB620C482AD0838C
                                                                                                                                                                                                                          SHA-256:D548729454E669C9F615623BF10F239700C306CE7F3073ACFDF45F1B63C048DB
                                                                                                                                                                                                                          SHA-512:38893CC9FF5EAC01678CC40694532CA8055A06F329EF91B2B29708554792ADAC9CF35B108BFB87DA0C4C5526AAC602614278471E8F1F488BAD83A3D84275FA9B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............;.J....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT(.c`...`..".......,7....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\plus.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):294
                                                                                                                                                                                                                          Entropy (8bit):6.573744637174437
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP8AMBsQiUjdKc5dGTS9OQ5NEZ161BAyA1ACV9ZlWvDYTSc/jp:6v/7kAMBjiUpZ5dm1qNEZ1zT1F/TZ/N
                                                                                                                                                                                                                          MD5:62E91ABD2E724BB57F0B3BAB2DACD83B
                                                                                                                                                                                                                          SHA1:C94AD553972717AE09C3F02053D1111DBE95A416
                                                                                                                                                                                                                          SHA-256:27B212F8C62BC329EEED2799E2D769F151149C3800EDE29001523FA1CE2D9042
                                                                                                                                                                                                                          SHA-512:92CDF06EFDF27756F85E6AD79C6AFAAF098F68CC8AC08A73C98FC3B2F38925D9FA6DD953CEF953F80ACAA3565CF9EE67FBF925C11093658D6A2D79CEF6D60555
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...............w&....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT..c<..Y..#C....;.n.......g_.|...........}fb``...d.c(..T....d..X5aU|..U..Y.M.).M.e...f().@(8.....b.s0.._{...3....:......._...n..|..........#C...o.... #...............IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\progressbar.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 8 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):287
                                                                                                                                                                                                                          Entropy (8bit):6.668202444123687
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP6qsQiUjdKcXJlQlTUDn9IW6PGeS3ZDHREup:6v/7tiUpZPQlMn16+Jz
                                                                                                                                                                                                                          MD5:20BDC1473174BE881ACE703EE9A1CE99
                                                                                                                                                                                                                          SHA1:60BF6C947F8ABF94D22D2A3DAAC818B7E925C9FC
                                                                                                                                                                                                                          SHA-256:16EDCF662E60FE9C06F35B8B86D53A490C58A97C5A542523BB6109E217FBEF03
                                                                                                                                                                                                                          SHA-512:10D43638C96C2B9A67C907E4AA4F46362F3E7FFE45D6DF45714A0493A1E1DABCC400225B7939C164FAB977A3C68DF6B73E2B2314A1C3C4ABD4832599D68705A5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............._.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT(..!..P..gw5.....YM.AoQ.........hD5g.........$$.hD'yj&O...K.+=~..HcbE..dU.x.3..Moj."V.$@.a....NX+.l,...|3.S......7E....Njb....U.n.....R.........fqy...)...t8....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\progressbar_v.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 30 x 8, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):279
                                                                                                                                                                                                                          Entropy (8bit):6.642932539150523
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPf/CsQiUjdKcGxKBnkAWqDaJRBLOTVqG7wTejeJBp:6v/7KjiUpZG0GA+8TL78hp
                                                                                                                                                                                                                          MD5:186F38C260DD945B8B9AFF7A248D96AE
                                                                                                                                                                                                                          SHA1:CEA446BDF199327C98C09B3A38FC44DDAD07F61F
                                                                                                                                                                                                                          SHA-256:E58A83E2836540E2BBBFA28637E83F0879E970B115883B1250B090A3F9C36385
                                                                                                                                                                                                                          SHA-512:0F3CE713566B705256B0ED5C748C6F1AE1F0AF6E16D5EBED3E19407A53DE3375DEFDF11BD06F11757C87B1F600324FE1F95E1C4E35C0590D3B05223592BE0573
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............O$....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT(.....`.E.s..$.0@%...A...`:....4...f...K...>....,.%G.e..7A.@+.)>H...Z?T..<.w [..kp..7.Q.l......m.{K......p..\^.CB....U...5`\J.......6./..)../......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\radio-checked-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):490
                                                                                                                                                                                                                          Entropy (8bit):7.274947673010178
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7wiUpZyyRzK81dPguGqVO6T0yXbcY+ti+K:XiUpMyRuudIuGYOGgFi+K
                                                                                                                                                                                                                          MD5:E54565856297F745FD6C846DD6CB8CEA
                                                                                                                                                                                                                          SHA1:0047FB6C8F016B9C7CE5887398CB82ADBA6C3262
                                                                                                                                                                                                                          SHA-256:29C46581308E52F858E0AE79B3501F99D8056356F39D211A2E7C75F9830FB5E2
                                                                                                                                                                                                                          SHA-512:80726AE3EC22320FCC134B9EDF84D7900DD79440E9B2BAF6D5A8B0D90082AA605ED799521753955D8DB986419353E10CCCBD6F55F264E36B2CC2B97F824EC918
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................a....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....gIDAT8....JCA.@..F$....h.b........F....?.. 6.E...........c...D....7!..Y.=sXf..!...x.{e..R..~.+9.(.x..L.6.,g..j..t7...\.bw.6.X...;.53.X.u.1........h..t...f&.l5.......o...X.=........E....o$9^O23.e;e".`......I..H.cl-&.........U... ....2e.F.qt.I.....P'.'....y..y..T@......-.T.7...]....q.fE.._...d.F.npV..S..U.3aBE.$...0..Hg..k.....e2..PP........1m..-ic.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\radio-checked.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):464
                                                                                                                                                                                                                          Entropy (8bit):7.23966325832047
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7wiUpZQnxVqi7UGSgHT5xiSetyKxr6m+V/DquyGk371:XiUpOxVqovDiSCv0D/f271
                                                                                                                                                                                                                          MD5:EE8C4B99F5352F4D387F54376FA4DFEB
                                                                                                                                                                                                                          SHA1:7E9CF915121F199279428107579E329BA408D8D5
                                                                                                                                                                                                                          SHA-256:5CC6BD3265394B9B88E795640CCCB8088D36DB9CF01F3A64E39A771CCECFE7CB
                                                                                                                                                                                                                          SHA-512:2921C72DC695685D089F1DDF5CC8DA0D85193470207ED86661174F84A998CD754340E8CFAFA3AA430B0F9C1CD9C00F05BB7431E1034D2F7F7A9D1721D51C6529
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................a....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....MIDAT8...=KBq....U)..."..r[....+A.9.$I..G......h&h.~..@!......^O.&.{.....;.y...%...~u&.........#r..vi/V..X..R..@d.>m...;f........RT5U..>..}7|..D..U.......8. ....^'.,....G9^..`...h...y.....c.S..L|...b.......P...+o.6.^..G.7. .V...*.E.w.n...<{.n.R..8......~......b5.t...y.....>.....3....L..^n...=.]>...'.E$..\7%.t...........r...7n....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\radio-unchecked-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):525
                                                                                                                                                                                                                          Entropy (8bit):7.350881538377302
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7wiUpZS80763mCncWP40MIARdkDb71CR:XiUpI8cYPXtrAgDb71u
                                                                                                                                                                                                                          MD5:114D3061D8E0547D6ABE596F0530EA37
                                                                                                                                                                                                                          SHA1:489AFA3530281E16CB657505CD4D5F0A41ACC8CB
                                                                                                                                                                                                                          SHA-256:897DE2E8C1252EFE52DED313D1103FF014845C615CA01594F0E0BCDAA54E9F5B
                                                                                                                                                                                                                          SHA-512:B8D535AB3CE0E541B9EFEC5ED95CA88A401BEBD37231A3F9459060E63971071BEA59F5269C8A95597254506AAE7D4BB63F6C97ECAC0A912EF0628802D421F1E2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................a....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...AO.A.......[[..z............&../p.Dd....&...)KCf..1.v..i2..|.7...F.z.....;......(G.;....Q......t:....Y.4..:..W.d7.....l?.{$8>......`.{....$9..>....;[...~..=......6.w.o..x.*.K...g+.R...%v\..f...f... h4.f...(x...]......h..Ua@k.R.}.._E.f.R..8](.....dY....2.q)0b....P.d.lE...:4b.J.n.-r+......$V$.x..r+..(Z......._x.>..t.z.t...W.Yf.............gz..../s.jE....zp.r}8...~...=..!l.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\radio-unchecked.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):506
                                                                                                                                                                                                                          Entropy (8bit):7.185235844364227
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7wiUpZX4RkYB4VtnHMT9fNN+LwtvFRnuP:XiUpTs4V9HM9VN+8tvFwP
                                                                                                                                                                                                                          MD5:AC177160C79C86482F32091035C834BB
                                                                                                                                                                                                                          SHA1:31025BC978413B278E95EB72B5EA8C604B4A034E
                                                                                                                                                                                                                          SHA-256:5737CB3CB6800453B2BC5B4177C760A2F17861AA9E48A9ED3670BF85C3870E7A
                                                                                                                                                                                                                          SHA-512:C65AB4BBA039E5C61C8A723FEB91D8BDCC78784BBB2A3A2BB53254DB456E78CDCA8A1057C5B253118B155EF04B22010C9DE47179A109F1EEE14B57F16AF9FEE8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................a....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....wIDAT8....N.P...T..!.hp..b....-d.>..<M7..+q.. M(..cL.5.%....q.4.V.x.........S4o..S^.\#..@....p.0.Je..][.q.v|..^)..".*.?..L.y.....p..=0sGb..v.{hX...M......4m.7.<.h..t....-"*.PnviD....t.E....L*.Wx.l&.#..........Hl.......`..#..cV.6.e.%M..$.f..0...P... i.`8........x.2.t..]..x.2.d..4l...y.J....|c.....Ns4...B>.^..D..."r.....{))..^.p.#...=wE{.S&.......j"..E2.w..Iw.H./R...@V.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\slider-horiz-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 28 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):289
                                                                                                                                                                                                                          Entropy (8bit):6.673822398767412
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPetqlCsQiUjdKcFZiAU4VUA6vnrTpDce1oYT2kKVp:6v/7aqlCjiUpZuAUaUA6vnRDce1ckQ
                                                                                                                                                                                                                          MD5:C16BE6372E1DCE05CFBAA8C26810E9C9
                                                                                                                                                                                                                          SHA1:9B3F3AB39A40907B7BC5E678FFC0D3DD0B7E8855
                                                                                                                                                                                                                          SHA-256:5B1BFD34A355A8E78528403C2877858F3F9A7499775CC19E534D2A8A3AC2ED31
                                                                                                                                                                                                                          SHA-512:50AA4215EDCDC6E4D962E12FFFD146540FF7B1BDC138CCB00279A49BF91D3A69EFB5B711F008A73ABAC00FA5E67B2518BD0CDBE234DC71E3ED41797EA699BA75
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8..;..P.E.}Obl.l..\.{......d.n!.K..BlD..q..(i_.!....=..=...0?....2.RD....,....t....j..(.Z5'.@$.......kvZ.T.`...{..(.BgyW63...._e....L)0..........i.. .$...$.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\slider-horiz-insens.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 28 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):269
                                                                                                                                                                                                                          Entropy (8bit):6.633971970647611
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPetqlCsQiUjdKc5hkmolKARCBerlDPWs6VSeHhR35lVp:6v/7aqlCjiUpZ/OvRCoJDPW2ahRX
                                                                                                                                                                                                                          MD5:1CAE8ADE47C27C72A6D7C197A69F9F58
                                                                                                                                                                                                                          SHA1:2CA063D7F978C81840F1872ECA752080BFD37E03
                                                                                                                                                                                                                          SHA-256:E63D1574302475157A22EE4793CACD8B3260E3E1D92AF68D9B19943A44D7FB37
                                                                                                                                                                                                                          SHA-512:733C63D55B3877B85081A5D477B8DB15FEAF39A7B52A57885946240F34E0504E771248A864D316C6BA58A7C407B0154C057CB8A0AE5FDA5BD3B4AC393629588C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8..1..@.....v!...-.).....k..k."..yV...............h[-.{....J.....3{..]._..D.1......|....0..Y......$h(d...^.1....a..N..!..*O.|3S.>.#A.;.t....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\slider-horiz-prelight.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 28 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):271
                                                                                                                                                                                                                          Entropy (8bit):6.588320869647996
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPetqlCsQiUjdKc1PvyKKH0bhrM0jhjaHBleYOTp:6v/7aqlCjiUpZ1xbijHLeX
                                                                                                                                                                                                                          MD5:7E4467A335740CFAC459EE676A3827AD
                                                                                                                                                                                                                          SHA1:322EAA4E00D8306925B30B68BA5D3C7CE7F973B0
                                                                                                                                                                                                                          SHA-256:606F9F16D9B80983A4EF1E48EE99B04BE73B0F5CA5009028540A7BDDD927D210
                                                                                                                                                                                                                          SHA-512:9399422B83BCCCD95212F9D0AAE5BA13E4CF8BC88872C8465A8B3F8CB65B0A6B645A6F74C22C5973ADF72DBAD941B1547A80F467238E071528A592D142E36779
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8....0.E..H.#...R.S.h ..x,.0...\.l.Hy)........#%..../(........|.!....e{#Q..8.z....V..X.1.d.}..!....l>.]..n........B.pu.E^....$#9.&...i....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\slider-horiz.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 28 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):281
                                                                                                                                                                                                                          Entropy (8bit):6.680570850984325
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPetqlCsQiUjdKcthk6zDBR4vPyRtcQBngy9Jp:6v/7aqlCjiUpZTX4vqRiy9H
                                                                                                                                                                                                                          MD5:55D57D73D2AC40FF7F0F6CD0993ED6C8
                                                                                                                                                                                                                          SHA1:3CAA1CE814CF522F9BFBEF6F4FC9C6215140F1E7
                                                                                                                                                                                                                          SHA-256:043E12CB492C67AF008F6597F4B3B20232B4F214573B72F8637FB8A8E2CFAC75
                                                                                                                                                                                                                          SHA-512:17F4F79EC534BF5C4B02929578F6BBD6A204FC74DCB0F5B184267F635100751C48511411BFEB8A390FCDE9BCA69E513CB2AD09AAD54E76A29DD21226AB0A0CA5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8....A....V.B4..`S.x..A.Q...Hh.$.a.....l!.:.I.W.h.w.B.......R.U..=....+......-.g....b8.+..(..(.....b."hS>...B.7%.J.N...m]....t.G%;P.=.7y.Z~...&.........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\slider-insensitive.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):521
                                                                                                                                                                                                                          Entropy (8bit):7.342760006204656
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7ZgjiUpZLOVE35gGJM1nRmaiYNpfSkxOdLxECG0U4Oc:86iUpAEpJM1nRmkNpfSkWECGBc
                                                                                                                                                                                                                          MD5:34B6EF4272675A089BA5F894CF1DFA4C
                                                                                                                                                                                                                          SHA1:789F2276435B5C0645DDA6270271E24774AB13B3
                                                                                                                                                                                                                          SHA-256:5C1838ED408085711ABBDD5125E749E196BB8E5F6995785126DBE2544D94932F
                                                                                                                                                                                                                          SHA-512:0A3715F16F0C3B4194C80BB1F3B02B8C2E3381F58DE2558DA2B3AEAB641766E9EAE9E10E532524D0BBE2767AA81733C21740EF85E85C74543E62C5A0DCA91862
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............;.J....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT(...Qn.@..gf.n...ENEJ9D...p..3$..r.....\!i...F..+.k.L..#T)!|O.fV3?....D.Q~.._.......#E?I.f....C....q.:..n).4.hm".D......K.......?....y]..6IG#...^.E...}...f3....}".@.kL...T0..E.Q~.2.bC.k$....^P.....{.nl4.0!...H....B.#...wM.....4..c..df.B...r>.7vp>."uO(p...."..y .A.Q...E...8...z...g8.....Q...t..o~..^...QK........M.SR.vc......dM-..<=..............Q.*........n...............IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\slider-prelight.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):457
                                                                                                                                                                                                                          Entropy (8bit):7.27429121454699
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7ZgjiUpZHpCJIQ3vjwl0UIHkvguDVhEgaFvB:86iUploT3Sl+Eg06Z
                                                                                                                                                                                                                          MD5:0B770B94D8BB6AC97E1FA5E0A003B866
                                                                                                                                                                                                                          SHA1:FBEA03FEFB35BC7AF4F37E3CA5BD7648305C8CAF
                                                                                                                                                                                                                          SHA-256:0AFECC08F083B0F2AB7DE053682A1143565D9358D3ED28BB630E62FE707EFFC0
                                                                                                                                                                                                                          SHA-512:A10D69A6EF3554A031C330206DCCAE1E8CF25297F43F5488A00D64E377C85A40AE5E39FAB78B0E559D32EF465B20F2D60465B0FF75010EC5B97A4CBBC6D9CFB3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............;.J....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....FIDAT(....J[a....3...U7J..f%%..*..H.......5.(.^.J....(.U...1......9....`..g.....0.x.....~...A,#....W...Qz.....W.h...I.O.y...dHwR....p.`P.q..C....W.=Q.n..W..I1..m...`.c...t.C~?.D......p..v#.w_.qZ*.v.h......J Ug..*.=....,l.g.D\D...4S..h..#.;P..e.............\......:.'......u.t;....a.....\....Wu;.~s.....g.."..@........<...._.lw.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\slider-vert-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 13 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):284
                                                                                                                                                                                                                          Entropy (8bit):6.513230487537659
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPCqC7WsQiUjdKcD9TmuY4IJKQbIXm8kiramWJby586GEErtsup:6v/7qrSjiUpZTY4IJKQsXJHamWVc8oc
                                                                                                                                                                                                                          MD5:2C31E14A43D3A1D26BB53D77716341EA
                                                                                                                                                                                                                          SHA1:4A921D60D2D56FFB631B51B9F16814E1B88DA7B7
                                                                                                                                                                                                                          SHA-256:A86214DE4865D5AE10FA1DB36228FF76257A96E15DC59A08ED1D83FB54A2333E
                                                                                                                                                                                                                          SHA-512:3C4C5F0BFE5CDB79AF468BE3FA00AD8D7B49916339387DAC84F2FB05846C0F48336EBE828CD9BBD51304041FDC0D9BE82272E425E118607073EB6F63BB4C86CE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............a5B....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8.c`..`D..t.......?c............n...S...........n...."|....*`j.0.f.E....?.......A...6M....QM..h..?.s,......1.9..Q.0J.....q2.10@.0F....o?..t3M...3!)f.?.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\slider-vert-insens.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 13 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):273
                                                                                                                                                                                                                          Entropy (8bit):6.655934020341121
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPCqC7WsQiUjdKc1XThW14owfFP5PDPQitY7V2hwyY4sOD9dp:6v/7qrSjiUpZilqFpDHO8hwyMOD9z
                                                                                                                                                                                                                          MD5:71A13E7682AD9BD0C401CF6C19B8B570
                                                                                                                                                                                                                          SHA1:505EA57D2A886442752EF5F8D349A2D61A27B1DE
                                                                                                                                                                                                                          SHA-256:6E72AF70983DAFD2F7B68B79F5C0AD74424717A1D5A7124F0B75EB7B6B71D7C9
                                                                                                                                                                                                                          SHA-512:CFCAA21923A0C943E1C1489DFB4EE45B958A3F5CBAB04CAE4C9999B81D91418E21ACC521332484E5497E9F4B01FF9F93F6E6A780FB94C42C43EF2E4C52903CBC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............a5B....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...1..@...?!.vA....S..."Ur...:..#..[-.W..4....c.Z.o.*&..n..V.V.^$O.7.9r...(.L.M.....a..\..".t....V..6.QD.........]...Czw.@..,K.....t",.[.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\slider-vert-prelight.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 13 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):271
                                                                                                                                                                                                                          Entropy (8bit):6.545345089210072
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPCqC7WsQiUjdKc1O/jR0mJOZ95FqgfBe4rflSua7p:6v/7qrSjiUpZ1O/LYsgZjUx
                                                                                                                                                                                                                          MD5:C9C58815777224CBDDC4D3D11338F4FB
                                                                                                                                                                                                                          SHA1:683E2A72716520FD3C9C00121099D53E17735090
                                                                                                                                                                                                                          SHA-256:315C8098C62EC25F5F2BAF307687B15F1A810F54FC461E2EE14FD7D90630BE21
                                                                                                                                                                                                                          SHA-512:B783CA104D44648567AFBDF3D28979942350182CB59857BB2DFBEFF50B35D62292083AEF9B13185BA9BDBEA692B98215506BEB9773EC09BAE44275642DAE19B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............a5B....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8....@.E.s."6`.[..)@4@.(7..QF."...H!F\......lW..E. ...tA..(.'....z....d.^.)p.Yev+.El...`.c.l.T."-+....OI!.G...o.j..zO..U.D.........$...K.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\slider-vert.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 13 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):275
                                                                                                                                                                                                                          Entropy (8bit):6.496665433895732
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPCqC7WsQiUjdKcH2mbEigLlEHFlqA0olglp:6v/7qrSjiUpZw6OEa
                                                                                                                                                                                                                          MD5:2AC777F2AE73EFF60251BA80BBFE1C5E
                                                                                                                                                                                                                          SHA1:46CBF60942213414DD4C43C1627EFE86A89B5B84
                                                                                                                                                                                                                          SHA-256:8694535A83AA2F17FBD443270F843939144B41901122B5FABAE8C99C9F679701
                                                                                                                                                                                                                          SHA-512:1FA5C1744FF193825797595F10F59196231DFBC3023C6954CCE49BBAEC2C8F13908D9B77FF7969861A3D4238CB78FE91FFAD3CB96C4FBED180CED7C4B54D31A4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............a5B....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8.c`..`D..m.;3+G....1P%.?}xU........].TC)B...................c1..!.......A....&"...QM..h..9..#..S.........".Q...........Z.._....z......c# .d......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\slider.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):545
                                                                                                                                                                                                                          Entropy (8bit):7.324878855682484
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:6v/7ZgjiUpZjCCgiTgXpcuVH8syKxFXYkCvoUhjkc:86iUpBgisZDVEOYkC/1
                                                                                                                                                                                                                          MD5:EE8C2A8A5151AD24ADD7F135DD1EE1DC
                                                                                                                                                                                                                          SHA1:EFB22AB40035D146E9F79DE75C253E3EE4295165
                                                                                                                                                                                                                          SHA-256:6B42F2C94C41792613AD51EA417C09E3F434523BBBF87A0BEEA4A7BFAA5C5282
                                                                                                                                                                                                                          SHA-512:31DFB13F645F561B0E8FFECD1F80EA8A127624A4E9694464446DDBA492E97D5D08D6D5870DCCB62C65249099A1B87FE8059FD0399F6C6C1EE7BD570B55B659A7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............;.J....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT(...Mn.A.F..{.(...hHla.9.,...,.. ..9.......L"p@.M...'.YX.p....X...oU.z.Z|.B.NGT. ;S...p..1.."..rw..Y...\.c1.W7.......N.E.f.Z.....p7.v...z.[..^..#PZ.=}.lU...hb}.05,.U..wM..(B.......H=.>..R].!j.dg.aP]&.<.T..Z...)z....*b.n.GZ.6.H3.|...Q%..>"f..^....&.....q...%r..,...3..%.....\.....#..u.......pl............"....?......].N...S.|~........R.......QT.!(g{d...9...9|...T.......?.Z.Y..h."^:.....V............IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\tab-bottom-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):197
                                                                                                                                                                                                                          Entropy (8bit):5.831891529549951
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPljllaf1rtxBlly+r3U8G9RthwShLKOWGEVwYshkxh1RWAgGnoz83pN:6v/lhP21QiUjdKcBhk5kAgGnooZjp
                                                                                                                                                                                                                          MD5:F2E42166A7612317A23308AAF86D4F18
                                                                                                                                                                                                                          SHA1:0FD344C0A5F91D1BA1F76CFF3BD7DF2C8E7ABBD0
                                                                                                                                                                                                                          SHA-256:E1F56D32BDF58B0DE82889174780E0C0A56718104329BE9F32EFE3E8A28B65D7
                                                                                                                                                                                                                          SHA-512:8C35AA1F91E4103DF7D3CF151C735DF6BB6A296F52BC92E3F933C7488BC51DB3356A32E4ABECB6B37882647D8756357AD61A078CDB1EE81128566D49D391769F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............;0......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....BIDATH.c.....%.1.z.{O^10..F$0j....Z<j....Z<j....Z<.,fa`.t.........r......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\tab-left-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):197
                                                                                                                                                                                                                          Entropy (8bit):5.766685175279197
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPljllaf1rtxBlly+r3U8G9RthwShLKOWGEVwYshkxeam790MR/4FrpD:6v/lhP21QiUjdKcBhkEiMR/4Fr1TVp
                                                                                                                                                                                                                          MD5:A515E91A4474E652120FB1D8C3CFE32D
                                                                                                                                                                                                                          SHA1:A89E5CC15F6CC3496FFD6835AEE49A35E9706487
                                                                                                                                                                                                                          SHA-256:E0DACC3ECBD430D3642F357C5C380F1C829E2C99958E235AFF8B626790C3D39D
                                                                                                                                                                                                                          SHA-512:A9B7B91999D72B28BE84C3674649A5C900B08804C4992765F6CDCDFD9A450BE29625FDB7B6A3B06FB5D5EA081754ABB88E0A4CC5B8C2B1364B17FCFA409BC471
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............;0......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....BIDATH...1.. ....A....-A.M0.xH.4..6...\P.z..q...............+.s....V....^......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\tab-right-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):193
                                                                                                                                                                                                                          Entropy (8bit):5.826561004369924
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPljllaf1rtxBlly+r3U8G9RthwShLKOWGEVwksOTrTblnfCO6xgx6sb:6v/lhP21QiUjdKclCXz6xO9qwVp
                                                                                                                                                                                                                          MD5:641DA6521288038F836B04784C2CFB23
                                                                                                                                                                                                                          SHA1:2F2CE44BFCFA7CC4C6BFF4675B9B34E34F7C95A9
                                                                                                                                                                                                                          SHA-256:BE821D4D3517792666DD4EFEC6204A9C86118CA7C2A7C7DE0A78BADC7552C306
                                                                                                                                                                                                                          SHA-512:1E01B9EA09AF8723AF1205C6BA78568ADFF788C3EAAFF96795DB7912528E79AE72F2C715E568AEBE756D310CCE6F246E37FDC0DCC6DAEAB68A3ED5AB9694A19E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............;0......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....>IDATH..... .@A...R...........k......y.N.bbbbbbbbbbb...<Z...{.9n..Y....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\tab-top-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 12 x 22, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):5.790488825500324
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlNS+8OIVtAr3UiMX8fDtyaNK88LE4M/Kt/QS1p:6v/lhPS7OIk68hf8LMyQMp
                                                                                                                                                                                                                          MD5:A207C775A704B80ACCD126F3562FFB91
                                                                                                                                                                                                                          SHA1:4D157E9795042068D69D80ACD55F041C3CE84170
                                                                                                                                                                                                                          SHA-256:B6B8D8F1F35450DB29B7CD9DA213DBFED73DABF5DE9EB01B4FCA41438FD93B7F
                                                                                                                                                                                                                          SHA-512:C03B142ED32A44DD54D7FB83C3CF3999125B5F93E35804BE9074246082A6B55A76CCB3601F284B7C967D21EFBA43FA2F20224776F58676229FD3AE0F93E92032
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............8}.....bKGD..............pHYs.........B(.x....tIME......".......EIDAT8.c........3......Yx...>}.. !.W...x.....2...30001..F5.j..@O...'.........IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\tab-top-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 12 x 22, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):171
                                                                                                                                                                                                                          Entropy (8bit):5.649440146347792
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlNS+8OIVtAr3UiMX8owfaF/0+EM1i6RvfymtQxPn/p1p:6v/lhPS7OIk68ow4/vVv2Xbp
                                                                                                                                                                                                                          MD5:811A92E848D33BA6A89AC940FAF88AAE
                                                                                                                                                                                                                          SHA1:0D3771FBE99DE3D7844AE97B3B0CE61A22FB609B
                                                                                                                                                                                                                          SHA-256:F852E730024E11915DDDDF97CADF7B8D0A3A94E924EEC45DCA9AC268EE3D4CA7
                                                                                                                                                                                                                          SHA-512:8A534384AD49045ECDBA2DB3425F2B7B169A7AF2271A482D7C42E44CC33E4CA0E294A8C1EB4449365734DDCDC4817E11650956B527873313AF547D043B7D38A0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............8}.....bKGD..............pHYs.........B(.x....tIME......#......8IDAT8.c........3..Xx...>}.. !.GP.....6....F5.j..0.5........6....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\tab-top.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 12 x 22, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):171
                                                                                                                                                                                                                          Entropy (8bit):5.653854693144072
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlNS+8OIVtAr3UiMX84av5aF/0lCxRymtQ+ulljp:6v/lhPS7OIk68Dy/RxvulVp
                                                                                                                                                                                                                          MD5:11F59D59A85BC2908000111C64D8855C
                                                                                                                                                                                                                          SHA1:D99DAE1D0FC49BBB018BADBD1DC7F0036E39213E
                                                                                                                                                                                                                          SHA-256:37BE944409C265B6BEF25F676FC6EE4BE683A0574BE0F5EF21F519842B069814
                                                                                                                                                                                                                          SHA-512:1FCE0077E71883AB716718090ABB0D67CC32B2360419112579343B228897052EC80E520BF7B44CDA7EB4F0BBBB50448245067D332D144D60DA4AF9162F60600A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..............8}.....bKGD..............pHYs.........B(.x....tIME....../1F.....8IDAT8.c........3..Xx...>}.....BP.......6....F5.j..0.5...o..K:.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\toolbar-entry-border-active-bg.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):391
                                                                                                                                                                                                                          Entropy (8bit):7.05468944856345
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPnhpQiUjdKcpsyXM1b7XxUZmZAR5KI1KL47LXM/MkDSfXtlz1t0JUbRmuzK:6v/7vh6iUpZpKXA5QLmwDCXtlz1tiHsg
                                                                                                                                                                                                                          MD5:27CB6E4B7ADEB8F53683FC3A8CAA03ED
                                                                                                                                                                                                                          SHA1:807E15382F7B0961F618BBB776A7849AEA712C34
                                                                                                                                                                                                                          SHA-256:A6B911D241C6D2359B84B06E56FA610776367823F0470D9B31896EEC55C12851
                                                                                                                                                                                                                          SHA-512:C6F2CA69155E73F2298E089B26D2FDD4C7169F387F01FE9FD4CEAD941E770FF5BF316D44F301D4E1EDAA462D5EABD2248A54B3259D1D42F35F76ED958DDA4631
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...J.P.....s.E.$J..R.E.B...#XEP.Dp..U....>@.........:.d.&..8....?...g.(... /........6bE...~Scs...y....._.{.=9X.l@Qo....8.[.@..1..$..q......)......uA^.E.T.Vgd.)...D..s.... ..K..!.M.....c..A...... (......m,q....y..q.`N.?...].i>.......X".556V.?9.e...K.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\toolbar-entry-border-bg.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):366
                                                                                                                                                                                                                          Entropy (8bit):6.991841226269964
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPnhpQiUjdKcxNgoXJl/UEhb9xZ/Ced8W4hknnCLxvRN2yhH3HJBWOkup:6v/7vh6iUpZxNgcl5/Ced8/hunMxpUyf
                                                                                                                                                                                                                          MD5:4E9125CFD5704ABF033DFDAF5FF0011B
                                                                                                                                                                                                                          SHA1:71D26F71DB870754DE0015FB87383878EB9593A2
                                                                                                                                                                                                                          SHA-256:1D38249980C38FA23F7643479A0B85CA80D603C51C851E041DA0251B8DF67B7C
                                                                                                                                                                                                                          SHA-512:8D2E99F16B304B67F2FECCC2FF6C3133EFCF0422CF1BC041FC533AD7C6FD608A9536AF36BDE4411A8E9ACEFFC4E37116CCC0962E09F9962F1E4097779B19C878
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...J.A.....a]...7..S.N..J.....4.......X.6.u~....n.........I.".m... H..0P.+.FA....,..y...]..iV.s8Yo.u="......{....n.....r..=O...'O..0[,S=..f......2...e(C.."4...h....0`J9...>86....WYo./....b.r..x.;..G..gn.....sK.U.(....c.~@0....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\toolbar-entry-border-disabled-bg.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):321
                                                                                                                                                                                                                          Entropy (8bit):6.780037968725372
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPnhpQiUjdKclDvooVPAQlCuNEQMTZ6k6O54lbLCjt3Jy0wjsEp2ETp:6v/7vh6iUpZVooVPTMuNEQcd5agyas2m
                                                                                                                                                                                                                          MD5:33D66FE1B3A6A6811A0863CC86B4963F
                                                                                                                                                                                                                          SHA1:6BFA9881AAF22AEDBB7038476CB9BE9BE1A28B70
                                                                                                                                                                                                                          SHA-256:909EE034A8DEB6C592B3324B8E255959D789C99D24A7D80DD2515032BD8035AC
                                                                                                                                                                                                                          SHA-512:5E09419D2CFB0837CEAAEE4DD32359E1D8589CD7A8624397B724A2BA7F1D4287823360E1DCED7AC010DC05FCC686A620C3037C663983301D3E21E9F4DF9733BF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....................sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...An.0.F.7cc+....|E*$..iB3.E.j%.f..w..$o.....Ws..Y..)...r...q5g....@.dD.0..5.\....8/..x`..2.=..7/...mS..[.d.@..=......_.*T..U.M!.K.'.. h..o.U...U.9..~.(>N.i..Gr.bP!E.......[. ../.D.$.,.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\toolbar.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 24 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):183
                                                                                                                                                                                                                          Entropy (8bit):5.7230856357732405
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlLttZXrtxBlly+r3U8G9RthwShLKOWGEVwuBxtZfjajvjAgyRyG/Bh:6v/lhP3QiUjdKcmtjafAgyRyGpeqp
                                                                                                                                                                                                                          MD5:0C36B4E1D5CDD45E6804771648FB0069
                                                                                                                                                                                                                          SHA1:A9B8C28635EAD01FE80E1D5FE599476C9F09C07B
                                                                                                                                                                                                                          SHA-256:CA1B5B7B8E72A15626A633C2CF8CE033B8857293E2A63ADADC17C7F2C982AFDB
                                                                                                                                                                                                                          SHA-512:F2A8B3235FE1D799AFAD5EA27B6969ABF237DE53B174D1126D55D4B05EDFC45D0D469BAB62273F03B5207B1FAE02DEF1E80FE44081A56FD9629ED70F5457F840
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....... ......^.8....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....4IDATH.c........&Z.>j......Z0j......Z0j...#....o?........I.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\tree_header.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):166
                                                                                                                                                                                                                          Entropy (8bit):5.629450731816906
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlHjtjOelpWsrtxBlly+r3U8G9RthwShLKOWGEVw5s+oOROZHhtigFt:6v/lhPGeNQiUjdKc59oQwt8ap
                                                                                                                                                                                                                          MD5:64DD28D68ADEAA22B60802498F2BAD01
                                                                                                                                                                                                                          SHA1:D9F96CA9E07290B9724E8FE4C2BC5674E0D60AB2
                                                                                                                                                                                                                          SHA-256:83A4BB4E4CC322E5407ABC4F4122E28D8B1BA84DC0781F2462A51C35EBF59076
                                                                                                                                                                                                                          SHA-512:5FC9CD73BDDCF9C8190BCC6F40030B058FC39E9911CFC973EC5DF334578252D1C3B97FC46C303658345D7439D10B37F9A458A06CDC35DF61009766584062C65D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............X..;....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....#IDAT8.c........./.L......Q...G........S.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\treeview.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):125
                                                                                                                                                                                                                          Entropy (8bit):5.502513834980641
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPljllafuh0AMkBy7mdojNZxltlllllqaZLItllp1p:6v/lhP2uXKnNZ2aZLItllbp
                                                                                                                                                                                                                          MD5:637F3A97BA1EC78DE38AC4619CFCB9BB
                                                                                                                                                                                                                          SHA1:E70A19329DD9BE049F6EBFDA2BF40F09E82B3C10
                                                                                                                                                                                                                          SHA-256:95C02164AB0B70A772906ABA18103D3DC0714452CB889BAD78198F7A554A92F7
                                                                                                                                                                                                                          SHA-512:0E405F382C8773A23C47DF5994D96AEC99919AA75E89F5C91D79C72C0AD6E4009D926C02413F32D6B313E996BD81C62BB876D8EFD69B48DED8F99E57EA185176
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............;0.....DIDATH..........A$..K.q.M..%3..x..(."I....VVP..............d.....>...DeC....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\trough-horizontal-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 34 x 15, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):267
                                                                                                                                                                                                                          Entropy (8bit):6.500722926046393
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPitZkQiUjdKcqL1N+6qaen7Ggdy8tyhFxVmm+nsup:6v/7attiUpZq5DcPkfm/
                                                                                                                                                                                                                          MD5:01C56A23A7A6E564974D67ABA8884340
                                                                                                                                                                                                                          SHA1:B25279190C7E112819D9D6FD23F74C5DDB95CECB
                                                                                                                                                                                                                          SHA-256:86ED8622278DFCD07865704E5919EC0242487D5132B3EC8D41197E50882F7CE4
                                                                                                                                                                                                                          SHA-512:5771964C0FF64F3DEA67B6E9C737240ED37DEA71E6F26A661A1EE4C390597A88EFA36FE4FC637A62A57A6FF2DF2B952DD78D8ADEF53185A018CFB89C3FAB5FE8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..."..........u.*....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH....@..g..u ..#"(..p.~HL...2"............~.;..@..'(w<..k.0.....VD.O7....Y..U.ga;G...c....g.q..T[;[..c1.t.-".G..DG.h.e.B..Y(../FC.....R....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\trough-horizontal.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 34 x 15, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):261
                                                                                                                                                                                                                          Entropy (8bit):6.429711003991257
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPitZkQiUjdKcBDT1q20FNyVHVAGCdp:6v/7attiUpZB1lqyVHVbY
                                                                                                                                                                                                                          MD5:20E31676F499073B13248574EEC35B24
                                                                                                                                                                                                                          SHA1:BA4FC5F7FED3FBB0C2C49E53A69A4C4674CD8B86
                                                                                                                                                                                                                          SHA-256:77E1A43D941D77E64652E1CA6532AA9F42B0412A2D48EE34BF9EEBB8D4272C3A
                                                                                                                                                                                                                          SHA-512:6DB2DB25F1968AA5D62CD7EDF90EF4C046C4B963CE88336C914497991BE4480239D7BE5687C080DA8CB15FD0A287C6F5306CFF5A8602CC942672E0469DB74A06
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR..."..........u.*....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH..!..P..g.......U.........hT.@R......mB.G...d!.9...v..l.......x..<;..0.m....:J.v...P..1Y.(.../..?.y.....x....x|E............t.g....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\trough-progressbar.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):296
                                                                                                                                                                                                                          Entropy (8bit):6.7481835004515975
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPoipQiUjdKc/9AojGGAPPWfc0lE4nmYZXlHFRL8uRvc/hPCY/jp:6v/7ANiUpZug+PWs4/ll2Qq/N
                                                                                                                                                                                                                          MD5:5495FD44FFABCACE7B2E8ED18CFE1DCE
                                                                                                                                                                                                                          SHA1:14BEA77F53F097EE33273F6A1BF9722DB6019B68
                                                                                                                                                                                                                          SHA-256:976131844788C86672E880CCE95547DDC66FC5423092160685212AE1E196BBD8
                                                                                                                                                                                                                          SHA-512:A5AD020C0D6C031775ACD4FCE886CB283EDEEB9FBFD03CF53A7AF0234D726AC01461AC559C3BEF6A49725B2D371A3C98FD34A3BEDBA09C8EEC57850A46336B2C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR....... .....+.......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...1..P...?u........7r....8;0.x...7..@.|.B..3M.4_~iZ.XA3\..,*.@.LDSk".B..@.[..hlM...o.#....=.. .@.m..\.....5....?..1...;=.PDS .P.)u.Bk"'.1p..O.Q.zc..6..../)r...=....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\trough-progressbar_v.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 32 x 10, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):289
                                                                                                                                                                                                                          Entropy (8bit):6.649099474637677
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhP2kTXQiUjdKcFXqr4nooEO3fwgrArjPeVJOlncY2mq1p:6v/7eiUpZcr4nooD3Y3rjWVAncZ
                                                                                                                                                                                                                          MD5:EB4517DC6BF4CC43673858C31B3F5491
                                                                                                                                                                                                                          SHA1:E2C2B8E7078EDDBFA1C612A1485772663429EA3F
                                                                                                                                                                                                                          SHA-256:E511189CEBE3AE13F707DAADB9C775AE57E93EEB3320D6849DAB5797656DF4C4
                                                                                                                                                                                                                          SHA-512:417B7FA47F2FAC29693EDF75D9B92042DEFDD74A67216F941DEA74C33BC940640E0496A45F7A7EFF20101695D9A7038D1C363163200049B8B610AAE1959FB2B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR... ..........M\.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDAT8...!..0...o.M2_.PW...0;..Y0h.4......2.=LY...._....B.....v3q.j`..{...6............"Z9k........i.Z...uB.......u@....."..}B.%....g......CDx.=.8..=":.....)F.~7c....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\trough-scrollbar-horiz.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):143
                                                                                                                                                                                                                          Entropy (8bit):5.292637511360477
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlJlawvlrzAadCmy+r3UiMJAm7MkxNPmgFQeChPkdp:6v/lhP70wZz19HcXMkLmgidhcdp
                                                                                                                                                                                                                          MD5:D8185BA1DAC925F83B61A7A6884F732F
                                                                                                                                                                                                                          SHA1:9302922E577718DA79D8E9F6E17035F378852116
                                                                                                                                                                                                                          SHA-256:2A4D991D24C628D52C9C06F0EB618191FAB4D18E3D1B62EFB45CC4C8871B2F8D
                                                                                                                                                                                                                          SHA-512:BF8E87CFEB532C010E74E1F1B81D828BD742B1D3DF178CB0E3FD176AA7BAB1E17C0EE3E3280671F506B8373A1928A5CC7B8F30247A0775BEDC1259B0A99E15C9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............;.J....bKGD..............pHYs.........B(.x....tIME.....%7d..u....IDAT(.c......2....`T..Q.X..M....y.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\trough-scrollbar-vert.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):143
                                                                                                                                                                                                                          Entropy (8bit):5.2733725637929005
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlJlawvlrzAadCmy+r3UiMJAnykxNPmgFQeChPkdp:6v/lhP70wZz19HcwykLmgidhcdp
                                                                                                                                                                                                                          MD5:3F622E2CABEB9333C9F74ABC457E2343
                                                                                                                                                                                                                          SHA1:FA22DD1B81228994CB37B3C0C62A32E343327BE4
                                                                                                                                                                                                                          SHA-256:D0DF472C6F3C578FC1A4E2C28F7C4025CC7724550A82B36AB47EC87B9C73B657
                                                                                                                                                                                                                          SHA-512:164DE30FD04BD13D1621E54FA2AFB7D0C34FE6C96F6776F6013A09337E72C306FABE79D0BA66A1004EB846987402700E612E294AE79637752C2F106F795D5BE1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............;.J....bKGD..............pHYs.........B(.x....tIME.....%/w|.#....IDAT(.c......2....`T..Q.X..M....y.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\trough-vertical-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 15 x 34, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):270
                                                                                                                                                                                                                          Entropy (8bit):6.606724648755511
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPr/7pQiUjdKcRNvbUvRVCkUlAE713RW/qMpMPup:6v/7D/eiUpZRNYvRVCkUlp2/fpX
                                                                                                                                                                                                                          MD5:4F36239D4E9929EBBDBCBFC816470C2B
                                                                                                                                                                                                                          SHA1:8D4AC395D2AE49CEAEB97BFE8512C4E45CF21076
                                                                                                                                                                                                                          SHA-256:2B6B55F483411B1D2FD7291D1AFF377ED5ADB3D0FA3B2BBCC338B5E1811C9354
                                                                                                                                                                                                                          SHA-512:18921E1764C5348527E26E16BC7FCB2DBFE4B8CFB83AFA8559EA3667702852088450FCFA81DF4FE2A000408ADB626BB0BBF4541F1C6D3D9C7827FBD0AD59943A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR......."...........sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH....@.....&.U8@$P.=.!...-P..L.2.=..~.1.....&...`d!.r....F..a@..tX..]....ZA...e..&.....gd.!3..'.$L6.....A~$.\..O..W.t.].....C#.7...,:.z4....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\trough-vertical.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 15 x 34, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):264
                                                                                                                                                                                                                          Entropy (8bit):6.547150702969649
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPr/7pQiUjdKcf+X20OjiBMWiVNn450ittMdp:6v/7D/eiUpZGXQiGQttMz
                                                                                                                                                                                                                          MD5:93BA270B27CE9201E7C5DC748CFAADDE
                                                                                                                                                                                                                          SHA1:09323EA1D06DC29ABF321229AEE1F09909E0EC9B
                                                                                                                                                                                                                          SHA-256:3DE86E2262E4AC5BB5B83C32A9F5EFA630117DE0AD71AF5C0DC207E55ABD3A50
                                                                                                                                                                                                                          SHA-512:1811F99500AC944FE40B326ED43DC824EE2594E0178F6C468ED15B6C512B0C8C7DC0921873BDECC510F1508076E2AD2783AF10411544F7833D4C265D22351127
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR......."...........sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....IDATH...!..P......n.B#Q......\..VT".U.@MI.._..........X.|<...J(.:Ay:..p..a1....(.....M...9....'N.c.....{J..A.$..].....[._>.......!..M.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\up-background-active.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):188
                                                                                                                                                                                                                          Entropy (8bit):5.780680112781498
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlHztZlp3qCAadCmy+r3UiMx8nOx92GFoNA4kxbYxC299K1NGUig8gR:6v/lhPZ3qC19H8Ii2UcdkxbYxC2XK1Uk
                                                                                                                                                                                                                          MD5:CC8C15991E4656E93C4AA25EE6DB0049
                                                                                                                                                                                                                          SHA1:9BE4479BDE051BB9522B83F48E88AC305C9EF753
                                                                                                                                                                                                                          SHA-256:5CD772EB222399C62B683588499C82B0095C6FBCF7C5BCFB183B18BBD8CD3D89
                                                                                                                                                                                                                          SHA-512:D187CD04D35ACC85BA76B1C01C5E26BC80513FCC0FE7C17C763C4FFB1C575BB815963A17191CD5B1D61C25B7DBC64F9C34A5BBB31A11FE9C58558E36EEED2790
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............[k,.....bKGD..............pHYs.........B(.x....tIME.....-3.......IIDAT..c.~.................1...~\..............L.x...3..?.......*D...........)es>....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\up-background-disable-rtl.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):204
                                                                                                                                                                                                                          Entropy (8bit):5.888383449726471
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlHztZlp3AsrtxBlly+r3U8G9RthwShLKOWGEVwTBx9wWPaZKBXIyx2:6v/lhPZ3AsQiUjdKcTdwuaZ/isIC7Tp
                                                                                                                                                                                                                          MD5:D95CF26BB205DB52ACE862A910FD5BE2
                                                                                                                                                                                                                          SHA1:25F488A96480FB94E1341537AC0FD987844C0515
                                                                                                                                                                                                                          SHA-256:A079F04418447E667FFB2C1C9009E5A4467268BF1597F64CA97FF3648A429825
                                                                                                                                                                                                                          SHA-512:C08B087B5D965ED3FE6D3BD4891628F5B8BC87398612C5CAD3F2CFE1E3973F45D375575B0549DCB8C973CF53F90DA18356367D16F403EA529E942439E4788841
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............[k,.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....IIDAT..cd```...............l.X.............M.T.....|.......4^E....Q.x.....?vb.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\up-background-disable.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):222
                                                                                                                                                                                                                          Entropy (8bit):6.0722128303277145
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPZ3AsQiUjdKcB9RRW0br96539LmXDCkk74up:6v/7h3AjiUpZB3RW0brY5NLcC/7x
                                                                                                                                                                                                                          MD5:739425D1DBBE77718D5449E49D986F40
                                                                                                                                                                                                                          SHA1:EF212720AFC15C790CD5F3E8EDBD42100CDC05B5
                                                                                                                                                                                                                          SHA-256:282EAF28063F9DD56BA1DAEABB9243D5FD67AC595DDB22EE7EB413A9C51AD5D3
                                                                                                                                                                                                                          SHA-512:C6BED365F4DC83F19FC2E06E19893640B7A211A97D4F49208A502885A91585BBF633D6612D7E1221F7EEB8E5ED1517C80D35BEFCE22A94DE71FC36A24E607717
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............[k,.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....[IDAT..c|...........C...R....2...........|....._...]Yp............./I....&\.a......*D........\.).....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\up-background-hover.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):198
                                                                                                                                                                                                                          Entropy (8bit):5.809927395574655
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPZ3qC19H8Nw2siDa1immXQi5eWJp:6v/7h37HKw4+kQi5eWH
                                                                                                                                                                                                                          MD5:5E718060AB4544B4839A110E43532EAB
                                                                                                                                                                                                                          SHA1:7492D1C02D49A9E27E1D88BFD1F451DF6EAA3494
                                                                                                                                                                                                                          SHA-256:46ED894BBC137C794E55C72F2947A22B479F5F45456487B6BF1C2908A2F85DAA
                                                                                                                                                                                                                          SHA-512:2AE0622F7E152FB458B0D0C0C45785FCFD7CC0501D6850C6A4586025E32FFE60FF37557F063CB3257C3E238698DEB907E141F832D313211A0AAA159A3A276C4B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............[k,.....bKGD..............pHYs.........B(.x....tIME.....(.].....SIDAT..c<..............)FZR...............=........4.FFF.I1^y...;..a......*D........+...r.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\up-background-rtl.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):210
                                                                                                                                                                                                                          Entropy (8bit):6.07427208258008
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlHztZlp3AsrtxBlly+r3U8G9RthwShLKOWGEVwVs6ME7grQeH/+nx1:6v/lhPZ3AsQiUjdKcVBkEeGps5IncCxp
                                                                                                                                                                                                                          MD5:30ED451AE49A1716CF405CA8BBE99D90
                                                                                                                                                                                                                          SHA1:0BF7DEA93485DA3D3F5DD862F6ECB1BAD548C4D0
                                                                                                                                                                                                                          SHA-256:4084C5D20D655876854020DF66C02407CDCED502C3E1CB68F2B1788D932968FC
                                                                                                                                                                                                                          SHA-512:47FAF932A2D715EA9CC2974F2A1248AD9C9B746EB7644D2FDDBFDDBF8E5337C16E051BE9692D085C8901B18F9C60897D37E4DCA6B60B9670EFE99866821B04BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............[k,.....sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....OIDAT.....@P.E.sE^E%$:.5...F....P...p..|...c.Y.g ...0..5..u..s7.5E..x..7..a.j..f.S......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\arc\up-background.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 10 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):188
                                                                                                                                                                                                                          Entropy (8bit):5.851766678697494
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlHztZlp3qCAadCmy+r3UiMxw7kx92GZLgOiDaCzkmODXFnRj1wtEoB:6v/lhPZ3qC19H8Sw2siDaCzvODX1Rut9
                                                                                                                                                                                                                          MD5:332FCFDFFF7EC47FD179E7C693883575
                                                                                                                                                                                                                          SHA1:8E5EC8C6B4F29DDAED42E4C4B1C2A71111012B42
                                                                                                                                                                                                                          SHA-256:3C83BAC09C7B8092DEC076AD1234774B23D19A664F9C52CD86FA1603440330BB
                                                                                                                                                                                                                          SHA-512:DE6719F1F4C9D7BC692CF82E6F5B2EC6BBBFE093025ED17E98A89267A7D160F36DE1E1F671858DC64D5BDCC21589097F5A3807B33721354A2BB3837CF616A08F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............[k,.....bKGD..............pHYs.........B(.x....tIME.....*...8...IIDAT..c<..............)FZR........~......f````b...Ey......*..6b.2.*$..;.+H...*....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\arc\pkgIndex.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):466
                                                                                                                                                                                                                          Entropy (8bit):4.716595696071137
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:427y44FxHYvFj8fLtU/7AKcsBqQszCrQ+pBb4sn:4270zy1sRK/UTGrBZ4s
                                                                                                                                                                                                                          MD5:0B7D027911944895B252108336C70B36
                                                                                                                                                                                                                          SHA1:EF2B0CF5931722B7C22A92D15633AE44233E9F4B
                                                                                                                                                                                                                          SHA-256:5DFCB83B6A14B9CABBAFE905CB9427634540A3A36C2021785FFD286031599510
                                                                                                                                                                                                                          SHA-512:47BED31F1ADC7617EBD95CEA8E9212DB687B07F3728620F37C59EE60373A4E32F5741498097A2AAEA53654AF7D2896576FA6292494E064C89B835045493E1D83
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# pkgIndex.tcl for additional tile pixmap theme arc..#.# We don't provide the package is the image subdirectory isn't present,.# or we don't have the right version of Tcl/Tk.#.# To use this automatically within tile, the tile-using application should.# use tile::availableThemes and tile::setTheme ..if {![file isdirectory [file join $dir arc]]} { return }..package ifneeded ttk::theme::arc 0.1 \. [list source [file join $dir arc.tcl]]..# vim:ts=8:sw=4:sts=4:et.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\breeze\LICENSE

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):26526
                                                                                                                                                                                                                          Entropy (8bit):4.597540262150079
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:LE56OuAbn/0UVef6wFDVxnF+7xqsvLt+z/k8E9HinIVFkspWM9bc7ops08ZuQa:LE5trbernFCL1leSWmc7ksNZuQa
                                                                                                                                                                                                                          MD5:1803FA9C2C3CE8CB06B4861D75310742
                                                                                                                                                                                                                          SHA1:B386B371CE94933E63CED1052AA72A60DA5485FF
                                                                                                                                                                                                                          SHA-256:20C17D8B8C48A600800DFD14F95D5CB9FF47066A9641DDEAB48DC54AEC96E331
                                                                                                                                                                                                                          SHA-512:DEC798F85EDAC11B3A3F4BB1F309397719DD4DE04F66357A5520B23E758CBA757C9C7BEE87BDBAE2A5F936368CAB0670BBD3395030393C029D68D0E72FCFBA1E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview: GNU LESSER GENERAL PUBLIC LICENSE. Version 2.1, February 1999.. Copyright (C) 1991, 1999 Free Software Foundation, Inc.. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed...[This is the first released version of the Lesser GPL. It also counts. as the successor of the GNU Library Public License, version 2, hence. the version number 2.1.].. Preamble.. The licenses for most software are designed to take away your.freedom to share and change it. By contrast, the GNU General Public.Licenses are intended to guarantee your freedom to share and change.free software--to make sure the software is free for all its users... This license, the Lesser General Public License, applies to some.specially designated software packages--typically libraries--of the.Free Software Foundation and other authors wh

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\breeze\breeze.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13983
                                                                                                                                                                                                                          Entropy (8bit):4.189394890873151
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:dch7lddY2pq3TC3u3D3uSCyuswSyYG0Tc/C6tmJNEhp4mH8yxY6IJD:ah7ld22ceGzCsLG0Tca6tmDEhp4mQJD
                                                                                                                                                                                                                          MD5:63CA2E86FBB6242A74942D08515E6E7E
                                                                                                                                                                                                                          SHA1:130C294A5639735F19FF673B6552D3906300061C
                                                                                                                                                                                                                          SHA-256:FC8063D825E69CEC8BD9612A59D9DBDC97A2A078437C4F01789D9E96441E918D
                                                                                                                                                                                                                          SHA-512:B3C05D01C2936813AFAC463302BCAF9506074F9D5F031FA8B91A1AA7ECB9A0F4EFCC6CD8939B1FCE8B49C21DCCD72825499F085F079BB8353BEBCDA78D88D2F1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# breeze.tcl --.#.# breeze pixmap theme for the ttk package..#.# Copyright (c) 2018 Maximilian Lika..package require Tk 8.5.0..namespace eval ttk::theme::breeze {.. variable version 0.6. package provide ttk::theme::breeze $version.. variable colors. array set colors {. -fg "#31363b". -bg "#eff0f1". . #-disabledbg "#e3e5e6". #-disabledfg "#a8a9aa". -disabledfg "#bbcbbe". -disabledbg "#e7e8ea". . -selectbg "#3daee9". -selectfg "white". . -window "#eff0f1". -focuscolor "#3daee9". -checklight "#94d0eb". }.. proc LoadImages {imgdir} {. variable I. foreach file [glob -directory $imgdir *.png] {. set img [file tail [file rootname $file]]. set I($img) [image create photo -file $file -format png]. }. }.. LoadImages [file join [file dirname [info script]] breeze]..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\breeze\breeze\arrow-down-insens.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):244
                                                                                                                                                                                                                          Entropy (8bit):6.6872576318864505
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPIc519nnKHZIla/gdnVc/V7/0ZbrlDga3dpEDjjp:6v/7D5nKHZ8aUn2/Vj+bpDga3dpED5
                                                                                                                                                                                                                          MD5:0D792A447CED8EF1D11B19B60F4E6837
                                                                                                                                                                                                                          SHA1:9C8154371024EAA3B50E0A8D01717A30CD636E7F
                                                                                                                                                                                                                          SHA-256:C75DCDCF19A385D1B8D01CC882094497DD97E9FD748526FD8A6757D3512D215B
                                                                                                                                                                                                                          SHA-512:9EB4253B1C04ACC11C97F817027EF6D7C319EA016121ED8CBA95BBBA1EE9EB13D6982CFCD7FC96B11AF998D46AAB7D3C287D6D97D504210B5A2287204600EC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............Vu\.....bKGD..............IDAT(.....0...&...&.......vr.........).N:.&8.Z.....}.q.....o.FD........3.+....=..v....s....:.H...K..4.w....,/...~.,.cd...Z.....@.o..B.......].....dYZ....X..j..In`zG.s.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\breeze\breeze\arrow-down-prelight.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):222
                                                                                                                                                                                                                          Entropy (8bit):6.62439268961086
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPIc519zuoncH8uUXRNXwDdr7M22B2p:6v/7D5zuocqd2P
                                                                                                                                                                                                                          MD5:2AD62CFC61ACFC24FA34C59CF23F2102
                                                                                                                                                                                                                          SHA1:3FA0A9B344ECC6334FA5E9DE0569BA19A4E9BFB2
                                                                                                                                                                                                                          SHA-256:99096D33CC75FBFFFED1664E8A06FD4EC72CF286CCA9DE3F2DD95DDB768B0023
                                                                                                                                                                                                                          SHA-512:531C068DBA9821601F8E3CA67A0B61C2EB1339CBE01F4ADFD449964266BCA0B1724C8B9D0D51CFA94D63BCE695E877E75483E7A5605A76D3729C16707D33765D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............Vu\.....bKGD..............IDAT(.....0.D.}..]..2`.AR .1.b&@..b.tFY...Y...$.<.w._.?.|,.e.|,n.3....W.....!M4.......5.E...).5..P....... \.......m.!_.%.^..@....y..@.>...Or.k8IMpd......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\breeze\breeze\arrow-down-small-insens.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):186
                                                                                                                                                                                                                          Entropy (8bit):6.117142163275411
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlv5hrliCAadCm/kxPZeW+Gw/wLOnnbdfSa8vw2n05LB/lzWSL6hm1p:6v/lhPZ4C19/SO4LSSa8vOLBtzWSLgQp
                                                                                                                                                                                                                          MD5:8D928D5EBB05E623D7A33783F36E4DC0
                                                                                                                                                                                                                          SHA1:D1C431B9984BB5575E5AC506FCF726F461BB0B58
                                                                                                                                                                                                                          SHA-256:1B7FFF0776C16286542FF56AB1DBA7C17DE6AE8E3C7E667B08255615D4D8A916
                                                                                                                                                                                                                          SHA-512:52F596F5F2619E9C7FFCC794701F40A56B790A0BA530B2B9B8C899300907262B8875BDCF34EA7E26AE68E8102870D868AFEDFADFB0A28F1B2552E9728970FFBA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................bKGD.............oIDAT..c` ....q..c.........!......_!.Vb.X..$DE.12000.....fd.a..z....?..../..FZ..c.m........K.^aq.......Q.'....A e.U......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\breeze\breeze\arrow-down-small-prelight.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):6.201705699419727
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlv5hrliCAadCmzEm1WsiuPOoTnVKweqv9fIunvSWzTUWRznxhA/lVp:6v/lhPZ4C19ZWludrhznKcTUUzLop
                                                                                                                                                                                                                          MD5:4170F56CC46B6C541D1CA6FA313D4B00
                                                                                                                                                                                                                          SHA1:5CD0657C8DC70AF85FBD7ACD8108764787B42333
                                                                                                                                                                                                                          SHA-256:E1C4AC7E2863D054310B97B7C8AC28B12A12BA2A43AC51CD9727907B6960F541
                                                                                                                                                                                                                          SHA-512:CFDF087CDB904D8CF94A15DD4B8FF53BBE118A86114F46063B6F6F9BED88D0588B218453AC204BBCAAD5345375611BDDEFE99009FD937CDCA98EF7FC04DB564C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................bKGD.............nIDAT....1..P.Dg~....H..^A..+... ..."..B...._.`........7[.5...... ..H..I...O.x.10...1.1.]..<V.p.].s.s-:^....+.9.g.....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\breeze\breeze\arrow-down-small.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):180
                                                                                                                                                                                                                          Entropy (8bit):6.188959051630603
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:yionv//thPlv5hrliCAadCmqVSPVgmKI3bX83ufngNOwNzQ9DZKWOJ4O/ljp:6v/lhPZ4C19qIPVgHo7KuLwmZy/Vp
                                                                                                                                                                                                                          MD5:EE3D10F0307A55D54CC8EE49B4895E3A
                                                                                                                                                                                                                          SHA1:0D1AD61B2CC935526CBF82C4A1B757BCB1FDF540
                                                                                                                                                                                                                          SHA-256:46E45A80741375804EE5FCA88A66726F30EF042F5101B26AD2341C62EEAF53B7
                                                                                                                                                                                                                          SHA-512:8D093CB6243219BF56C71CF2B74B7866CDAE32FB84B86F9895221739259DF068C47094ED1B108680A9A130342B3696EB0B1CC240C4C6C8F21ECF0151DF33B1D2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................bKGD.............iIDAT.......@.C.]....../n...EW....B.G.oa...L.K..9....)..`..}..;T.h.egE.(k.h6...<...k...|.w....z'.'....%.%.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\png\breeze\breeze\arrow-down.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):239
                                                                                                                                                                                                                          Entropy (8bit):6.647559368422242
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6v/lhPIc519cSI/KrsLiulr8ErJqFNG7nxZJygTY/jp:6v/7D5v6KoBlr8ErJqFNKPyL/N
                                                                                                                                                                                                                          MD5:AAB3D8AEB7B3994F3111B348E5A80133
                                                                                                                                                                                                                          SHA1:014E4D54436CAB80960E87761947EACE31A724DA
                                                                                                                                                                                                                          SHA-256:4439F23E905987DF8E2D9EBBA80F88364C280786E644D20D4D267A0A297D52AD
                                                                                                                                                                                                                          SHA-512:D29B5DF8D1A8561D077C337D9ED99BCC75A79B24A73187EE072E015480A4382CBA7BBB7FEED58C03A34AED80C2ED83378F2A255BBB861C6599E03533BBA55467
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............Vu\.....bKGD..............IDAT(..M..P....]..]......W..E.-D........6..M...$..p....e.W......^.:..S...t.U8n..l&...O&..0.##p.yc....p.....F......a..d.-.Z....'...`...w.&..t...I..QJ<..).....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\elegance\elegance\stepper-right.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 14 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):560
                                                                                                                                                                                                                          Entropy (8bit):5.152922510616859
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:astHVm85IA5VZ/P19E3HvnAaD6/gk/rOlTstkOJtoRZ81wVrGgFVByIczgq2d:5pWA5rH0fLDMgSSlo7tfWGYBy9X2d
                                                                                                                                                                                                                          MD5:294A600E56320D3F6C4D398746F7A5BE
                                                                                                                                                                                                                          SHA1:532D0109A453C731119A639912647F733AD771C8
                                                                                                                                                                                                                          SHA-256:C32981E343EE33F98982C17D50FE9F3C92314428A96C1BDF52C564068E1E6124
                                                                                                                                                                                                                          SHA-512:D1AF552B97A2899897C9D4F6F60A21064306081AD3B55E33258BD7690D57F03DDA37C918798D80D890064AE4DC319AB75D659C28557368BF9E9EB3E39897680E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................................................................................................................................................................................................................................................................................................................!.....G.,............G....F@...A.+GF<.8@..<..466.8..6.GC114..4.412.GA0..............G<+..-...%.''+".G8"....8. .......G5...........G4.............#8.. B.B.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\elegance\elegance\stepper-up-prelight.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 15 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):542
                                                                                                                                                                                                                          Entropy (8bit):5.439749492478779
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:matAM4iR3vvGIgWplTSr8BEcXGUviQl9r8ZGznp6PyPX6zJJr442EAFZrBANK0:maT4ihOIzT9/Wmdl92WnprPql/jAFVi9
                                                                                                                                                                                                                          MD5:DDF5F852971DAB8DD1E5EA50135E153A
                                                                                                                                                                                                                          SHA1:80F92B439CC19A56371C0A4C318789D81AC955E9
                                                                                                                                                                                                                          SHA-256:4BF3491ADC2D8261FF0923008DB41B74A4F41D87A1811867E5E0CA2E5CBAC454
                                                                                                                                                                                                                          SHA-512:0BEDC04038DBFE737302AC8A888EE7416C19A33C1F598CD9CB7FC492BFAFE3D114B58DA842AB3275F53DAEF5064EE41D33224D3F82F7717F01E51E49F1E7DA14
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..........o..r..t..v..w..x..|...........................................................................................................................................................................................................................................................................................................................................!.....G.,..........{.G....GF.CC?<996.0..60-,*#......<..*( ......,.......,.....G?;......=.0.....A.......<...>......G.6.#...%.(...........G..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\elegance\elegance\stepper-up.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 15 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):549
                                                                                                                                                                                                                          Entropy (8bit):5.336542204508181
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:mhUQ5IA5VZ/P19E3HvnAqvX2555Wj679INYUkSC1gaFG56X8fCqqRZPin:mnWA5rH0fpv2WwIpkRbFu6ACRRZ6n
                                                                                                                                                                                                                          MD5:F6A08DF0A034238497882C679348049E
                                                                                                                                                                                                                          SHA1:6AF6FAD16804D7011874E22A8832ADDEFEC54B9C
                                                                                                                                                                                                                          SHA-256:1BB2D975E1C9312D320EB6A88F386EFF8981E2DA90473FA6B413D8AE26A1B431
                                                                                                                                                                                                                          SHA-512:9C78B77238249B38CF601B2ED964CF084BD6D9231CC53938EF3B25B882F22B3748BC8E58A48E9640A2F1380DDDD96E7FF8754EAD99FFA720EB4BB1F1C1FC22FA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................................................................................................................................................................................................................................................................................................................!.....K.,............K....KJ.GFBB<><773..:31/-##.....<..-($....KA?8..(# .............1.....C?<3...KF<<....CB...<.......-...C.2....-...........K...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\elegance\elegance\tab-top-active.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 60 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):544
                                                                                                                                                                                                                          Entropy (8bit):6.568984085652401
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:g8QK4BW37EfQhL0DW5gYQILnxDVj5U+OP+xUQm:g8QPILEfQhLwWGijxDVj5UmA
                                                                                                                                                                                                                          MD5:EA74CB3B081C73A34CD1FFA892842FB4
                                                                                                                                                                                                                          SHA1:FA33F441D6BF8774EAE5F9F8558B8CEBFED01602
                                                                                                                                                                                                                          SHA-256:6C1DA508A8E66259CAC48666256570E5459C40F0E0BB61DEF5530B691C68BF51
                                                                                                                                                                                                                          SHA-512:08766B7A036686866C5EDE298FDADAC4D9E452CD6844105CFFEC94B08B8DCD0CDE3B1837CBA7EA3315E33F6AE895791D23CA641567FF9ECE762F9EABB61DB1FB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a<......PPP.............................................................................................................................................................................................!.......!..Created with GIMP.,....<......@.pH,.....j:..tJ.65B.g..z..W+.J...W.....7W..j4.a.}....~{.....z.w................................z............................................Bx.........................................H..A...X`......F...AD..-b...#D...V.I...(K......#W.....M.2...y3').0}...R&M.HI.M...H.B.*u.O.V.....*W.+...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\elegance\elegance\tab-top.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 60 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):583
                                                                                                                                                                                                                          Entropy (8bit):6.867832862963228
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:NI+F2LF9Cd5I5hhY0enA+4mnhMrftqhETDh+y:NoLFBpjSGmhMEy1
                                                                                                                                                                                                                          MD5:216155D79C53DFF68C72B890A3368777
                                                                                                                                                                                                                          SHA1:A7865B641F4ECD043DFF1B172DF1957179AE5438
                                                                                                                                                                                                                          SHA-256:AC315E2DD0A7AE7D0D41354857C625391126F3195B1A8980CD2EB66239B90D5B
                                                                                                                                                                                                                          SHA-512:9CF81151F52E82EDF2B899FED982EDB8EABB4A2BDD296F4B7BE4055370C20E145546E585D4D2007D02622A7A336F029A821D7538E7CAA1CEF1B7BCB6F966405C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a<......AAA.............................................................................................................................................................................................!.....).!..Created with GIMP.,....<........pH,.....h:..tJ.FO.v.Eq..0.....(L..i......s.Y..5~................{.%.............|.................M#.............................................................M...................A........C...J...aE....K.AG..ArL....#M.L.r.<.0c...AM.3q.TpsfP.4e..0...H.*].)..M48.J.jR..8X..u)V.].v.*..U.R.mJv..E..}.w..v..{.._.x......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\elegance\elegance\trough-horiz.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 60 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):97
                                                                                                                                                                                                                          Entropy (8bit):5.534724053192785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cf/rwPqGl0xl9nluEYBwTFZKtiWJe:cwPcjZYBw5ZKtiWJe
                                                                                                                                                                                                                          MD5:D2693D91649E929A82F22ED7E1E3DB92
                                                                                                                                                                                                                          SHA1:4FAD6CB8438509DAB1EEB727C57F44B2A50E211D
                                                                                                                                                                                                                          SHA-256:88E168EFE1A2F676AE30109D69106C099C2DEC149561E5923C2FB1FACF7BD57E
                                                                                                                                                                                                                          SHA-512:0747D21FB24616962B83F308E412034CFAEE78364AC1388852EDEBB189890AE33B1FE8C014C787455A4EF7D07C71E7164FF39EEBA5F1D9B75EC435990B16F519
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a<......NNN.........!.......,....<.....2............{...H...J."..2*.............Lf..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\elegance\elegance\trough-progressbar-horiz.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 82 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):664
                                                                                                                                                                                                                          Entropy (8bit):6.936576746006585
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:ae2Ab/2VzwEVi2+w7uYR0aFjClFGElVCP3VL5i7IMW:ae2AbNEViq7hqaFURCdL5iA
                                                                                                                                                                                                                          MD5:76C3CA23E4392DC5D22B8293F54B5D2C
                                                                                                                                                                                                                          SHA1:75BF28B67EE7CFD51C157374C9944B91BCCBFEBA
                                                                                                                                                                                                                          SHA-256:5ECD9E66B921A3932760791EA751FF5CCA75EE9DACC0DC872266F127D158838F
                                                                                                                                                                                                                          SHA-512:04C1319A2292C9034FC92F90104AE5D2C8F671ED8DF078154BD094C4090D2EA2B083B2F9D50F1DB4319DFC70BD6C00AACF62A2881A2B623F4A67E5CA69C225F7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89aR......KKKppp{|{||{{|||||..............................................................................................................................................................................!...../.!..Created with The GIMP.,....R........pH,...r.4...tJ.Z..,...z..xL...m.0h....@.....AA....k.vwwx....kqp.qzll.iC....................k...........B.............................../..........................................H!`....V.8p.@...9|......,X.p..E..4Z....."1\....J.'.e.9....Oj4.......2.......:p.).CS...:UZ.iQ.O...)B..F....C..^1t......!D..+Wn.x..%....!.........W.........H.bE..+&Sv|.Dc.....9E..1Wn..2?..c.M....s.......4.N...$A..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\elegance\elegance\trough-progressbar-vert.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 15 x 82
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):677
                                                                                                                                                                                                                          Entropy (8bit):6.9985807010982315
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:Se2Ab/2VzjND7IBXyGWuJvElLQHPz6fG/CJtb4+qdnE/j:Se2AbKtIKwjz68Gbquj
                                                                                                                                                                                                                          MD5:D50BC21CBCCC8A71C7513201BDEB4560
                                                                                                                                                                                                                          SHA1:361EBD528991D0A1611510DCFEAFE79705E42372
                                                                                                                                                                                                                          SHA-256:79F8AFF1881A7CEBBB8E3CB90588256D4AA84A5283405578A4DA5B6E5728613E
                                                                                                                                                                                                                          SHA-512:FD50CA00D7331B141A1C8D151494683933250178FFBB6735285CF834E25783E4E2717AC2EC903144D4CD0856FEE0657C973EE5614D8ADC4D8EE9759E02EEDE80
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..R....KKKppp{|{||{{|||||..............................................................................................................................................................................!...../.!..Created with The GIMP.,......R......pH,..C.r.\.....!.\<............v.....r_..z}m....5..ilv~q...V.}oP...{m.^.j...&w.h.....e.^h...%.x.W(..ik...RaV..g`b. .........S...`................P.c.j........ *...t....V....%.YS.0Y1:.... m.%)....&...+...2`...S.....R.t....P..|.(...F..A.H.".G...j.stH...g.A.g@ .L.......{...Z-"...\..v.c2....E.'.......eh......hSi.Q..SwU$....o.Q.c*.:...9|...7.i......l.+[].D....Y.M..#..(.8./.3H..S.t.....VgYS.:....s%H.K'...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\elegance\elegance\trough-scrollbar-horiz.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 64 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):803
                                                                                                                                                                                                                          Entropy (8bit):6.161690711584306
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:s8M4KE7PYsrTy2ZLg8mtlx/Yv3VfHv1R+hBbbLQ6+r72JE0lW3i:sYKELFZk8mBYlRSs2J5WS
                                                                                                                                                                                                                          MD5:187E3497009C677DCE352C7D2BEE8B0A
                                                                                                                                                                                                                          SHA1:82D74A0CBABF4B15322C6D9E8D690B46C4D04198
                                                                                                                                                                                                                          SHA-256:696B0615F6EABECD8B7DC5E0212AC7C74E9B23DFA1CBE4D50BEC48ABD3BE516C
                                                                                                                                                                                                                          SHA-512:036D199E9325C704D40A92353A97AE998F15D649436DA24FDAB2B7D70E68A38143FE2BF950716B2ABEE20326226C5335F3C4BA8CC35FA1D5BEFCC30E85B0739E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a@......EEEwwwxyy{{{{||~~~..............................................................................................................................................................................................................................................................................................................................................................................!.......,....@....................................................................................................#.#................$.........$..... ..}.H.....B...6...".|.E.HH.aBr.Q.P.....%S.T9r$..$I.l9s.)i..I.......@.Cg.G..\.4iR.Lu.R C...V.b...j.Z.^.AV.W.f.z......6t...-[.xm.{.o.....;X..rk..|C..A.tH.Ly.e.?.k.....A_.......)]....>......m.@p.^.[..!B.......!B.._.Z.s.B.#o.<8.!A.?..........;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\elegance\elegance\trough-scrollbar-vert.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 15 x 64
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):871
                                                                                                                                                                                                                          Entropy (8bit):6.39501825920392
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:coLM4KE7PYsrTy2ZLg8mtlxHMeZNMU+A5PgQXV+gfZpd6Cb0q31mkdS5n:cuKELFZk8mBHMeDTJgQXV3T6Cbj31mx
                                                                                                                                                                                                                          MD5:836665A62EAA358264AD1ECFBD624C05
                                                                                                                                                                                                                          SHA1:CBBF7A649FDAFF26BC6443AF106ACCD72E7FCFC8
                                                                                                                                                                                                                          SHA-256:C966021CE456BF4CF7170B14E65FB62DD779300011266087BAFCE6DEFFC947E2
                                                                                                                                                                                                                          SHA-512:09529466A86FFD196C7B4D5AED8D67719B3F0E28DB38262C77F14D777578615CBA3A9B88D90AAA90193CDC89CE0BC890E0B78F678FB5D0F1FF4DAA945B25025B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..@....EEEwwwxyy{{{{||~~~..............................................................................................................................................................................................................................................................................................................................................................................!.......,......@...............................--35;@B....#...@....-59;......9@.... #(..........3....#'.9......53........0.AC.....A.......;.....;A.. ........P...]...n....`.[.r8<.1..i.....aZ..##x..Cc...\.hY..8h.Z.U0.M....*g.OA..*.j...EO.`&k.Q..Z0C:.)Ho...|.*..H.@~..T...)....._..:....a.+.;..@.pZ...!...,)>..6.PY*....u0.b../.=..g..O.4...R..6.jm...[#\...Z.%..P..i.1P..mC.D/dm..7.H.m.JTk.~0J...d...-f...O@^..t..z.........5...Zl4...C..@.7XQ..../....c..R.R?m..<.d.@ .;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\elegance\elegance\trough-vert.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 14 x 60
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):133
                                                                                                                                                                                                                          Entropy (8bit):6.014041380867768
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cv8PqGl0xlllqzOfRE/8+W1umFit32zwvBfO98voKfZWAge:NPcjji/89aFTpSX2ZWAb
                                                                                                                                                                                                                          MD5:FAC9A4C0DE28B74133A6B11353EEF0C9
                                                                                                                                                                                                                          SHA1:20C27F2E5AB87017994304215B344B232328E1AE
                                                                                                                                                                                                                          SHA-256:C3805D91DBC21767FE55FA776B3E6A7D0EAA48B2CADD3F7BF29F171AB17968B9
                                                                                                                                                                                                                          SHA-512:D2751946BE8A431B12EB22AE829786998023F0C59F5969D37B5BC0D4E4B3BFE1EC8E33B339679225D9A85CC59127E0313F31CAFF87BD98CFC5A6D2708EF4873C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..<....NNN.........!.......,......<...V.o.k.....j.nz_.a..V.YF..2..J1...y.9.....h..x4..JP......4.:.Xk...o.8q..3..<u.......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\elegance\pkgIndex.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):154
                                                                                                                                                                                                                          Entropy (8bit):4.3451726862339815
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CkURi8MJw7BMq2Lo49lMQ9+btQaXFkrQ+l7BMq2LICv:CE8MJ0BAo4MQ9myrQ+pBA5v
                                                                                                                                                                                                                          MD5:35C7721A62A755646DAA02B0F853445C
                                                                                                                                                                                                                          SHA1:8CF7464913ADD6A92D31AC8CBD714799C85CCF28
                                                                                                                                                                                                                          SHA-256:E81B6F1DBE75E5AC19FCE398FF3FA856136C95F2D45E3D17A8D01460A2B8AE29
                                                                                                                                                                                                                          SHA-512:37EC4A9DA819C4FE4256330A5B75054642D736CCFF7644877A2E3CF0908F0D5C74CFCEA8B115091D71CEDD042D9918D44684A45AB479BE4065E2F08393788786
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:if {[file isdirectory [file join $dir elegance]]} {. package ifneeded ttk::theme::elegance 0.1 \. [list source [file join $dir elegance.tcl]].}.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6517
                                                                                                                                                                                                                          Entropy (8bit):4.7919581945843674
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:JQrhNNGeaCyRRBUiOD1yUbUmqFakcqH85rr72XvdUNOQQK2V920nvPDz:OLNGbCyRR21PUmc5VAr72Xpvz
                                                                                                                                                                                                                          MD5:B2085A4D29448291381C3507CDA54523
                                                                                                                                                                                                                          SHA1:A22EC08B693EA86EE5F8739F8263BF710D0F71F2
                                                                                                                                                                                                                          SHA-256:6993A95DBAD91BF5DB9057BF4C08944760967A18BB0DC7F89EBD49CDF462BBA6
                                                                                                                                                                                                                          SHA-512:646FAFB47E9602ADB950ECCB0226B58F9267FB10A88D564C8C288F85C8F974D8A013E351682E9D60C721667B52D23DE68174E5E5653955CEBBCF0D93C35BE8A9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Part of the same project as smog.# Available under GNU GPLv2, or at your option any later version.# This modified version only available under GNU GPLv3..# itft1.tcl - Copyright (C) 2005 Jelco Huijser <jelco@user.sourceforge.net>.# Based on sriv.tcl by Steve Redler IV <steve-wikitcl@sr-tech.com>.#.# itft1.tcl, v0.14 2005/08/11 Jelco Huijser.# Added support for treeviews and alternating line colors..# itft1.tcl, v0.15 2018/08/18 RedFantom.# Modified to support ttk instead of ttk, indentation and formatting.# Combobox Down arrow is currently vertically stretched.# TODO: Implement support for OptionMenu widget.# TODO: Improve Treeview heading.# TODO: Fix Combobox down button (either change down arrow or -border)..namespace eval ttk::theme::itft1 {.. package provide ttk::theme::itft1 0.14.. set imgdir [file join [file dirname [info script]] smog]. proc LoadImages {imgdir {patterns {*.gif}}} {. foreach pattern $patterns {. foreach file [glob -directory $imgdir $

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\arrowdown-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):349
                                                                                                                                                                                                                          Entropy (8bit):6.851064217213505
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DDGJ5OYMjE8HA9ioO4cduu9nFR8EY79ujuPSE+j6EsSLZn/HU8zUAJYSgyn:DDGJjR8HA9isKnoujx6yEPI
                                                                                                                                                                                                                          MD5:325AF95E807B4496D9A5A6D81B21316D
                                                                                                                                                                                                                          SHA1:06E6310AB18562479A9E7C948EBC4A4AD91A48A7
                                                                                                                                                                                                                          SHA-256:7AA7744CB7699CF59B5C81240A9F3A5838E610362D7C85584586B5AF2BF7C31D
                                                                                                                                                                                                                          SHA-512:F1880D072700BFE3FD68D47EC680BBCA969988E1CB19CBCC1829D586A7A3A3A3959B6E090B57D5EB5AC3E239D516CD10D99AFBB0435AC51CF1DA6D56A78DE5E6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a............(..(.+B!=\ >\!>\l1X*Ovn2Y*Pv+Pv{Ag3a.4a.4b.=s.=t.>t..g.G..P..Q..}.......Z..Z..Z..i..i.....x..x..........................................................................................,...........@..s)....p.H....c..0h/..u..:..1.m.P%..I...W..2y....B.8.....y..2...........X........20-..._.o2r,.."...qshj.nV1Ytv `b.LNPORTBDGFI$A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\arrowdown-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):345
                                                                                                                                                                                                                          Entropy (8bit):6.867814414962782
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DDG95ODVlIA9ioOw5j2RpYFLlKW7974PHuc0/BTwXe0wxrGgFen:DDGc+A9ikACLl7JauFJTwe0wxran
                                                                                                                                                                                                                          MD5:865FEB8C2D032DF32599C2C525B23B55
                                                                                                                                                                                                                          SHA1:90B99DCE87AFCDB8B7C4A0C82700DF5F75B481DA
                                                                                                                                                                                                                          SHA-256:760B2436776EA02D9705E71094EE1607266D579A569E7F8EFFB48EC6BCF3D90A
                                                                                                                                                                                                                          SHA-512:BBC1451693CD54AE628A6477179F0C57FAF47AED9E81456126D9FFB6D5E278AFDC25A597D5A7D5F1635D7D12FF0C42D46E5B0B6760A34533C9DC931FD2B0787C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a............(..(.+B.+B.,B!=\ >\!>\l1X*Ovn2Y*Pv{Ag3a.4b.>s.=t..g.G..P..Q..}.......Z..Z..Z..Z..i..i..i.....x..x..x....................................................................................,..........~@..b)....P.X$..EC..48...b.b..q..H....(&2..:.r.d.7 P00.....y.o.......3.o......`.p"..._.n.q%.+v..d.gi*-l.Veri^`b LNPORTBDGFI&A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\arrowdown.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):349
                                                                                                                                                                                                                          Entropy (8bit):6.901947538852676
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DDGJ514CEAjK9sO4cTm9jbnFR80NSKbYbAcJiinDbiAeXV9mIZRwkuK3DzGOQJ:DDGJs5cK9w1bnomS+4JiinDbPeF9NEY4
                                                                                                                                                                                                                          MD5:3C4E8F45DD9A38740A1A49FE0B0BABE0
                                                                                                                                                                                                                          SHA1:DBBEA97B816AA5E10C8AB53D02DAAE959A3291E1
                                                                                                                                                                                                                          SHA-256:5C2824A7236CF3C75A60771E7BF65BDC31E80AA8EE06EA7099F4B76A70204A92
                                                                                                                                                                                                                          SHA-512:D08704E7BCB157C4D762ACA027EA006C13B03155628BA610F831410C64BE758F635040E733415EE9D3B799425CFD37D85723CE58B850AD229CF9F7E08A8FA314
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a............(..(.+B!=\ >\!>\*Ov*Pv+Pv3a.4a.4b.=s.=t.>t.G..P..Q..Z..Z..Z..i..i..x..x....................................................................................................................,..............*.......h....E{}f,.i$.d,....M.F...2..52V.D.y...$.i,.....y+.1...........X........1-)..._.o1r'......qshj.nV0Ytv.`b4LNPORTBDGFI5A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\arrowleft-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):346
                                                                                                                                                                                                                          Entropy (8bit):6.799546995330483
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DG+AlPfGRxA8Y4SRWwKQb/FsTGvIWrhmmt6HLDiDuA74WgbGFw:DlcPfGRjZwKQUlshmb3NehgbGS
                                                                                                                                                                                                                          MD5:12CB5B234AFE725913F07A85DAFB9785
                                                                                                                                                                                                                          SHA1:B20AA5136EF7246F712ECBE577C549A3BBB61028
                                                                                                                                                                                                                          SHA-256:78C4EF9C0B0CA209CEF5A03230D492E1ED77DA9ACC556119113E96D5C184D92C
                                                                                                                                                                                                                          SHA-512:8F7AEF025FFB3B7A3D03E914AB0FCA7C301AB3B88597A5A7FABA21F10C94E2D4394113446060F69984F8BCF7AFD9E2A3F3CEC02E4841EC863BDCAB095333CC6B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.....4...#.%8.3M.4M.4N#Bc#Cd$Ccl1Xn2Y+Qx+Qy,Rx{Ag3`.3`.;n.;o.C}.B~.C~..g.J..J..R..}.......p.........................................................................................................,...........@QG.)......H ..D...4`......f..1.R.Z....J...xjB..R)..t*A".%&&z..$$....$#$..........! ......................nV....b.LNPORTBDGFI"A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\arrowleft-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):357
                                                                                                                                                                                                                          Entropy (8bit):6.88517983035333
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:D7/iIGOJLs2UDlXuyAps3h0VtsmCLajmRx+j+0mEKdFigV:DOIlJA2UA9pW4/A+wx+j+VbiM
                                                                                                                                                                                                                          MD5:1BB39F8896F2748C370483852DC2BB6B
                                                                                                                                                                                                                          SHA1:D60A0BFE69327F2162B6062C4938B15C80E2B405
                                                                                                                                                                                                                          SHA-256:8BDA91197750D1195ECC6D764C22A0F81C0CFD30E37BFF637C4075DAD6741D5F
                                                                                                                                                                                                                          SHA-512:EAADD5A106E0FC4755516E37D60787998A1668E78F52441A9A09B73F0C1CA85B55E9949302DD3CAC25A45BDD92E2E932A0F2169142398B0C68596385158D428F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a............#.%8.%9.%8.3N.4N.4N#Bc$Bc$Bd$Cdl1Xn2Y+Qx+Qy+Rx{Ag3_.3`.3`.;n.;o.C}..g.K..}..............................................................................................................,............Pg.)......i0..F...D<.....z".h<...cQ..0.L..A.61.T.P8.R''w..**......*..+,.....+..-//..../...2021...0...55335...4kV776.7..6`.LNPORTBDGFI!A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\arrowleft.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):346
                                                                                                                                                                                                                          Entropy (8bit):6.853030692149868
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DFpblPfGRplXkLuaWQKBb/F89vE9v+tilmnOLuRSXo24C+s7QX+YnwkEk6De:DflPfGRF3QKBb5AilKRSXb4CzYwkNJ
                                                                                                                                                                                                                          MD5:914DC9FA613E6979BDD443F377D041E2
                                                                                                                                                                                                                          SHA1:61C448B1525B952CAFE8A71786B9B3BEFB7425F2
                                                                                                                                                                                                                          SHA-256:1E5D38E0A185DA848742E8BC7C4D57D8307A0BA1466E7F70CC0F567B4A6F6C88
                                                                                                                                                                                                                          SHA-512:6BCE08FBA5925D7A4B408E8CC6E611189107882548BC17638F8C403E8A6E3ACC812558143CF950C16827F45AA79CA30DA27D131452E6C446C2090BCF4C21D73D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.....5...#.%8.3M.4M.4N#Bc#Cd$Cc+Qx+Qy,Rx3`.3`.;n.;o.C}.B~.C~.J..J..R..p................................................................................................................................,...........@.l.*......X..K.4cu^-X...d....2.R......-.8..y.H$.[$.5.. !!z*............................................nV....b3LNPORTBDGFI4A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\arrowright-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):349
                                                                                                                                                                                                                          Entropy (8bit):7.174646005079001
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DD4xd0u8pkuxkTYdhEAhWwKQb/FsTGvIWrhrGQrn0L37ac2FZ/VPl3Qn:DD430zpFdqA8wKQUlshrGQr0LLac2Fv0
                                                                                                                                                                                                                          MD5:69F76FAA851D9D103B110E3F381FB9A6
                                                                                                                                                                                                                          SHA1:3B1E540E39F8EAC98197D3774DC92F7D50C19CC9
                                                                                                                                                                                                                          SHA-256:7EFC8FD5CD42AF0CDA2524AA5B479FC53E196C7AF40ACBAA93A970575C986EFF
                                                                                                                                                                                                                          SHA-512:15367DF2E72C641DA5D434FE17BE53D81DAC01E48A51100C1C76BFB453B83DB77452CC483E3C09979EEB7E892E92D2C9697126B480CA6CE8A38CD66C7AFAFE5D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a............(..+.+A.,E./G!<["?^#@a$Bdl1X*Otn2Y*Pw,Sz-U~.W.{Ag4`.4c.5e.7f.7h.=s.=t.?v.?y.F..g.G..H..O..Q..}.......Y..p..............................................................................,.............I.*.."...a(.PF.c.Er7....x...a..> ..F.1...|...b2..........//{!.-......,-..('(.....*).%......%.......E.....%oV...%b&LNPORTBDGFI+A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\arrowright-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):350
                                                                                                                                                                                                                          Entropy (8bit):6.816721618287912
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:D7d4XfkvUsRSXuN3s3hUItsmCLatKSvRg3BTpmp99jsZnMgJEn:D6mUGNmWQ/AEKiRgHejjsev
                                                                                                                                                                                                                          MD5:7DE031C8722B7B09506070DB1648EEC9
                                                                                                                                                                                                                          SHA1:4FC9D66BA5E71B00D36AC971F933EA52A6E87EC1
                                                                                                                                                                                                                          SHA-256:BE4EE7DBC7BD17C9E2BAF5F5461B59D95173119C752520C1F50236368DF74293
                                                                                                                                                                                                                          SHA-512:3F5562E128B0181EDA63A1803291F251424A1B7FAA2204EC74B86B2AAF062B91235185810FDDD363552624E36DAF7DE124795071C23E08980BC3D68BCA216EE0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a............#.$8.%9.%9.3N.3N.4N#Bc$Ccl1Xn2Y+Qx+Qy,Qx{Ag3`.3`.;o.C~..g.J..}..........................................................................................................................,...........@N.b)......X(.....<4.M...h..Eg<.......H...G...D.H$".....#........%&$......'))....)((.,*,...+*...//-.....iV110.0..0`.LNPORTBDGFI.A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\arrowright.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):349
                                                                                                                                                                                                                          Entropy (8bit):7.217309864322876
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DD4xd0u8pUuCyTYdEsraWQKBb/F89vE9v+tiq4/wbQMu8/GNlJQVoU2uMgOe:DD430zp18Esr3QKBb5Aiq4/MZu8mQV6e
                                                                                                                                                                                                                          MD5:882E6E5535FB4B7919672DA0351B06B0
                                                                                                                                                                                                                          SHA1:819E5E7762E6AA5F2CF582C0B8844B38A274C393
                                                                                                                                                                                                                          SHA-256:14950877F6BC3FCEE68B75823F5F76484E4BBA9B2AE2047C709D7A5441CE6080
                                                                                                                                                                                                                          SHA-512:F77E2526CC2F77DE06902910B3A9F451D450A866790B06EAFFCE713BF6385A397D7B8AA4B30F49199024DC5472B5820123BBA554230798A1B70FCDD5990B2BF2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a............(..+.+A.,E./G!<["?^#@a$Bd*Ot*Pw,Sz-U~.W.4`.4c.5e.7f.7h.=s.=t.?v.?y.F..G..H..O..Q..Y..p.....................................................................................................,..............6+..4..e.}.P....p.\.v..v9.1${.6..L.........X....Z.(...)**{3.(......'(..#"#.....%$................E!.....oV....b<LNPORTBDGFI=A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\arrowup-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):309
                                                                                                                                                                                                                          Entropy (8bit):5.987087836902387
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:bwZHwD9MS6/vMNp/Nh2XmzUPQ9AZKrmW/:bwZmMBE71h2KmW/
                                                                                                                                                                                                                          MD5:CE6165F2A69D3D09773A4C6ED2BE7E5B
                                                                                                                                                                                                                          SHA1:EC06A2D00D6A3F844867BD226DE42C1EAF9E7BB8
                                                                                                                                                                                                                          SHA-256:D47A9B4D38A995316B3E0E15FEF00213BC9002F4B438FF66E87D587AEB128A11
                                                                                                                                                                                                                          SHA-512:19D835DA1B03599047EC25561A6ED367DBC38B1E71E736852124C6D177D5FD51AC6102759618C691017935BC5AF33FEB4AD066483E8D330C5B883E1FC99F1EAB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......f..[o.--f/0i`}._..o..>F.^v.>D.p..z..t......g.........00h...47r...24p...46t......68w?@t......`s.//g=E.--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f--f!.....?.,..........R... (......X(....P..L'TJ]\..g...b...bZ.f-ju....g.....ZQl|o[..O.sE.h...WBDFEHE?A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\arrowup-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):347
                                                                                                                                                                                                                          Entropy (8bit):6.90986545935917
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DDGJ5OYMjE8HA9ioOw5j2RpYFLlKzJM/dnGUG5ONHvmMBGPVEj:DDGJjR8HA9ikACLlMJ+Ub5KvmMQNq
                                                                                                                                                                                                                          MD5:A2321DD23E6273A3781CD2550851673D
                                                                                                                                                                                                                          SHA1:447D771E7DFA3B79393900C1EF3E3B772D48A97E
                                                                                                                                                                                                                          SHA-256:D02F981FED7F607EFE3E60969C03F2BDC61B03901A07D64759F595D4BAFE29E4
                                                                                                                                                                                                                          SHA-512:EAC5CCB3255A7F77530D50F1FC18CB5C200518FFDDCD80D89917A2FDDC36509053B37F4F4FC4CEE054D722270C35BFEF8881F597349EE040A126CDA5F8F8E216
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a............(..(.+B!=\ >\!>\l1X*Ovn2Y*Pv+Pv{Ag3a.4a.4b.=s.=t.>t..g.G..P..Q..}.......Z..Z..Z..Z..i..i..i.....x..x..x.................................................................................,............S.s)....p.H....c..0: Q..j.d5.1...J....(.4.RI.X.b...c. ...24z.o.........o......5............q&i,w.Ed.gi+.5mVeri^`b!LNPORTBDGFI'A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\arrowup.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):349
                                                                                                                                                                                                                          Entropy (8bit):6.90968473170917
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DDG951DxlMa9sO4cTm9jbnFR807GSKbYbAcJiiyCNh7xo7BQXnQ/WOTRPB5+f1FJ:DDG3ma9w1bnoIGS+4JiihNHoSXnQ/Bdo
                                                                                                                                                                                                                          MD5:F074991A50F6E19EF602402A1BBD53BC
                                                                                                                                                                                                                          SHA1:87A4D77F0D1EF59E129A83D7779AB4758F4826F6
                                                                                                                                                                                                                          SHA-256:7DD5215334B0074A6F247EC457E13C3341A7002598849FE35CEF7CC1A0254465
                                                                                                                                                                                                                          SHA-512:D6B0EA49660273423CEE8A6B4823C6E3D8CDF0AD6C7C654609CC69BEFCB7F425B8F7C52470841BF5B643C41A2320CC8DD67B89820F613A83F97B553C5B66D2BC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a............(..(.+B.+B.,B!=\ >\!>\*Ov*Pv3a.4b.>s.=t.G..P..Q..Z..Z..Z..i..i..x..x.......................................................................................................................,..............*.......d.P..D{yf,UI..`*..q.M.D..."..32V..Px.....j0.._.y+.1-.......z.............u.....1r&h._.E.qs...m+V0Y&# ..aILNPORTBDGFI5A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\button-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1669
                                                                                                                                                                                                                          Entropy (8bit):7.282863503783164
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:3aRYD3xKVIT7bd6npeHKWRuQThg2Wa8ug45IDZ7U:3AgKGjbhg2W+YDZQ
                                                                                                                                                                                                                          MD5:06124B863035E0996D0B859FC094C1CB
                                                                                                                                                                                                                          SHA1:3E245658060506BABAC31176F633F24C27F2CE99
                                                                                                                                                                                                                          SHA-256:574C5FC5F657029298B037DB9AE50B7426D4156DDD6C6E4DA9F69B6694F73EC2
                                                                                                                                                                                                                          SHA-512:643E8F2205768FA7D42EA616E2393F4CC72A08114303BBD426B4C313AE0357E7724994856E63419AC560D28A7856E8EB6C91CD49104D43441D14B22244C965AB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a . ...Jo.Ln.Gp.Kp.Hq.So.Ns./|.Vr.Ws.;{.Ov.<|.4..?~._v.T..C..D..F..@..P..A..e..f..U..7..P..l..Z..s..w..>.._..Y..L..x..M..t..C..O..E..d..Q..^..S..T..{..c..X..Y..b..[..c..h...e..k..^..g.._..h..m..g..i..n..h..o..q..p...q..k..r.....m..y..n..u.....o..v..w.......y..z.....|.....}........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,.... . .....Y..H.....M)......#J.8H.BS.u......$ C.......R,.h....[.h.B...4..p.b. ..n.....M.(!....J.,u...JV.d}.*.[.^..+V.].j....OS.T...K#.c...KR.....Ru...[..+^.....`)i9...(+t_.R..g.V...JV-IV....J.%X.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\button-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.280940825131361
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:3naScbYwLzJXxmRI1yNekASzyL7SoDS6XUvHPZi4+tBzuoXByYuCqBzn:3naTbYwBm+se0y/rDZXlzzu4ByYuCMz
                                                                                                                                                                                                                          MD5:6AD784C6C30F50F396A8E75DDF0EBA34
                                                                                                                                                                                                                          SHA1:FBB9A6B2EDF61A1397EF028980A523CB29A0F0A3
                                                                                                                                                                                                                          SHA-256:19F24063195ADDAD3EC1CC566C7A332BB03DCD2BF10643F80BFFD0C9879BDF6E
                                                                                                                                                                                                                          SHA-512:3127AC9AB20C659D28CD171A69A908980F9C75677FA5F322AA8A2A01B8A266C5DC617BA049F3791BD3AB9909C6505728BFD4A03796E9C0DBC4BC376244FEAE8C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a . ....Lm.Mm.Dp.Pn.Eq.Qn.Sp.Sp.Tp.Tp.Sq.Sq.Tq.Tq.Kw.={.={.=|.=|.bt.=~.A~.B~.\}.@..I..I..E..N..N..k..G..k..R..R..V..W..s..s.....[....I..I..I..I.._.._..z..{..O..P..P.....c..c..V........g..h..\..]..l..c..e.......g..p..p..j..i..t..u..p.......x..y..v..x..|..}..}...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,.... . .....9..H.....y=......#.U..<h.,....%G...1#..^..j.2...0]F!..F...h..uE..?....J...;j..X.3U*-j&......X...&.S..@E...Y..h.E...(-pZ.$.O.d.....Wo.`.......@w.*.,X.),p&Jt8....G.X.Pe...g..S.>.C.v....<.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\button-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1667
                                                                                                                                                                                                                          Entropy (8bit):7.602269431524809
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:3mAAymNStRj3rUucV+/ieW23Fa937AFVCVlyykpB:36ymMfjQhFwaB7AFVKrk
                                                                                                                                                                                                                          MD5:3FA3DB31AE45BCC142819DF657CC9350
                                                                                                                                                                                                                          SHA1:8B31457BFE0EB8AF1D0ABA52FFBB696DDFEF441E
                                                                                                                                                                                                                          SHA-256:AD6F0DEB270AF150917D8063C53652CC0E51E20FABAC65E93A57D012A20D59DA
                                                                                                                                                                                                                          SHA-512:F2B89E78D592F8CF9EE3CB54F2D71FA8060244DF87F5D92299D3DB98EDFA8647C80A2D504FE413361D3CD61FA09DECE74E0A4AB45032103B8C66328EC184B03B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a . ....Uw.^..xx.yy.e..`..f..a..O..h..R..c..j..k..e..a..f..U..g..i..r..n..j..i..d..o..k....p..l....]..v..g....M..C..O..E.....P.....S..m..T..u..U..W.....X.....Y.....b.....c........e..].....g..h........i..h.....q.....k........l..u....................................w.....x..........z.....|..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,.... . ........H.....w).......#J.H..].q.v...4JB&.I.$. =^.0.H..].m...A..89...s...-^..B...<.8....P.F......(...F....s.I*Th..h...4...&......;t....o..}.....2.....".1es90A..H..*_`..Y3..=.pZ.GQe.li..h...7

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\check-hc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):392
                                                                                                                                                                                                                          Entropy (8bit):7.100156937964658
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:H2T0OMkSreP+OlHQ3/frmdOxH2C5555555Nap/EvLDJOHHehyJ9CL:H2T0kSyPflG2C5555555sOLDoHXfCL
                                                                                                                                                                                                                          MD5:1DFA35D75D53872E0FD13E4FEABB1537
                                                                                                                                                                                                                          SHA1:95B630ECFC18833FC4D11FAD6B6D0B2F5F9009BC
                                                                                                                                                                                                                          SHA-256:0D5AFE26CB151006FA54B8BC084BB4B8BFFCD2241E6BCD86FE8D37CB7C98DCB4
                                                                                                                                                                                                                          SHA-512:02390C40482ADCF2492E939B3A1EE7442677DDEFD99772B6361624C94D9256C9AEC598ABE066999297EB5EE50F35C49499F184BD9968CEC2B72956BD99A4C8C6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....6.lY.lY.m].m^......................$.$&.&&.'(.(......e.zN.N.....P.PQ.QS.S^.^_.ab.bc.cd.d..........................................................................................!.....?.,...........@...)....4......9..(!.v..Q.EAH6+..2. ,....8A.....~.'d.a.+y|}.3.v...0|/..5.uw+..1z(..z.l3...5%..{.vm).......wn....|..4......x&..-..c3..'ge2!u..Y".\[!...LNR.TBDH..JA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\check-hu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):240
                                                                                                                                                                                                                          Entropy (8bit):6.441720578994884
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HgywMiz7C5555555555N6+hoQFj00sTmSmcSVFv:HyMiz7C5555555555fhT00sTmdv
                                                                                                                                                                                                                          MD5:F8ABCDAD751D63B99B72FF4380290536
                                                                                                                                                                                                                          SHA1:1625D79A20862666B7DFA003B8BE1BE886AFFEEC
                                                                                                                                                                                                                          SHA-256:F98515ED231C0B578F623F3B125A96EEDD91EEABE79899C6A4235C4601F49493
                                                                                                                                                                                                                          SHA-512:1D4BC1FFEC8F4A8058F82C122732EA6CD6C7C9545E4247541A2702C834A9A197C09CEC8C0F58FDB2FFC09522302E6172931C19C2D5D03546DB022BAC9104C9B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......lY.lY.m].m^.............................................................................!.......,..........m.. Gi...0C .p........|b.%A..).... ..D..(D.<....v..V.N.......r..%[..v.mf..k......qwCG..IU..9<.....,.2.4"$(..*!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\check-nc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):389
                                                                                                                                                                                                                          Entropy (8bit):6.9760453820930115
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:HqkSvvCZKNjSgT2C555555555s5B6PWBz9HgX2o/oEr:HcvvRNjSb5B6PWBaGogEr
                                                                                                                                                                                                                          MD5:46BD91E7012017DA84243AA046D75F64
                                                                                                                                                                                                                          SHA1:763F8B04BE15F19263A1F83787140BEDF479B8E2
                                                                                                                                                                                                                          SHA-256:6CDF7DF3271A4B8FFCFFDB2EBC026EAE14942F469FD9393C58DCF8AED0D2CA12
                                                                                                                                                                                                                          SHA-512:F2257D5AE9BD5688FEE9D6E436FD01421FDC181CF52577C3F0855509361C9886F8E38FBE3A84C38CA6F7B67054D7155F361F871A210E318D935E458ABB0E3CDB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....4......................$.$&.&&.'(.(...N.NP.PQ.Ql..l..S.Sp..q..^.^_.ab.bc.cd.dn...........................................................................................................!.....?.,...........@...)..F..4.H....9.tL..vk.....,F..a.......p.I...e..>.....(x{|.1.u!...{-..3.tv(../y#..y.k1...3...z.ul%.......vm....{..2......w...)..b1+."fd0&t.WY.[Z]..LNR.TBDH..*A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\check-nu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):238
                                                                                                                                                                                                                          Entropy (8bit):6.199448362839729
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HGscJwFSxgC555555555555N6jN7DX0NGlEQydel1MCshJrmWg:HGrwFSCC555555555555AL0NGGJevCQ
                                                                                                                                                                                                                          MD5:CD862BF9DF41D88F7AEEA2A13AAA0216
                                                                                                                                                                                                                          SHA1:4E5B13EA0E88318FB28F55C97CFF5D3CD6979566
                                                                                                                                                                                                                          SHA-256:4EBA2363C4EC5F36E20AC6053F940C8E359B971DE73F1C3C775D8F7761FE7BFB
                                                                                                                                                                                                                          SHA-512:7906AA8154823D5B0347AD6208458BF83ACDEA3E49B9FD85EC9A6F911DB46462991AF24DCBF6E201FA9DB12C69F0995999A5A42F5A2DBD60D2B0A32DAE018E11
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......l..l..p..q......................................................................................!.......,..........k ..Fi.&. C .p..c@$J..I...D.A,....P.x8.P.Bi.0...V+.Z..pw..s.d.9;.^.l...n..u......vBF..HT.7;..=..,.2.4"$(...!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\radio-hc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1130
                                                                                                                                                                                                                          Entropy (8bit):6.4654234041974625
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:HQzCEPa0dDPJ+cNTGUQeGpjwTfsJEW9ULXJBv/9onLJtaE5W6WkuJV9:w+EPa05wWTlQafsZUtOPaE5WXxv9
                                                                                                                                                                                                                          MD5:2DEA3DE27C302E6E65FE11EEF08E1BF2
                                                                                                                                                                                                                          SHA1:E5A8BF4C73D7B5CD0367E7EC57D40F8A89113C36
                                                                                                                                                                                                                          SHA-256:2E89DFD8BCE5D831730BDDC98D751E04FE47C11A25E6427A7CC1107C41B6A295
                                                                                                                                                                                                                          SHA-512:7BD3CAA9D4A46BAEB2D1B1616B4231771C81A4849FB36E01AFF273FC227D6804614134B0A44C4CC08C526FA30BFAEADCFFE9D06F158AE105C8AB7853B4DF74F7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..........................................*-4.8E/8D1;H3<H5?L7AL9BO:CO>BJ>CJADIBDIKQXMQXRTYuAfuBfTX_TY`VY^VY_~Ps_bh~Qs_ci.e..h..k..l..m.~..~...v..v..w........................................y.....{..{..}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,............I......"8p....#O.F...L..&2jDQc.'P.Bq...D..B.,)....._8..T...#a...L../.xzT..,h..1.H..;\..0....5z.D0p`.I{..h....8@.xX....+...0...3t.d..`......Ib"..&q...!....1.djt.B.M..."...,.h.....E..iP.A...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\radio-hu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1127
                                                                                                                                                                                                                          Entropy (8bit):6.233612926498925
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:H6Wq4Tk5sCZTuUdd319kfAhB3MpOuBsseiHV5WS:aWq4TgFd3fUALmQseiHVcS
                                                                                                                                                                                                                          MD5:4178F1E9851E16F82A7C738617048AC5
                                                                                                                                                                                                                          SHA1:5C3240AE36B0C9500A0125534422DAF85A910DB5
                                                                                                                                                                                                                          SHA-256:247A72CBE05F8C7BC0D089694129A769D81DA0DE84951784029FEE4BAB0C2158
                                                                                                                                                                                                                          SHA-512:6BE7E49EE72BF6CB4FBE2001EA396F27DAD55AACDEFEC27A903A01E797BB7040BB6AAD97D73DD7EB2460153B4F7FB0E1E096051976F4922A8EAD37CF0EEE973B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........................9GX;HX=IX>JX@KXuAfuBf~Ps~Qs.e..h..k..l..m.o..o..t...v..v..w.w..x..}.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,............%E......,h aE.F.".tT.....2j...I!G.........)`.`A....C.=j.d..H.t.be.../.0:..B..S...g..+?..0(..*mz......7Xn\h.q..4>.P....."j..x....*u.T.d..%...dy. ..._...c..%K........3......cE....a....X...@.o%..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\radio-nc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1025
                                                                                                                                                                                                                          Entropy (8bit):5.527866334420751
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:HxnzC3UXxPa0iMWHp4bR5BY0D2Z3PY/jaH5w2/p31WiQngP4+fiYx9B9Y:HtzCEPa0Vo4bR5NqdGjUz5MlgPZieS
                                                                                                                                                                                                                          MD5:92190FE7ECA63A0B5D3400E0D4D4D508
                                                                                                                                                                                                                          SHA1:D723328482B9780587E6FF694471D0DE13F7AE36
                                                                                                                                                                                                                          SHA-256:C3C8BE3919BDE86016290B5A26AF6B640D3BE32289A1C5700AE6D6B565373EDB
                                                                                                                                                                                                                          SHA-512:093299178EE01EBAA24AC081EED67242A2029AD8D2A8391581CB82BCD8627FA758B98DD39983D2374780DFEA763F4FEA7631285D3D089F8742484D20A873868C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..........................................*-4.8E/8D1;H3<H5?L7AL9BO:CO>BJ>CJADIBDIKQXMQXRTYTX_TY`VY^VY__bh_ci~..~........y..{..{..}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,...............H........c&K.4t.$.....?.L.....&>h..#..%`.(..CF....L`....?.........$B(h....g..x..B...BP....A-=\..!....%.0.....!/.|..5...N..!..H..........(_...CE....<..`..2x....$.....@P!.?...yB....G..Q....2_

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\radio-nu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):624
                                                                                                                                                                                                                          Entropy (8bit):7.125864772685637
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:HKW9scFEk0DtKpg9+NA+CvPY/9haWbf1G4d2GR6cc6xgW:HKWqzZ9OARvG9MIfw4dbR6bagW
                                                                                                                                                                                                                          MD5:15F2794CE91DA6A6A4C91DB70F85E965
                                                                                                                                                                                                                          SHA1:D09C47917B63F4EDBD83037975F9DA9B8BC36696
                                                                                                                                                                                                                          SHA-256:0CD21AF3A08B15861725630551EF5BA48B62736AF4A498DE5930C38764075761
                                                                                                                                                                                                                          SHA-512:E26F64104FB40DE18057F274A1C919EB4000AC59CA45B0044F706C02BACF0E2D70A9E7CE9390071CADE0D330A77D5000F6439AB5341C5D25498E26401AAD9C93
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....x...................9GX;HX=IX>JX@KXo..o..t..w..x..}..................................................................................................................................................................................................................................................................................................................................!.......,...........s........odR<DWfo.k4...../Hl.i(.)3@D8%.Em.4.-.......#Mp.e!+...LQ...';h.T ?..twwu..I*_.A"F.Nwxxw`.V*V.C(K.Q..c.[*X.W$I..u.v..P1b....Q...0c .. ...Bo...b!A...0...%N!6GX.....=..9....;h.P.e%"8h.X."F..D@.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\sb-thumb-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):342
                                                                                                                                                                                                                          Entropy (8bit):5.9818101597103395
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DUTUzk7yXuyAps359tsVYCLauqwvZuAFFMECltbjke6jQKAFP/:DUTQ0T9pW5PVAVqcQAsEmjEj2/
                                                                                                                                                                                                                          MD5:FD2453BE02B6A641EE91B7FF844F7A42
                                                                                                                                                                                                                          SHA1:C23F78C51BFA3421B9BC9B731FF76C8AA14EEF08
                                                                                                                                                                                                                          SHA-256:71FCED188E3F9563FB319426F12341950FDF51F627E39B0B7AB6609F3228FB48
                                                                                                                                                                                                                          SHA-512:49E94F46C8576B6A00026CFF1340B24B77ADB0722B960E23C3F89818A5D60CE8E61528D01D29ECC4276080973600E348B3C510BC26DD2E5D569CB5119DA0A7E2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.....&.l1Xn2Y{Ag.g..}................................................................................................................................................................................,..........{..@(....p ....`p0...E..U ...c....."..< p6...L.=...........~.................. . .....~.##!!.."iV%%$...$`.LNPORTBDGFI.A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\sb-thumb.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):329
                                                                                                                                                                                                                          Entropy (8bit):5.730485682296883
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DDV1aWQRi8xsDKb/F89vE9v+48Nv10bi5MWinNCElgw:DDr3QR/sDKb5n8l10bi5IZh
                                                                                                                                                                                                                          MD5:62EB1AD5139A4AB1D5AC7701A89DC54C
                                                                                                                                                                                                                          SHA1:0736B1643941D27FA91023EF478B5971DC5FBF06
                                                                                                                                                                                                                          SHA-256:29BFE92CD4F75D26C16C8CDC05D855DD4F15CF9BCE4FACC4CB141E58A9DBBE42
                                                                                                                                                                                                                          SHA-512:D72E79B8ED0F202AE2F5D4682D4042666DC24E87DD457AC9E08BAE284D283C83110B000B53A0B90AF0002A43634117DA691CC5EEFE229304F983A9196AC8F17B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.....#.p...............................................................................................................................................................................................,..........n@Q(.)....p....P.b.. :..f..|@..qp.T..4."(."pI<".........w..................................mV..b!LNPORTBDGFI"A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\sb-vthumb-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):337
                                                                                                                                                                                                                          Entropy (8bit):5.977126273119052
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DUTUzk7oOw5jNdDYFLlKeA+vyHFf3hPkycq5uGfWxE:DUTQ0kyLlPA+g7PkycWuG9
                                                                                                                                                                                                                          MD5:7B1344ADB0A7D96575EA62728EACFB50
                                                                                                                                                                                                                          SHA1:9FA90D3571A1CE87CBCBAE6E5C33A3677F18344A
                                                                                                                                                                                                                          SHA-256:B6ACF06D673CEFA6DB2492BC50ED276FD0CDF00422B7DE857542B167FEFC3268
                                                                                                                                                                                                                          SHA-512:FE6D8B60A6CB18D67B6B9C98D306589A7E701ECB5A63F9AFC0F64AA356E3F9A4BF250B46E2B3D223D2944FE2153780F6D763531E55A4C327C5A1262B566A8824
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.....&.l1Xn2Y{Ag.g..}.......Z..Z..Z..Z..i..i..i.....x..x..x..........................................................................................................................................,..........v@..@(....p ....`.0.......|D%.1.`@$....(....Z...F...,.t="$y.oq...^......t.%.p..t_.n.q.i.v..d.gi..mVeri.aILNPORTBDGFI.A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\sb-vthumb.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 14 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):336
                                                                                                                                                                                                                          Entropy (8bit):5.957102649523803
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:DW3uO4cTm9jbnFR807GSKbYbAcV+l0zyCjUuJQNXgbQ2H4R0Agse:DL1bnoIGS+4V+qrjUcQNJ2YR0we
                                                                                                                                                                                                                          MD5:3464E443B01DBC26B031219BC07129DF
                                                                                                                                                                                                                          SHA1:D15D2F8AF6E87B790FC5534BA82E58510BC8C290
                                                                                                                                                                                                                          SHA-256:C241AC689654C6AD9C9971412D7393CCDE8DC189AEEC3EA45344D72EEE640977
                                                                                                                                                                                                                          SHA-512:054229065011BC1553DBD8CFF1B31F6A6E82228802EABDC86563A2B77C4630813BB40C3E1E56BF72DF008A049322DCA58F3ED882B4F97C0BBD83A8DF0D9AC279
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.....$.Z..Z..Z..i..i..x..x.............................................................................................................................................................................,..........u....)......@..P..".0B....X....1..H .E..@.. ..qx..whc.p..y......u....zr.v.....fh._.o.r~i...qs..nV.Yt.`b"LNPORTBDGFI#A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\slider-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):182
                                                                                                                                                                                                                          Entropy (8bit):6.561196531293614
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C5zlgQZZ6s7iYGfDec0RwaScM7Y/RlIYvgLagpqBV/MfBtNGNukven:CCQZZHwD9MS6/vINxW/IfGNhe
                                                                                                                                                                                                                          MD5:AFD12DB1A7393C535FC5A7054F23381F
                                                                                                                                                                                                                          SHA1:34EBC2B694EAB523F630062EAA6887852A111F2B
                                                                                                                                                                                                                          SHA-256:1DF123605391D2C80D54438914AD79FE7CF17501CB1171F82FBCC888E4EB8F43
                                                                                                                                                                                                                          SHA-512:04D47C392A88CFA4A671BE06E72306F6111FBB8BAC15B39493A7CEF328151CFE9065B9FFE8F0580DC8BC14F97F13CF6D4C6C1F1B6F06976261955742F0A9BB50
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......f..[o.--f/0i`}._..o..>F.^v.>D.p..z..t......g.........00h...47r...24p...46t......68w?@t......!.......,..........3.'.. F.ea.7.*.....N-;yj..$....C.t}..O...>=..6k...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\slider.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):182
                                                                                                                                                                                                                          Entropy (8bit):6.595617753856748
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C5zlgQZZ6s7iYGfDec0RwaScM7Y/RlIYvgLagpv3hIVJLMe0mxvse:CCQZZHwD9MS6/vINxvq3w1mV/
                                                                                                                                                                                                                          MD5:67EF5C32384976256F1C96926C7F891D
                                                                                                                                                                                                                          SHA1:7CC5DA88AD15DE28B9337141DE4FE65159C83170
                                                                                                                                                                                                                          SHA-256:EC564C3340E2FB006BCA3EF968E5FA3945D42759D7F95193CC98E5C42283781B
                                                                                                                                                                                                                          SHA-512:949F70E73059BA3EA53523B5FF222AAB9B850E14BBFE946668D6EB0E804A1A9C6B7514518AFC6403495DF45AC973DDB46135D0FE69BA9AFC157CDEE62FF11560
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......f..[o.--f/0i`}._..o..>F.^v.>D.p..z..t......g.........00h...47r...24p...46t......68w?@t......!.......,..........3.'.. z.fQR4.*.....N-;tjG<..kM...Ov..>.....X.......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\tab-hide-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):832
                                                                                                                                                                                                                          Entropy (8bit):5.1300261818254285
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:LYVGQaofQiE/a0kQyNPYE6kLG+60ybnlqM8eCeVUOCxxMskIVmUhPvyy:+dwasKjXG+63nFTVFCxkIVmUhHyy
                                                                                                                                                                                                                          MD5:55915554CFE98AAF893AC1955ACD46F1
                                                                                                                                                                                                                          SHA1:58926529766C44C64C8EA7784B1EC6553E057EEE
                                                                                                                                                                                                                          SHA-256:50CB8C8348847C95C6451C6B349F2E1FDC757505D105CFDDC9A93354D1F48CC5
                                                                                                                                                                                                                          SHA-512:2174BF16DDFA1CC8C2D09BE4288B0361AE6588F60596A911D41F441CC8E464FC2218A99267AB4BF83550DFBFFDA021FAC181916FA54D0DEAB0C7D3F067316861
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a....../z.Jz.Nz.B..3..Q~.H..P..B..[..U..S..g..m..z....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..Created with The GIMP.!.......,............!...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\tab-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1622
                                                                                                                                                                                                                          Entropy (8bit):6.677377478702527
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:3plcZR1kfWFBm4BxTuJG+RjJqykLrQ11Ard3aVCW/0BBoAvEn61sTM3dfU:3YZR1d6MxqldJdtjod32CWs30zANfU
                                                                                                                                                                                                                          MD5:4E9522FE08D83AD68488408DDB796120
                                                                                                                                                                                                                          SHA1:5333C024FA2329721893740691CD20328A59E44A
                                                                                                                                                                                                                          SHA-256:B46E2F8FDBE172873E34C089F42F9D872AE2D54C1407F4EE99DC73E96DE06BD4
                                                                                                                                                                                                                          SHA-512:3EE0AF2DDCF7620A6DA254427C195672DE01FB77DCDF6B6641E282E4FBCA6F094CD6D5D5D947BD9AE3AC0B753DAAFCC0B82C5AC8096C1F81EDC43B3CC00A2D0E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a . ...7.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,.... . .........O.9q.Y...o...g.E.o.A.e..`Br....4e..y.H .6..lI....8s.lB...-Z......):f.X.......x..&X........4d.@...e+X..A...;,...T...*L......)R.......4.8..N.3Zt.......N....C..)B..........B.J..*

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\tab-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1692
                                                                                                                                                                                                                          Entropy (8bit):7.294031473676712
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:3WK9mBh8qbSxnGXJrZNrvRhK6k409wIgoDZrWwrKQtclhhGbT:3WmmBhZAGBZNRo6f0m2DJWwrB236
                                                                                                                                                                                                                          MD5:10A67A04BCCA6176F2E95419F98EC5B2
                                                                                                                                                                                                                          SHA1:A3CFC56FE5A139452C4C8EE1E0E500D109C64E24
                                                                                                                                                                                                                          SHA-256:363261AC19FD558891B3ADC5C70EAD6A3F580D3226477482CD7532BC9FDFF24B
                                                                                                                                                                                                                          SHA-512:2E1E5D27C94610542F3208970F3FD390E61A798ADD23A17451882414D3D786958E5BB7F530A7DE9AB5F13970465AAE08C0F5161E6908ED8B18B8D2AD87AD519A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a . ...y........|..}.....|..............[..d.....e..]..^..g.._..h.....i..h..q..i..r..k..|..l..}..u..m..~..n.......o.....v.....w.....x.....y..z.....|..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,.... . .....a.r.*.*T.@y.....@.".*.V.T...Q.G..).....C(..2.(.&M.(.j.J..J...yC..O._.n.ie..-;..y..S.U.<E.....#G....$G.._...zd...~.ER.*T.Ad...qb.......0bC..)R...E..U.:.).....$>p....9.@.C..'\..AU....Y..PaB....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\tab-s.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1713
                                                                                                                                                                                                                          Entropy (8bit):7.327111109999042
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:3aEmBhZAGBZMXQ8b1m8USOfH8iK8mtC5H:3PmBh3ZQ1m9SOvxKXA5H
                                                                                                                                                                                                                          MD5:7B6C79309F91BDB0F63855B2761CD48B
                                                                                                                                                                                                                          SHA1:972D1CB2B0820DF7589BC3B00C9ECE41A56B15BD
                                                                                                                                                                                                                          SHA-256:7463BA0AFD4869F5997A724DF98C9B7E8B07E8D6A902B096BCE72C525F3CADDC
                                                                                                                                                                                                                          SHA-512:A266D30C5E2FAFFF2B4FEEF07E9E68059CA9F105ED957D4EB0E17CAD970297A1CC330769FD193950C1B56EAA1730AEF9C4679323A1BE2EDDCFA5F6EC268CEE01
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a . ...y........|..}..7.....|..............[..d.....e..]..^..g.._..h.....i..h..q..i..r..k..|..l..}..u..m..~..n.......o.....v.....w.....x.....y..z.....|..}........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,.... . .....c.z.JU.T.B}.....B.*.J.+W.V....$H..-....ID(..:.IR.M.(.r.j.'K....S....`.r.y.K..;......+V.>I...K.$H....D..._.........IZ.J.%Be......].....@....*T. .e.U.:.1..G..%@t.....;.H!c..']..Ie...Z..Xqb...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\vslider-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 14 x 9
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):183
                                                                                                                                                                                                                          Entropy (8bit):6.507816078659911
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CXnZZ6s7iYGfDec0RwaScM7Y/RlIYvgLSl6FQNv6CDqTLevYlUQHgtJ3kW:enZZHwD9MS6/vINGl6FQNbieARHggW
                                                                                                                                                                                                                          MD5:F4BBE46D86BFD1FA73599DEDDA0D5F36
                                                                                                                                                                                                                          SHA1:152160CA728B1F7E457F6802665994BC31825943
                                                                                                                                                                                                                          SHA-256:0A398799A71AAA7AB5B3CEE42639512601297BF4899E07AF25FF89E77C4E9569
                                                                                                                                                                                                                          SHA-512:AE0AA8867FF7D6A4F92DC483E0FCBF293F2ADE85D0DB4884E50699CEC8B13D4F42CED94A2B019D8BE4992EC0C9C637443699553DAEE6AD02857C90CD82538E2D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......f..[o.--f/0i`}._..o..>F.^v.>D.p..z..t......g.........00h...47r...24p...46t......68w?@t......!.......,..........4.'..h._*xl.^.&.4,bx.{.`....'...H.H.l:m..tJ..H..@.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\itft1\itft1\vslider.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 14 x 9
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):283
                                                                                                                                                                                                                          Entropy (8bit):5.265213056429614
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C2ZZ6s7iYGfDec0RwaScM7Y/Rlp2t7yvAp/QlM7RzpUfRu4VJ8O1Te:xZHwD9MS6/v8tvp/QlMeMYJ8O1e
                                                                                                                                                                                                                          MD5:B00DC09E770E317CA278654ADBD1E625
                                                                                                                                                                                                                          SHA1:81B88DEF0A7D77BE1F4B65C45EBCF45EC81BE5A9
                                                                                                                                                                                                                          SHA-256:475413DFDB2CF2AB6DEEAE53A71952583578D0AAABA9AF93EDF08C3BDA93FB15
                                                                                                                                                                                                                          SHA-512:8ADE09AFCA8EE261F55706035312536CFE71CB068F37FC7933320E8D4E3A90BF9DB3E265D2B6494C8F8B8C6E50D8212BA5261FCB8E059CB9FDA68CB6352DF62B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......f..[o.--f/0i`}._..o..>F.^v.>D.p..z..t......g.........00h...47r...24p...46t......68w?@t......`s.//g=E........................................................................................!.....?.,..........8..`.p.&G.o).8...SB.Z.B.v..H...x...0..+..p..C..B.p.\...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\LICENSE

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2147
                                                                                                                                                                                                                          Entropy (8bit):5.118927071773829
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:T7RWpcbTvyJ3aoxxgHn6432sdICasG8yKxPgfjOXT3aZP0LYN:kcfkzxgx32l8dBXT3aZP8U
                                                                                                                                                                                                                          MD5:068C97C6C8E124BC92F1BC75D98B8576
                                                                                                                                                                                                                          SHA1:B403245714412EF38CCBD210D00E44ED668C74A3
                                                                                                                                                                                                                          SHA-256:71E39EF5D3E58F2F00FA1EA3BB0419CB5B447FC9CCD35F8E30FE2D88EE9D70F7
                                                                                                                                                                                                                          SHA-512:6998E7F5F95F3043B94DEA0185DB4AD1B5403884174462BE7395D456920D3830773164C98D470DF01CF51629A663B4D26BC8F67864077D9E891383FFB14FC73E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>.The following terms apply to all files associated with the software unless explicitly disclaimed in individual files...The authors hereby grant permission to use, copy, modify, distribute, and license this software and its documentation.for any purpose, provided that existing copyright notices are retained in all copies and that this notice is included.verbatim in any distributions. No written agreement, license, or royalty fee is required for any of the authorized uses..Modifications to this software may be copyrighted by their authors and need not follow the licensing terms described.here, provided that the new terms are clearly indicated on the first page of each file where they apply...IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR.CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THIS SOFTWARE, ITS DOCUMENTATION, OR ANY DERIVATIVES THEREOF, EVEN IF.THE

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13334
                                                                                                                                                                                                                          Entropy (8bit):4.624932250356899
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5Qn2aoOQKohwnSCyWsCkD8IcbeSC4MtK+OyuEB+cxrZ5gvk96zBKqmVX3:ynvghwnReMYKpunxvgoX3
                                                                                                                                                                                                                          MD5:A0BED5E8665B9D557CE6BE4413BA5033
                                                                                                                                                                                                                          SHA1:35AC8E381DB199A452C23077030AD7E19573C319
                                                                                                                                                                                                                          SHA-256:9FFF521E4557D58127D0869F4643DD5FA676B4ED824AB22874BDD365B4A00C54
                                                                                                                                                                                                                          SHA-512:C750B8E86FF4D81B754F9BF3F248FCC45A816979D875E7C1A6F5A3ADF228F6D2C2B7C9AFF31185A0A77F7E1B1C6778F8822A0D5420BAFB7D207857F56ACAB2E0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# keramik - Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>.# Available under the BSD-like 2-clause Tcl License as described in LICENSE in this folder..package require Tk 8.4; # minimum version for Tile.package require tile 0.8.0; # depends upon tile 0.8.0..namespace eval ttk {. namespace eval theme {. namespace eval keramik {. variable version 0.6.2. }. namespace eval keramik_alt {.. variable version 0.6.2..}. }.}..namespace eval ttk::theme::keramik {.. variable colors. array set colors {. -frame "#cccccc". -lighter "#cccccc". -window "#ffffff". -selectbg "#0a5f89". -selectfg "#ffffff". -disabledfg "#aaaaaa". }.. variable hover hover. if {[package vsatisfies [package present Ttk] 8-8.5.9] || \. [package vsatisfies [package present Ttk] 8.6-8.6b1]} {. # The hover state is not supported prior to 8.6b1 or 8.5.9. s

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\arrowdown-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):273
                                                                                                                                                                                                                          Entropy (8bit):6.516075214308522
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NOmnd8AO7PdL7nmd/hE250ZfbwzhwYXoYji:QAO7PVmJRiX7
                                                                                                                                                                                                                          MD5:151DEBAA6F2E47958783D45D6F93A2DE
                                                                                                                                                                                                                          SHA1:929C808166DB0AFF9E5D2831548577B95B8D30BE
                                                                                                                                                                                                                          SHA-256:BDFE7C64FE974BD007F62F154AA12D093D7270F7480FBF196A45BAA3815A5575
                                                                                                                                                                                                                          SHA-512:8BF40D1C0FB1E3FD3E70E53D4C35A951F632A171FE73E7D5A70CE692623D5BBC67E29B9DB1A8003DEB7C759EFA1F95990E871AE019BA859EB0DF543CCDB5B097
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..........sss..........................................................................................!..Created with The GIMP.!.......,..........u...dY..2...$.UR..G.....r.E.....lX.P(r@`".Qi.*.>.S......,..H...o..eX.Q.D......O......L.B..;....#....,.*...."&.#.!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\arrowdown-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):258
                                                                                                                                                                                                                          Entropy (8bit):6.0591876855858295
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Csrlltu9TZkSSWa/gggvvVYl/+66luAdL6YLwxqB75wHyikmm5ajzpMmrd/ohIpk:N4ksdY0nPdL7cx67GnXOatr9Rprrlen
                                                                                                                                                                                                                          MD5:A3FE87B25C098B5C4D17E3DCB056ED95
                                                                                                                                                                                                                          SHA1:D53DABD5006CA0D4DAB44008922496A897C930C5
                                                                                                                                                                                                                          SHA-256:1E4B3C636C1F915FA6E47A89AC78DE7E0A8498A3C7DFE113CCC7303205570974
                                                                                                                                                                                                                          SHA-512:F6ADAEDD1A71BCCB7E6A8655A772E00FBA2B3628EE483DF65BDDE24A3F498E5549B277026242CBA65691831F719E6759B9527E4D19EC0529C01389CECA6EAEFA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a......................+++111777>>>???CCCEEEJJJQQQRRRXXX^^^.............................................!..Created with The GIMP.!.......,..........f`p..`..1.F ...0.....s}........Gd.4.Jf..I...UJ.^.Gm...B......4....8...P5(.D.q..........=.......!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\arrowleft-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 17 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):292
                                                                                                                                                                                                                          Entropy (8bit):6.796900149789617
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:LYX6WZd8ZVVPdL7ozv4B12wuj7PlP252nbQWneSqF8QE:LYqWMPVPGc2wSDdg2nbDeSwtE
                                                                                                                                                                                                                          MD5:D16418FF2802C2DE84B2DB8E7B51C7BA
                                                                                                                                                                                                                          SHA1:8FE514EB211B108402553C13CF4CB929D6263029
                                                                                                                                                                                                                          SHA-256:B097D7716EA367D90E0034A13F692E339E1EFCC5051A03A0C88331CC3A8617C9
                                                                                                                                                                                                                          SHA-512:4C033D7D992D1CD9684CB44CD5588D6FC9D336EA6E9D4D00D9F54E04AF00DEE4CC5C888239E5EA88AD060FEB49BD861FA02BA9328E71C17E1786947CB79F0B04
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..........sss..........................................................................................!..Created with The GIMP.!.......,..............di......Pc. Jm.K.+...@ .3rD*.$ ..lt............E......`&1.e<NZ...=.X...B.V,.yq{st....#.....W-..#...........#................."&.$.!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\arrowleft-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 17 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):272
                                                                                                                                                                                                                          Entropy (8bit):6.1068010788454385
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:S+f0sdY+rPdL7oKN8XrDM51GkaiWV4kU3ve:S+dVrPWM1i4kU2
                                                                                                                                                                                                                          MD5:5850B48A47F4FE283C4774A40BE177E8
                                                                                                                                                                                                                          SHA1:DE7FEBFDC5CD696802F3ED6784CA20426B8910D2
                                                                                                                                                                                                                          SHA-256:85CFC0084F2301FB5E3AB382C1101D8BA739699EC29EC6D55958C3F759FBA76D
                                                                                                                                                                                                                          SHA-512:7F36222EBEEAE4E70E5527E5C9D3F200EE51C9D264D0F0868BE3F203B13BB984036723FAD01B49C2561842B7AD9D999F3B043F939E579B228EEA7984FA49B402
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a................+++111777>>>???CCCEEEJJJQQQRRRXXX^^^```fff.............................................!..Created with The GIMP.!.......,..........t .d9.E......1.tm..L....?.Dd@,...r.x....#.qX.....HR.J.`..H..uF3...b.....<QO(.."...)T,*"........3"........16.5&.%!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\arrowright-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 17 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):274
                                                                                                                                                                                                                          Entropy (8bit):6.610023406151245
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:cGmKI6WZbBJbgPdL7oIv9n/xdcy9WdPJeDhEE:nmKJWxDbgPL9/fUP0
                                                                                                                                                                                                                          MD5:B2D861CD5849379751F0524701A42C26
                                                                                                                                                                                                                          SHA1:F1D7B1D92B7173B6B54DEAA44B8722659D73D4F2
                                                                                                                                                                                                                          SHA-256:10622294741C81B6FEDAFCB1FE1C662F46A2B388DA1518C750CF7C3F5D78F424
                                                                                                                                                                                                                          SHA-512:126B426D167EE0AA2C9092B4729EE7D529FEB52D1B7309E32313D9B317C2AB8EC17C7590F579BEFCF8E6E2B0AE2C4E9021B5EAFF9851B3C53FCDF6C8D123A9C9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..........sss..........................................................................................!..Created with The GIMP.!.......,..........v...di.....Hc"...P....m..px..3.\ .lf..&...T..,T..DF..V+.|...X[.@Fi..J.P...~..H".#-*P+.*#.........#......p......"&.$.!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\arrowright-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):258
                                                                                                                                                                                                                          Entropy (8bit):5.849879269206281
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CsqVPSSSWaRdYl/pCRuAdL6XLAnedNjWokgRb45p3VnudiJrudrD5bknmub2:NxRdY+RPdLbYIokw85nn5JrudRAnXS
                                                                                                                                                                                                                          MD5:744EF804C4D0D3F9DF7ED553537E9981
                                                                                                                                                                                                                          SHA1:F084C872C81FC8C564A1907B42463CD5D45304BD
                                                                                                                                                                                                                          SHA-256:A14D4696146BE5AACEC3BC51EA03C7E8AC9E133DEE694920AD10553F3D70B738
                                                                                                                                                                                                                          SHA-512:FCECFBE28ABAB643AAD715E0AF5D9944A7FE3F052AD822D0EC6D713E14521F254DC49320668CC9BFC07BDD5C4A49AA5F2B6BD58D006265BE7DC467DD40F0A664
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............+++111777>>>???EEEJJJQQQRRRXXX^^^```fff...................................................!..Created with The GIMP.!.......,..........f .d)"...l...1.tM$...8..p........l>..#..P(.......Y...g...l~$......."..'................"5..&.$!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\arrowup-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 17
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):286
                                                                                                                                                                                                                          Entropy (8bit):6.793700619647209
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:oJYX6WZd8WI3CPdL7d8rgloBFenrN1UdFF93e2Sn:oJYqWMWI3CPiperDUdFF42S
                                                                                                                                                                                                                          MD5:6A92DF16527362BA6A2941687D7E34DF
                                                                                                                                                                                                                          SHA1:74A044BFF6666311409E86AB0CB202DE1BAC5E05
                                                                                                                                                                                                                          SHA-256:7C57ED323A761C55D22803F82CA27D609C52C371923DCEA0A2B195DBF4A15BF4
                                                                                                                                                                                                                          SHA-512:F5D063177CC86E3F1D061B37A69B9D39463EAC9B414F4D843765BDFBB8711A7BCCB393C335AF14596EA21257637FBE5EE2FC55D45A47C2F725E5FB94597540B4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..........sss..........................................................................................!..Created with The GIMP.!.......,..............dY...Y.4I..(H2:..m.Y..`.. .d.Bi...cF......Q..l.....-J..q9.E...{..v..8....xp..|h..u.....K.....f..........7.........L.."&.#.!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\arrowup-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 17
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):271
                                                                                                                                                                                                                          Entropy (8bit):6.1545053507905045
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:oc0sdY+rPdL7MVWXRl561uw9mhvqYPEle:oOdVrPXXRl5wVkiqf
                                                                                                                                                                                                                          MD5:6B770AF44CF26D673E137DFDCA77FB76
                                                                                                                                                                                                                          SHA1:D106C9C48B90F95B774395911384464ED7652D8F
                                                                                                                                                                                                                          SHA-256:B61DCE59C7AEB12C3772CE868302D2365EF97D307B2CAE4BB5AEC706B7DE5FF2
                                                                                                                                                                                                                          SHA-512:C8B35EB9CF8276CFD496B97B4D52C4E6C00F370025A7118368A97561CB2A9D3B265605E5764235CEB1D09299D7120FDAC6244BE803453CBFB2347C8F07AEB21B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a................+++111777>>>???CCCEEEJJJQQQRRRXXX^^^```fff.............................................!..Created with The GIMP.!.......,..........s .d)*..(l...1.".<N.4k1.4@..(...B.(.6..^B.....Gd......[...T0...6..6Y.......m...B...O.......j..,...>.5.......H.&.$!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\button-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1266
                                                                                                                                                                                                                          Entropy (8bit):7.91259862113889
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:HZIsQAQ8Ic44Yo4bo4Y4ofXQLo4LoXgMXI7gAgXIL1VnNa9XU7t9FoWFS0akaUAm:HZ3nfXP3nfXfX/HXPX/HXaVng0PF7jAm
                                                                                                                                                                                                                          MD5:4B0EB91EFF4D2FE665B59327E4743D09
                                                                                                                                                                                                                          SHA1:802CAD18102327238B711B58B0548E68482F8CF4
                                                                                                                                                                                                                          SHA-256:81E52B83F5ABE11AC22511274C131F29548FF74A81B5B7DCABF237BAD0902104
                                                                                                                                                                                                                          SHA-512:F93E067AB519A6DA2080F196536B231ED4954C8E147D51FD87F4D92AD4074E411F1F83C6544EE0A5D7E3C8042935994FB334CD96DEEEF135AFB1E6FB6679042C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a....................................................................................................... !!!"""###$$$%%%&&&'''((()))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{|||}}}~~~...................................................................................................................................................................................................................................................................................................................................................................................................!.......,..............Cw......;.N.?s..Sgn.8o.2f..n..=.....r..TI.[.k.br#...6l..Kw....U....5h.I.F.\.t.J.In[3....6MY..?.#...i...j..8.b{B.m.]..)....8r.....-..j.JM3...7q.W..,..^...$..b...H...p.......4a.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\button-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):896
                                                                                                                                                                                                                          Entropy (8bit):7.19117636864494
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:HfZ0tfVKMe9eyrzmzQ3R6HcRYkTrv557z62:HfatfVKMrMizUPYk/e2
                                                                                                                                                                                                                          MD5:BF453C09388EB387CEC6B0D3FF8199DD
                                                                                                                                                                                                                          SHA1:CCDC77977D862199D5F3EF9EAF3FC65E2DE970A0
                                                                                                                                                                                                                          SHA-256:4694D73877237878BFD69B07664402DF73F34D751F30E155C5F20019644F96AD
                                                                                                                                                                                                                          SHA-512:6D53690C335EDE2B00CD0B2756424BC37D717F09914BF4EBCB6AAF72BDC22DF5260C964EDD2497FC14F820053FD958FB16C40735AA831D1F67E418E1A2DEC36A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..................................................................................................................................................................................................zzz......ttt...lll...ggg___.........YYYbbbZZZ~~~......fff......XXX...ooo...nnnIII???GGG^^^...................................................................................................!.......,............................................................................................ !......"#."$..%...! ....&"'..$(.)$)*...!.+,-).(\Dx..D...Q.0`.../"...A..+,|.....4f.......6h...#...n..C...r. . ...@..=.....96......><\.@.*...|...c..#`....D$.h.. `..X..#~.i*.F..CL..w...0.n.B$,."..(..b.....A....G.HPP.....H.....$.Zp....d...^.......$Q......8...@B..K.$i.dD...3...F..J.8.!.E...._PjB...h<......,4..?..[.4(.2.H...H....h...>$...)$A..UX...JD.D..d.!..t...M`.H.Zl..(..b.^|!H .;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\button-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):881
                                                                                                                                                                                                                          Entropy (8bit):7.18279456206707
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:HhcvY7Dtembk/xWczhoyretUj2ELBPdmgtF7iVatsnnoX+XE7pS9Evv:HKwEmMWcayrpjdPkgPikTnn
                                                                                                                                                                                                                          MD5:BA154E3BCD31DD7611CCA1A762C4AF76
                                                                                                                                                                                                                          SHA1:6ABA45939BD64036C6FE958419DD88EEC645F703
                                                                                                                                                                                                                          SHA-256:A4EB1EB9C9D700A499C02832CA1467586FBBA2F8270B4B772A246C00CE69EE58
                                                                                                                                                                                                                          SHA-512:5EFFF3BCF2C14CD438F39640D6917865F4D25E12D8F47A8044F16F51718B609D7E0665F0484155B5A2F70D9A4E2D2FA3FF3DCE45A942AA7F1E8D6AA00C7C0308
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a................................................................................................................................................................................vvv.........lll.........ddd...]]]UUUMMMFFFRRR...IIIooo........WWW...NNN......EEE......GGGfffaaa666+++444QQQ...................................................................................................!.......,.................................................................................................. ..!"..#$.......!#.."%. & '......#..%(.#)T,..A....5.`."..(X|0.....1...QC../\.0...3J..@.F..0_. p....2hx.a.F..'...*..<kx.qc'... ..A.*...0.x.....)x....G..h...6....?....A..x........C.. .aB.!....0.......!..0...3k...)."F&.H.A....R. i....Dj.f|.p..DTP8......1.j...e.=V..@.I.%.L0W...].!BlX..I.....Xw......\xF...(G...@...]...G.`..!.H1..TTa...t@A..4.`..D...Xd...Zl...v.a.^|!H .;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\button-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):625
                                                                                                                                                                                                                          Entropy (8bit):7.329223558377531
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:HzScSzT/iJLXF3gayFa+KeS/jwiNOh7zcGh9A/v2CdvtsA:Hz1SwLGayg+KeM7NOcGhk+M
                                                                                                                                                                                                                          MD5:6E7D116105C85A7D11A245490CA3DB38
                                                                                                                                                                                                                          SHA1:1B0DF5CBCC01F14C9E3D5F42D02EAA7D7B25A0DC
                                                                                                                                                                                                                          SHA-256:D8B1B0934565DD322F6C42B58AFBBCE3ADA0D64207F8B2D69B0A6E8436765BF9
                                                                                                                                                                                                                          SHA-512:25ED7B183BA46070BAF09AF35D1A9C93B13A55F03F210FC030B78E4856558FA517C6A023E0A3E57544BE581FA66FC6C8FD846FDB39B55AFC2BA2A591FBAEA21A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..............................................................................................................................................................zzzqqq...mmmhhhnnn.................!.....?.,...................dR.......0(...,.. p..."Af...c!.p4..Ax. .|...H&....o..wz.U...o......f.zG...........iJ......... !"...H.."! ..#..$%..........%$..#&..............&'.(.()......).(.'*.+,(D....M(,+.T....E..\.(\..A...Z. h0..-.3...P......H. ..%.84(.F..(f..`r..6SX.aOF....8..p..I.+.Q.Q.......@..I..t9..c....$H5z.A......!b.......i.....4L..C...0lp.....).. ....:x..@U..9..sa..*..<~..1......Zm....O|..A....7z.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\button-s.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):859
                                                                                                                                                                                                                          Entropy (8bit):7.093863089743574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:HK3aWYzcuByrM9qNs+S/Mk7mvCKyomgun:HK3aWCMuqNs5/DmGF
                                                                                                                                                                                                                          MD5:ABC39E5C22B61C278C8C8554AF805311
                                                                                                                                                                                                                          SHA1:5B7AE0DF70B3A8B6F48B26A44CB13E3BAC5DCDF2
                                                                                                                                                                                                                          SHA-256:8B2BEB4FD8F43114C50AA80489B1F36989F4FF84D5354BFA3C58419AB58256CE
                                                                                                                                                                                                                          SHA-512:D9D03FC8F9B775B89FF6A1F8F2B7C45FAE017E2EADD85FA9E6D520132A270F9780E2EAD48F7B62AA70B436976699FBA00292140C7BD5E4D65BD3BB4410498300
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a................................................................................................................................................................vvv......lll......ddd.........]]]UUUMMMFFFRRR...IIIooo............WWW......NNN......EEE......GGGfffaaa666+++444QQQ...............................................................................................................!.......,...................................................................................................... ..!".........!. #..$........#%&!'(...&.8..D...H.`1A...'.XAb....\.......M.s....0b......-=......3`T....O..`.. .F..6N\....S.....P....:.......:rL....4.........>..H.a...Byh.!...>.0.S.. .G.H..-.>...Q.H..(x. .........BC.!.2..Q.....a...../!C..#....E> ....D."F.x..........>.....6L.d.. H<..gb....c=X.I.'O.@."%.....s..B...LAE...`..X$....f.......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\cbox-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 44 x 26
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1110
                                                                                                                                                                                                                          Entropy (8bit):7.564069930743119
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Lv+3t+1lxXI7gA6qoLH4zIJuIcTFeefsb1lyW4UORoQFzj3:LG94zX/BqaJwjM314TXFn3
                                                                                                                                                                                                                          MD5:691E46F2CD748EF2F81D16DACA001963
                                                                                                                                                                                                                          SHA1:A781051451C814403CFDC0F350DE362DC017332E
                                                                                                                                                                                                                          SHA-256:ACA9A5248CA62CAA449B145E0D1E3CC9C47917FA2F957D737AF2EE6EB430120D
                                                                                                                                                                                                                          SHA-512:4DF5CEF67116231CDA21A37E036C4F71C4BC1A2C82D930E7F16587FB277029D8A91D2FE2735A010D2B9ADE3BEC6DAE943B283781E77B10539611970B46F87645
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a,....j.+++444???GGGIIIXXXYYYZZZ]]]___bbbfffggglllnnnoootttzzz}}}.......................................................................................................................................................................................................................................................................................................................................!.......,....,.........Zafg.......faZ..X[\^e_VPOM......LK.LOYX.TOOPS^......Y.....VOIFJJKNRMJ.K\...(.( c.....b\QECIKKID.DG`..i.iG3.Xi......hbL@B.@8LE>.|...^.5j.$\....j.`.....0......A.....)..I5i.h.q#...'.....yU.5I.sg..).h.A.G.."...C.MuU..2...X..!.E...EDt r.+O.E.J....h......".4.......i..1.......+......5.h.0.F..R.W!C.F..C..=....-h..`A...6.h...E..s...fK..,h....u.._P$_..y......z..%..l).......ZB....*...D3.,!...O...*S..X?$...3....P|P...&...R..y.4@.k3....Np...v..@a.......E.Z..}.../...4....M.A..7..@.H....,....0&.Y..0A..6........6..b.12..L ...B a..:....B.t.NNz...r.i.8....>......pD.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\cbox-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 44 x 26
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.347685781422494
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:LlocxGLF8XIxAsA7AjaIYuJzM1qoHcM+HXQPZfZY/MI+A3Frxlz8w48R0SCig5Fn:LlYKXInA791qoHcMkQPc+KZxZ8w4883X
                                                                                                                                                                                                                          MD5:9DE223DC81A52CF364BEFD99E756A846
                                                                                                                                                                                                                          SHA1:636D62437325491891AA10BF153506891C250216
                                                                                                                                                                                                                          SHA-256:CA9FF562C5F551822241578A7E10B5F583359C2C92D7D694E148239F4C28082F
                                                                                                                                                                                                                          SHA-512:6EB22F1EE1DC179958FC1894E49086AA48BAC0BEF1BC943CE41869DE2B9F844F64EA8CA756B0B20F59FA4C3B0C35B8243495284675C8CC27EC840C2F4BF36FC1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a,....^.***+++444555DDDEEEFFFIIILLLMMMPPPQQQTTTWWW[[[```ccceeekkknnnuuu}}}..............................................................................................................................................................................................................................................................................................................................!.......,....,.........ZYX.......YZ..XVVW\XURPO......NM.MOSX.W.RX......W.....VPKIL.NVNJMJLU...,.,"Y.....QGD.JIBKJDFV..].]J8ZZP......[YVMA.KA9JE>CR.,..&%K....>....."Jr...#....E.q.Bj.}T\.....5|@.(.K!,J`.d..J.'=R.A.....;...HK...Fq).I....:...@....M...gEH....KeJ..8.p. ....L...2.G.t...KE.../l......J.{cJ..{#..E...B0T0l#..,P...M:...5%.,..f.1n...J..s.~..s..Bj......O.#......5.P.....#..8........k?B.Et.....a./.L...E.~}'L...1\...C\6C..-....&h...6.M.4.6.....C.D.. ..:..E..CT. ...3..l.....6...8..C......8.bKY(...C.).H"..D~H....I....'. .@Jd...Lp.}`..vJ....=.0..H..C.....4.....v....O@...E$QB.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\cbox-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 44 x 26
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1097
                                                                                                                                                                                                                          Entropy (8bit):7.470971106592431
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:L2wYmQOEdcjtDwEb9cHG8Xva9jVdQEz5YRd/TxfaZp1rk:L2wYmQAwEKG8Sl0EYdlfaZpK
                                                                                                                                                                                                                          MD5:A678F8F4B550E2F4E5F4B74F0E3D4658
                                                                                                                                                                                                                          SHA1:68FE956914494DF6D31AF6C0A37A9CC31C4E4448
                                                                                                                                                                                                                          SHA-256:145C69A08AD1AE5F92B440A4F84DA967D5C98DD2E0E544176147084ACE4CA110
                                                                                                                                                                                                                          SHA-512:85A2FCF518FA2B16AE227BBA6821D7F1E43D0A237DA70DF9231D91EA1F32F9139A8FD41A44CCACBBE6FCFB7C40373596D15D83C6B8E770918F40EF4204A4AB77
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a,....h..........................................................................................................................................................................~~~.......vvv........lll...........ddd.....]]]...UUUMMMFFFRRR.....IIIooo........WWW...NNN......EEE......GGGfffaaa666+++444PPP...........................................................................!.......,....,......................................................d.e.e4...................d[2>.>,.................d2...A)............. ..!"..#$%e|.+.A......3. ...D........."(..B......`...&Pl..B...!..p...8s.......#6.`..D../`... ...P.J.:UC../\.8...3L....`....=..[..%.H..A...5l.Pvc..*...K..a..*.....8j`..A....3[..s...jD.pc....(w...5kQ... ....S.......a..M{...R.I..r..B.K.N..u.<.-..cHr"E6P~..H...._..."DRx..$9.$.(.SR.?.`......L.A..!.....G...0...Vh..|PDd$,.DQ&.....J(!.(V.A.&p.....D.#...&R...~0C.*P...Ax0...a....K6..PB9A.A. ...<.E.+..A@A......I..h.s.y.....+LAE.A|`..4....|.......h.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\check-c.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):434
                                                                                                                                                                                                                          Entropy (8bit):6.939797664074234
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:ntxhEtrcwO1fSJjyFla3PdLbp/6pJIxW/qX+w0by0575G2foy3E:ntbE81fxla3Pvy/yuw0byJ2nE
                                                                                                                                                                                                                          MD5:CE4EDC3F89E94E904CD771CEFFA02ED9
                                                                                                                                                                                                                          SHA1:45F87DDAC9A880FDD2890BD2AA03243E927849E0
                                                                                                                                                                                                                          SHA-256:CAD64441AB198EF9276C4BE17A665FC66705FD13D9FD1C55D4B77B0F1C55C6A8
                                                                                                                                                                                                                          SHA-512:F24216E56AE5284A7D2C0C580F1F34CE90917FCEA315D8CA3FFCE082FBB3CF84D2D32B0DD78428F26539FEF63BF341B0E473C7C529E9D1E6489404C092FAD8AF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....5....---444<<<EEENNNOOOYYYZZZ]]]bbbeeennnoooqqqxxx}}}.............................................................................................................................................!..Created with The GIMP.!.....?.,...........@.pH,.C..r...73.tJ..6D....z...&3..h..z..W.C.....>..=L..%s.v.R.a.~B..4..V....[...40....4.../...-...R*...,...#...(4.{S{....!#$+&#%''$ ......... "!..##...................pC........dF..A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\check-u.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):423
                                                                                                                                                                                                                          Entropy (8bit):6.845708828839894
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:cS7hEtrcwO1fSJjyFlaqPdLbp/K7Io7jSGG5Ob3NlBO7mtojBA+U2VV/:RFE81fxlaqPvyU49mmtotA+U23
                                                                                                                                                                                                                          MD5:9D47C748EED5F549C19305AE076BF115
                                                                                                                                                                                                                          SHA1:07B076D4E4FAF705594940E3FFA8D4F9CC8E611D
                                                                                                                                                                                                                          SHA-256:647640C5AF1083EF1B267DD8A4AB1FCD93B58A1501EA79A1209079CD9398C2EA
                                                                                                                                                                                                                          SHA-512:35D3DFFF427B83FA8B1C634A0C9C0F952E39F73556CEE216C82EF4BDB917F94DC385D091DFAA28719F33DBB49D0B794BD535B00AB7369D8AAC2E06DBD2E631DD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....4.---444<<<EEENNNOOOYYYZZZ]]]bbbeeennnoooqqqxxx}}}................................................................................................................................................!..Created with The GIMP.!.....?.,.............pH,.A..r...5..tJ..4..kv.z.3..3..f..z..S,.Il......2...UT2.|B...S1....[..3/...-3......,..3)...+.."...'3...... "#*%"$&&#...........! ..""...................pC........dF..A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\hsb-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 22 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):366
                                                                                                                                                                                                                          Entropy (8bit):5.997415539012234
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:rysymOOFxqdf3IkOBEUFMh9GRWg+YHvdG32mHGH4ChpX:ramQdf3Ik/UFMhAEiPdG3h1ChpX
                                                                                                                                                                                                                          MD5:1A0CEB4CA670D4D5C86B02D633616C7C
                                                                                                                                                                                                                          SHA1:83966CDCED5D49131017CF9FF095234A62A6198E
                                                                                                                                                                                                                          SHA-256:C0F3764172E03622F758E86A967726B612417567401894DE10A60EC8694D1546
                                                                                                                                                                                                                          SHA-512:F88E25C2B98F3B86F5FD7C6B42736FB01C903B6DE7289ED2DB36476981472A382F26BA03787890A8BC540C7298CE548DBFB8D8E08CA83B931D1E1AE029A850C0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.............vvv......................................................................................................................................................................................,...........@@`H,....r.l6..B.p.Z.W..:H ...x<fl.....n....y0...x|...O ........~...........s...........s..........f\........s......s.. !...."#s.......g......BG..A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\hsb-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 22 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):233
                                                                                                                                                                                                                          Entropy (8bit):6.40931422871708
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:rkhuvy5FMuMNB97KPUer6tW94UQZ1A0KD95wNGfn:rkn5F5MZ7Gr6tW94vA0i7
                                                                                                                                                                                                                          MD5:65AC45D255E2C86EB27BCA1CB18BB77F
                                                                                                                                                                                                                          SHA1:710B7167FABB6498D9553135C60E0F204C961362
                                                                                                                                                                                                                          SHA-256:20C339C477EC265F7044484875FE78714D624E5FF381121FA91173EA71DD292B
                                                                                                                                                                                                                          SHA-512:7D85EEC167B266561F5B535FBB5B0B9321A6042CD0A3910E64FBFDE5BD120A77838EF696B4B929D98EC402D7A32E2D6851E5290612FD2DD26EBE046C6E22AD6F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.............vvv.......................................................................................,..........n ..di...l..ia.Gm.72.C.(..p8d.R...r,.....M...V..AV..x.J#...`8y..dN..%..}/.P...........Q.......G......"'..!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\hsb-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 22 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):401
                                                                                                                                                                                                                          Entropy (8bit):6.216439341541333
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:bMZaRxTguDebckLwI7S7piLa/PdLbp/ilUQ/W4PXcs2n8VrzJz5eQgNcb7GT:GexQbczI7+piMPv6l2ecs/JzFISu
                                                                                                                                                                                                                          MD5:F359F2B2BA5C1C96C7E12AD3F1AE6D5E
                                                                                                                                                                                                                          SHA1:816F4A22B50062BF46324ECF0FF99D131F07CA16
                                                                                                                                                                                                                          SHA-256:4816670D5A68A98CCA9CC2B560BBC1E3B66D8D6255DA4E5105EBF6E7CFABFFA0
                                                                                                                                                                                                                          SHA-512:055464BBEC276222CE3495F5667163D6F6C489ED4B5F0064F4D6DFD7189BFD553B553820B96D2A29152D9E04E6803AFFDCEB4CAADB027026B4EB4606BD020202
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....".&=f&>g&>h'>h'?j-Ep1Is1It7Nx7OyEObFQc<T~AX.Lc.Mc.Rh.Xn.Yo.]s._u.fu.ez.ez.e{.j..j..k..o..p..r..w..}...............................................................................................!..Created with The GIMP.!.....?.,.............pH,...Eh.l:..h.`(...,6..*...cL..'])$...p...VJ:..>..x.!..............................................h^!.................................u^...QG.GA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\hsb-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 22 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):395
                                                                                                                                                                                                                          Entropy (8bit):6.4385449047886905
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:bn3gWOlA02MfWVoKP3prZTMLPdLN4dh5EfmMqzpLnFt7Zz6zkeYXvi8/:7gVA01uCGzTuP4hhM+J24eKi8/
                                                                                                                                                                                                                          MD5:B2509D87CA0EC6006A4AFBD4EC22CAAC
                                                                                                                                                                                                                          SHA1:D88C3D6BA0218B9E605142C40F477B12A5C8FCE3
                                                                                                                                                                                                                          SHA-256:8242E0CB7973BFC8F059A215CC0E1E84E7825E204C672B785616F5CC8893978D
                                                                                                                                                                                                                          SHA-512:2C60822309987CD5D2285343B3C66E31FF2EDE77A1445050BB1EAF626DCBB3A06F39349B469D6BC521C01AC44EE578FFBAB795D2D1EEC0D71729062DF113FB4E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....'.[fx\gzWo.Xp.Xq.Yq.Zs.`y.c|.c|.d}.i..i..n..q..r..|..|..........................................................................................................................!..Created with The GIMP.,.............pH,....r.l2..$CA.Z......0..x,.0.\oi.j...g.N.H#.~..[.& z ..... .]I.!...........^..........................................................u....G.GA.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\hsb-t.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):119
                                                                                                                                                                                                                          Entropy (8bit):5.423395328716754
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CnG9GyqAQyDKK9tY/ySqp/KYePx+TPBb:H2ye4RSqp/dpb
                                                                                                                                                                                                                          MD5:58E53AB88CCC79B74FA946A58FDFD6E8
                                                                                                                                                                                                                          SHA1:CD6F3AC5D6692A5E5EEF91CE072BFDF5EB4AEE9A
                                                                                                                                                                                                                          SHA-256:BF2C1D7D0893F6042A7AFE5435F166FAB9DA9B44841E56B1543F6B4F5A03B8A8
                                                                                                                                                                                                                          SHA-512:F0EDBEDFA0FAA59F1AC05F6E5C3E04A5B8B51A068778B30434B95D0D275ACB7D6B16D375E805A4342C2EAEE151D22DFC8AA466A5CA65EFA6FE1098F3905CC6FE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................!.......,..........$..9..W...!.ca....../".sb.x..|.S...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\hslider-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 11 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):592
                                                                                                                                                                                                                          Entropy (8bit):6.563739629578852
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:KEwLOA3X9REpcbVPY3d9D84QAGoTPPFdAdAxuAfz:dwN3XQpchPQo+GoT3FagBz
                                                                                                                                                                                                                          MD5:F7BD76F59DB73489336DBFD9C27288C1
                                                                                                                                                                                                                          SHA1:7338161C5657C25BC329E4C2D9EC2F48F4C284B7
                                                                                                                                                                                                                          SHA-256:1373896BFD52662074CDA575E31D5163A76931C91609E1314C52CEBFCBB4FD9D
                                                                                                                                                                                                                          SHA-512:FDEC90F2F8100342C67E26D9CF5D6DDBE89B7E8D33A825F348E65427802890E0A036B9D4B48C0FCE5A0A1580379D6149C2DB12907C5C1D99A5B6BDE21A0A85C4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....[...... .....!..#..%..'..)..'..-.."..1. 6.#;.$=.&@!%/ &1!(4.*G.+H#+7(,3%-<..M./O.1R'0@ 3U 4W*3E!6Z*5G*5K%7X"8]#9_#9`$:b$;b%<e&=f&>g&>h'>h1=T'?i'@k(@k(Am)Bn)Bo)Cp*Cq*Dr,Hx/Hv:G_KKMINVPPP:S.J\{Of.Xf.klnlmoZp.ft.ax.uvwpy.yyzf|.}..s..x...........................................................................................................................................................!..Created with The GIMP.!.......,............ZP>+..)DUZS'7Q..6%W@6L..L,G"EK..K49.I...2-.C...0!.?...+ .=...(..8...&..5...$..3...#..1....../......)....;.*..*..R..)....<ZJ.....(..DK.+M.......,...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\hslider-t.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):579
                                                                                                                                                                                                                          Entropy (8bit):5.925240333217307
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:i3EFcAL32IOHoj3mTgX1kqKvVgBejgVcFByNRSSa4uTddPhBXCsaiC7+hbqmDAAs:1cSG7HojUgXu7KBe0VumYGEpBDhbqGlU
                                                                                                                                                                                                                          MD5:818D521852B522F87D9FFF0EAAF41145
                                                                                                                                                                                                                          SHA1:42B5E6AD87959B4556EBE31E65146F41F38E17FD
                                                                                                                                                                                                                          SHA-256:DA29BCB146BEBD332E19C0553EA3AF478E9B7313B954B957716C614CC6BCC0EC
                                                                                                                                                                                                                          SHA-512:33107A851EC6501BF92CE2D4CF4DB297420918BFDD46A6BC38704C2778FD1B52918C84EBCD37B83E69660DA07C8D0DC230266939A93E0B48620F0DEC6063D20A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....D.-./334567??AABCHIKMNOOPRSTUTTVZ[]]]`_`bbceefhpqsqru............................................................................................................................................................................................................................................................................................................................................!.......,......................(.6..60.(..96<C?..1+(...-/5AB..-().....'(*=@..4"'&....'%$;>..7$%'....&%!-8..6. ...%.#3..:,(......&1..<2........%&..)...H.0(A......@.....8`.@."E...)...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\indicator-c.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 9
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67
                                                                                                                                                                                                                          Entropy (8bit):4.536142648518819
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CM9SnTIuH8LzlEn:/9STIucdEn
                                                                                                                                                                                                                          MD5:EF7D5D6D6DE7DF634C8155405B8D0BEE
                                                                                                                                                                                                                          SHA1:70B4C625E26DB87954E1BC71537FF740B634402A
                                                                                                                                                                                                                          SHA-256:D34B0EDCEB216366C978C86114111269E8E38FAAB10BDCE96A3C6FABE6C660A7
                                                                                                                                                                                                                          SHA-512:780B8D6AA12838C226B88137FC44114EF8B1B990B39F9ECEDD37A19E12490850D608EEA11465702C411D38444B51D03BBAFDFC75C5C79C1A5B1DB6B763B60559
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......,..............+.....{[xq..t.R..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\indicator-o.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 9
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):64
                                                                                                                                                                                                                          Entropy (8bit):4.370864648336088
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CM9SnTmQun9eAJRn:/9STBun8IRn
                                                                                                                                                                                                                          MD5:75F725EADCD5AE2B1DC56BA05EA21959
                                                                                                                                                                                                                          SHA1:8A5CE8229F969A136642EBCD28E7B8812925C233
                                                                                                                                                                                                                          SHA-256:22985AEC3FF791C8BAA1B5174CCA14AA083CED92E9DC4C3061997F00E7AA9949
                                                                                                                                                                                                                          SHA-512:F26732850C45FBC5C28E64BCF0B517E8D35D94B1B9AD0A82630B30C6A35A1BA04F732D8FA3C4D23102DB8E4021C95B19C5D25A1188A21B057B45F581E6973563
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......,..............+..^..X;e.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\mbut-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 44 x 26
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1116
                                                                                                                                                                                                                          Entropy (8bit):7.520324797206868
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:LxJZ6J607KiXf9CDive/G94W0/x6dQmhek1RZcdxFF4GxVwUW:L3Cp7KiXUive/G9zymhekbIxFWqwUW
                                                                                                                                                                                                                          MD5:24ACEE167C366E1A0AFF7157A5766A1D
                                                                                                                                                                                                                          SHA1:FA8D57A230A7564C4409D4021ECE6E7AB142EC98
                                                                                                                                                                                                                          SHA-256:E2BF71E2CD3FCF3413528FF80C0DE398F1896488B3BF74384F7DD2E08FE18089
                                                                                                                                                                                                                          SHA-512:260B293BF53E21C44AD25FA88F63ABD2C95DF86B5E99DA5F43B95E8F5AE43F0414D309F85173AD1A08D82C537D9C2908C214733FA09B1EA95D2ED4C97879B95E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a,................................................................................................................................................................................................................zzz.......ttt.....lll...ggg___......YYYbbb...ZZZ}}}.........fff...XXX...ooo...nnnIII???GGG]]]..............................................................................!.......,....,..................................................................................................... !"#$....$....."..%&.%'..(.."$#......(.......H......V.X...A..Fd.x."...Z.X.@..0b.00._;..`.|.R...)b...BF..4`.. ..Q.&D$Mz.....j..A....n.....S.`.~u:@...7\|.....'".@ ...<...{.o_.."...C...b..q!....#C...2e.1k.q...z.1.#...B$X.z...._..=;D..?..0.dt..i....8q..m...{.i"1...P....E.d.~.{.T.b@71.H.#1&H@B....I....~}$.&.@.....K......h..L,.`..6x`.....xJ4.AiKP....t..N.(.$~....L...M<...u...hc.6N<.c.7.x..t....t...Q. E...B..;...N>@..4....SDa..L:..Q.H....E.?....T.@......xV.z..'...R..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\mbut-arrow-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 11 x 11
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):61
                                                                                                                                                                                                                          Entropy (8bit):4.392810492839526
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C0/PQSkLdlTO33YvpdtE:FQSkJg4vpdO
                                                                                                                                                                                                                          MD5:61A767D97F8FBEDD6CF466484890A8C5
                                                                                                                                                                                                                          SHA1:A816C64357E7CF247F5918B1A90236C78EC36E4A
                                                                                                                                                                                                                          SHA-256:CC60DBDD9E280AD4FFA9FBF3A1493113CF3E2E69397FB3D1C00F7CC3CB07CDD1
                                                                                                                                                                                                                          SHA-512:3C2E3D47DD09EA88F28B97CF9F829D60289B752528958D7DFDC1B15082A69A0D8C295E0FA39EE309E7C00E9344D748751B9E9069850392EA0D7C3AA9CA59AA65
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,..................x..&....x@.S..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\mbut-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 44 x 26
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1057
                                                                                                                                                                                                                          Entropy (8bit):7.205862286684635
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:Lbl53yzUEpiQgx1MYbhLEp0vA5s67i6w+ERE/yMsuE79TX564yMe:L55izgQgxVL0CA5N+D+5/yHuEBTXk4je
                                                                                                                                                                                                                          MD5:5E189DDE58A01888F7172CCD2434ADD6
                                                                                                                                                                                                                          SHA1:902D1F4439765CAD83BE7FAB57023B87A5D7B4B8
                                                                                                                                                                                                                          SHA-256:C8BA4C0A14B38450007DE63DA29BD852659405AE388B25B429543586383AAB83
                                                                                                                                                                                                                          SHA-512:BB62FBA253FC58B0B72C8BCC43ABB5E42ADCB48463CECD9A19D35C6D56EA8C18570F7BB0A8EFE057506515240E1A0EDF25131A3F776BB080056413B0F90BD75E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a,........................................................................................................................................}}}......uuu........kkk.........ccc......[[[...TTTLLLEEEQQQ.....IIInnn........WWW...MMM......DDD......FFFeee...```555***444PPP.....................................................................................................................!.......,....,......................................................................................................................................2@.......^...!C~.$%.p.A...4.....F.....H....Bl..AD..#H((..V..7o.u....#<d.a.....0(1.i....BuJ.j......`.E..*V<8p....4.]..m......P....._[.. .[.+.........R...E.... .L...../W..9...u]8...3e..P.6..3...bT.!...P.h$..7...AT.Qc.....(_......K..`....k.-C........k.....'/.....+..A........A....(`<7...>..........9(a~...P>....:.....B.....h..:h...@.P..+H..5..Xc......<...x......8.D.Bd..A..7..O>..z.(....L...E.1C.G\`A0..'..g.9.z.H....8.D.J.p...l@..d.2.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\mbut-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 44 x 26
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1095
                                                                                                                                                                                                                          Entropy (8bit):7.4516835820576715
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:LVcvY7Dwmby/jOEdclRPVDax/QS1uYA5aXjgZXc8kPMsBBqqTg+AVxHpRZSdBq2g:LuwYmQOEdcjtDyoYhXL8kNyEQRWqKHpe
                                                                                                                                                                                                                          MD5:E8033C6020BBD2DEF5BFDA7A23261E53
                                                                                                                                                                                                                          SHA1:74DC905C510A05BE2C6D388350A300420A0AE319
                                                                                                                                                                                                                          SHA-256:6CBCCE2D3C6DB2F75A565ADCB34340BD9F59E155126EE817E63B159E9746F32D
                                                                                                                                                                                                                          SHA-512:69213BCB04908B6E3E7103637626AE265048919D6E3C7FDBE51D89CED187EF4D8ECF89732959670109B1C724DFD99CABD7982466C79F506C6E11D314EE9495B2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a,...............................................................................................................................................................................~~~.......vvv........lll...........ddd.....]]]...UUUMMMFFFRRR.....IIIooo........WWW...NNN......EEE......GGGfffaaa666+++444PPP...........................................................................!.......,....,................................................................................................................. ..!"..#$%..........!F|. ....'@.0`........7.....'.@.aD....h.@.$...P.4.....V.......'Z.x.#...@.z.0th.HE...E...X..0...%`...u..._.v.;.F...gp.A.C...5*(.P...*J..{.o_..*......8j`..C...k.,..e.9 `......kP.qJT...O......w..=.t(..p.^.....;~xH.$E..<"(_.\H...K..<....~..N...#/....E....7.....C.......F.....B....._~.|.Dq. ........F.!..PH...f(O....D.8.....Jha.%....)..U.NP.B.5.XA.'^...7~0C.*P...Ax0C.......L2...O>..T>xc.+....O@.EG'l).~RTPf.c.xAx.....+LAE.A|`...]p..,T.g.i..B.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\progress-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 35 x 21
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):712
                                                                                                                                                                                                                          Entropy (8bit):7.328840143260883
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:YS/hsgrkANbBJ4t0l1rg15Piy+nP03ydsEHm+lYbwu4FrC0bjpBK4n:YS/hsgrkStLl1r8n+nP03JooFqps4n
                                                                                                                                                                                                                          MD5:B54909AF46B77F1EE4E1EFE3D4DAD3F7
                                                                                                                                                                                                                          SHA1:B7C35FC151E7492CAC8A41C444B37D7199DAE414
                                                                                                                                                                                                                          SHA-256:A59E8669760C49D24B44A3AF8D7D2C2F3A48BECE2B22271B08B6934DB2C5CF39
                                                                                                                                                                                                                          SHA-512:AA0873E2F1E284093FEA96324B5D625D091EE379DE533551F2DFD0D16F7BB48A407C9C62E5671B4A3DC33DB185E227F4FF14EDC7EEF172E1B134AE5451EFAB1D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a#....k..%..'0.(2.+6#-7!.:$0<$1>%1='6C+;I.?O2DV5H[8L`<Rg?VlBZqE]vGazIc}Ok.Qm.Rn.To.Tp.Sq.Tr.Ur.Vs.Uu.Xu.Yv.Zw.[x.[y.\y.]z._|._|.`}.`~.`~.a~.a~.b..b..c..b..c..d..e..f..f..g..h..i..k..l..m..m..o..o..p..p..q..r..q..u..v..w..x..w..x..y..y..z..}..~....................................................................................................................................!.......,....!.....................V....^....J988.g....j...._=55.i.......d?15.h......cB*4.f......a7%0.a....e....`2").]....b....X'./.Q....Y....W#.(.J....8........p.....#FDB..E.N>p0.`.. A..I.d.$ 6:....K.&c.4"B...>r.....@.61....#H.*U...A)*H......W.h.....+ZH.B..Y.\.].vK..&.&.K.n."x.......%.*..L.p...'.........;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\progress-v.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 21 x 35
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):713
                                                                                                                                                                                                                          Entropy (8bit):7.413080352446463
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:oS/hsgrkANbBJ4t0l1rg15Piy7710s44NnNwqPmtpmQXXvq3A2ylE:oS/hsgrkStLl1r8nv+sXNnGuQXXvqByW
                                                                                                                                                                                                                          MD5:35CF92F520FE7D6977237F4E24D4D51E
                                                                                                                                                                                                                          SHA1:6DF7519906DFF4B07DAF56EDCB18C2FB856EC195
                                                                                                                                                                                                                          SHA-256:B8918A7CFD52343861521A3D1E3B1DD520511162C53DA934BB497D997E8910C8
                                                                                                                                                                                                                          SHA-512:0D7D529275C787D1018D60F93EBB30133FB8E1987C42603684427B6BBE96328929FFE0377C8C7EB506EBC78200637673950565DCF29FC305D4250843690C89A9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..#..k..%..'0.(2.+6#-7!.:$0<$1>%1='6C+;I.?O2DV5H[8L`<Rg?VlBZqE]vGazIc}Ok.Qm.Rn.To.Tp.Sq.Tr.Ur.Vs.Uu.Xu.Yv.Zw.[x.[y.\y.]z._|._|.`}.`~.`~.a~.a~.b..b..c..b..c..d..e..f..f..g..h..i..k..l..m..m..o..o..p..p..q..r..q..u..v..w..x..w..x..y..y..z..}..~....................................................................................................................................!.......,......!.........................85540)/('&.(,-.K..51*%"......$+3L.9=?B72'#!. "&*6AW..J_dca`XWTNIFMRW[O..^j.jebYSHCCDSZ\E.......................W...o......^B....D8.^...Ydx0...'zTXP.. Mf$y...!O~,.!..3i...%.. ;t.8.....6q.....P.F......C..MJ...Z.*...+.S.Zu.5*W.'e..MK.k[.c..=+..Z.a......^.s.....o.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\radio-c.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):695
                                                                                                                                                                                                                          Entropy (8bit):7.058716349769706
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:G+kxUuqerUIj2hkaLoH82aGAaYP7sFa2/GuYlMKZCuMqRPNO:GKRerfih70H82aQYA8NRMKZCuMqRU
                                                                                                                                                                                                                          MD5:9DE5E5D31A39EA03A8DAB6AC15C33B76
                                                                                                                                                                                                                          SHA1:95D4E0744D157438F5193D480BC307EF89B2AC5A
                                                                                                                                                                                                                          SHA-256:E57B904D9B777027DA6F49FD7DA199196DD9612183AA7BA8227BC8C33D6590C4
                                                                                                                                                                                                                          SHA-512:D2F6630DDCEEFF445F729DA9A2F3F955E8184637032C19099561053F315BE6AF0A1791B47AAB192066EA566BEF34C9981B161F8C429CE084690776FBB8690255
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....b....+++666IIIJJJXXX\\\___eeejjjlllpppqqquuuwwwxxxyyy{{{}}}~~~....................................................................................................................................................................................................................................................................................................................................!..Created with The GIMP.!.......,............A......Ha..H..CaOTZ\XUMFC.>IM?<.?OK>.8DA9....:0CD6@.73A0..NQ.G)B35.)<+..T]_`_]1+<&?..H..T^.....H.:..W..[a..a.V.4..E..^...D./..,^\P.N..c-...0...,]..iB!..A.JLQ!Q....D....@.&P.H.......P.......$l$.aBA..!dP#.........p....=...!.D....t0!...C?t.x.....C..%...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\radio-u.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):686
                                                                                                                                                                                                                          Entropy (8bit):6.995996867582719
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:dc+kxUuqerUIj2hkaLoH82aGAa7PBXSW6wEsvVMA8XohmJV8JY:dcKRerfih70H82aQ7YPwE4Mn8q8JY
                                                                                                                                                                                                                          MD5:F25FE7C78B79D615A1023DDF6EF8CB03
                                                                                                                                                                                                                          SHA1:8161E5FEF6B17FA55C350324FF29C11BFA66AEEE
                                                                                                                                                                                                                          SHA-256:1A9657CC737633114998695F02B3F7B1C1A623012599784EF3E0A74BB1FCA7CA
                                                                                                                                                                                                                          SHA-512:DCF3E67676718AF398ECC121263A420BA33563C40F91995D369BBC2A902537713A2AF5E27E991DE9980FDAECE7CE57686F7E5C91F7F7EB5FA400053D1663B8B8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....a.+++666IIIJJJXXX\\\___eeejjjlllpppqqquuuwwwxxxyyy{{{}}}~~~.......................................................................................................................................................................................................................................................................................................................................!..Created with The GIMP.!.......,...........@......G`..G..B`NSY[WTLEB.=HL>;.>NJ=.7C@8....9/BC5?.62@/..MP.F(A24.(;*..S\^_^\0*;%>..G..S]...G.9..V..Z..U.3..D....`.C....+...-...d......p..d..|......^...B...b..&O.D..d...N....D..#j .Q"... bP#.......`...<.........,p(....C>r.p....;..%...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\spinbox-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 15 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):409
                                                                                                                                                                                                                          Entropy (8bit):6.767004168729701
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:r6vu4U9A7R1A4BWxaCSa4wl5le7T9+QvPTb+7v4cv9FXbt:rEu4U9A7R1A4BWxaCCQ58TlbbWv4CFXZ
                                                                                                                                                                                                                          MD5:E5759D6008A23170FBF6F76899254D91
                                                                                                                                                                                                                          SHA1:9D5456D6BE87211A068F8544F569EECA9B082AC1
                                                                                                                                                                                                                          SHA-256:E9796CB9DF0CF98FE7D3B546B8CE00807BACB4337317C432D663987AF19436CF
                                                                                                                                                                                                                          SHA-512:868A17AE114100835273A3AFA80A8FA73218781FD60BB02607DF98A095E03CA7579E988A41157820CEB872C4B5746237579936735CA63B9034CAC46A04649E24
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....4.................................................................................................................................................................................................!.....?.,...........@.l&s.N.Rh..x@,..(..P.......Y.B.@(..x.@*...E..V....X..'.......t".......(..............................................................................# ..........%+ ......Z..!),&$A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\spindown-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 15 x 8
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):56
                                                                                                                                                                                                                          Entropy (8bit):4.372169585587524
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CJ+0kLKnSB9kpk5n:Uk4SLkpk5
                                                                                                                                                                                                                          MD5:E6540BC7853481B7011F1950C13F9783
                                                                                                                                                                                                                          SHA1:C2C28A89464EFF4E1CD4FB164BCD27D31222CDBF
                                                                                                                                                                                                                          SHA-256:72758C134CABE0EA55F13F131E6C7EFB9B9F5C6552001722C49D6952AF78AA28
                                                                                                                                                                                                                          SHA-512:F2043818A3E20B90D82AE9BA1CC415B51898D7D0890855B6505ACAAC7BAED46FD25069DA0295994133F4D8347FC010D822F7E1B208DDEC63706BA446FA4D5574
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,.................X.QNgO...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\spindown-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 15 x 8
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):207
                                                                                                                                                                                                                          Entropy (8bit):6.242685681122145
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CJ6LA0hnIIQPSn66vWyzQO/HmG5q7xmr/83HEchS6LKgrStuyGB4dwDEG+yrURje:numHmiokQS64sY6Mq
                                                                                                                                                                                                                          MD5:BCBFE599BAC07F7F197477FA303B2794
                                                                                                                                                                                                                          SHA1:A2AFD6CFD97764172CCBE0AF3D6CF181C06AE488
                                                                                                                                                                                                                          SHA-256:C7E4CA2A62E090A012041B7D0C8EFD2955A59BEB627A32D6F6EFFD09E8E8D826
                                                                                                                                                                                                                          SHA-512:186D58FC9DC1BBFD6BF5674D52FC7A6EDF03CC9F145AB9AF1F219730F3CE3592298C2BF71586A3FB42DB0FB31A7556D317B3FFB489730E04AF93D268D8E8AB80
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........L..eU.,..DU&...B ..s...t.`g1.U..a....0.. .8D0...a.t...E..h,.EB..s.f.EB.h8.O..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\spinup-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 15 x 8
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):56
                                                                                                                                                                                                                          Entropy (8bit):4.227636558351595
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CJ+0kLKnS7ovo:Uk4Ssvo
                                                                                                                                                                                                                          MD5:6EA98594749A57833303C8D4856569F7
                                                                                                                                                                                                                          SHA1:1CA95E7A185F28348FE513D4BC2187E78321980A
                                                                                                                                                                                                                          SHA-256:9B35F81AF69D53875CAE5208F051C6DB2EA90519D31C2500CBA191D423B23BF1
                                                                                                                                                                                                                          SHA-512:EC9BC14E777A631F91E8351DC228A8BF7EE8E77C4CA5552FF023A0EBCC99B30700F15B83F13E3B71F620F2226379F6D7E7F9E7D0E15745CC78C9714B4FBBE881
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...................NNf3...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\spinup-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 15 x 8
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):190
                                                                                                                                                                                                                          Entropy (8bit):5.812382138585228
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CJ2xIIcng190g8B+nZHmG5lNNMMMOhHF/83H8chS6LKg7Bhm9TnbfQHoDDmjVf0L:+L5kHmMNecjocQS6LML0VsL
                                                                                                                                                                                                                          MD5:823455E01D4EBC87A611AB7240C29F15
                                                                                                                                                                                                                          SHA1:1A5AE0D64FE4CC227ABEA95CAD29D399194F4023
                                                                                                                                                                                                                          SHA-256:5A98B2C25EC023AAEFA9A80314074FAD26C7A4D2EEC94F7F15C277885749E1D0
                                                                                                                                                                                                                          SHA-512:88F2A07987B59063233AD0296DB215FB73F4C131638A09BEB883C41C71E43B63C94684A6841371C25472D9716685DF9239DB4064AEEDF992B0400DF6A6029C08
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........;..U.%9.#Q.(V.....@S.~....K`..."..........!`Z....q.z...xL..B.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\tab-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):871
                                                                                                                                                                                                                          Entropy (8bit):6.809685252534008
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:fZNLwzKa3DG/NuOqui0hmWmN1MixroseK8h1G9FiNUkcSHBvEXEj/8iNG0f/bNz5:ffU3K/g7lprVeKTFAbcSHmXEvnbR5
                                                                                                                                                                                                                          MD5:091B977D943DF771249E770AFDE16004
                                                                                                                                                                                                                          SHA1:D73EEBA23C74F30340BE52ACDAA215CD29054105
                                                                                                                                                                                                                          SHA-256:98AE87BDEA061CEE4F582CAE4FFCC1DF8A7927E76BC11BA069CABB8A12CF6DF9
                                                                                                                                                                                                                          SHA-512:C62377B36BAE0CF7FDFE64F14779B8856ECEEEC6940B445CB0F19932B924EB6F3B2FCD6CD7F6980DB83C29A54650C7E46BD7534B1D95EAB1C73B52233A10C458
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.. ..M....uuuNNN<<<;;;...SSS..............[[[............yyy.........UUU...............QQQ......VVV.........\\\...............aaa.........ggg............kkk...............qqq......www...|||....................................................................................................................................................................................................!.......,...... ................................................................................................................. !....! ...."#$%&'.....p.D..#D.A. ...."J.(q....P.a.....0B..)....-Xl.....&Q..!c...&l......4f.....3..X.....9...!.... v.....`k..0c....x|.cB.R.p{L.......|........(....Yw...........a....!k.L..e.5?.\.1.....lZq..'...:......1....8...M|8..D|..N<.q...4.........f.".. Q.B.....O..B..#.. ..b....U|@....J,.....h.7H..D........ ..V..L..G .;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\tab-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):383
                                                                                                                                                                                                                          Entropy (8bit):7.064775713374135
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:f7Hj32+C+5C3zN9uRS6GZZOUM8s24ZjYmoFUxYg/tI3yokWWPZ0RtP6Fvkrkgn:f7HjRl5CqRkhM8UjYFUBl0SZ0LDAg
                                                                                                                                                                                                                          MD5:86B4773455EEE7EF51BD54732568975A
                                                                                                                                                                                                                          SHA1:866A8B3618120257947BE9735324853B527A87F9
                                                                                                                                                                                                                          SHA-256:34FAFECC38C3318273790CD1E0AD0C03A07DF54B742A197B9ADD6E5D0EB844F4
                                                                                                                                                                                                                          SHA-512:23BF177CCF1056466ADBD37F25225516F09079835DB3E33D753197CA336966B031B7C5AD8AF4E33EFF8A231849B009D94AB601A2819D88B36454F4AB2D23711B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.. .......YYYXXX.......................................................................................!.......,...... ........`.hJ....D!.tM.....B....q0.>..b.h:.."!@&...v..6.U..r........K&..<H.H.J........xz..~..H...............5.4...a...........H........a.........W.....H.z.......................W..............................5.H..AJ.+.4. .P. ..x.B...7h...E..8q.p.J..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\tab-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):878
                                                                                                                                                                                                                          Entropy (8bit):6.882743950017777
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:fUNLwzKa3DG/NuOqQ3wXmN1GCFxVbXEcNshQP0DIkzfgDudlonhCFxH7i4+W:fEU3K/g3GPLxEcb0rMDalonhCFd24+W
                                                                                                                                                                                                                          MD5:374ADFAF533E00FAD398C0112B0C29B4
                                                                                                                                                                                                                          SHA1:7E5EDA9C7AEC78C30ED9F7D6FC5CAAB1787B648A
                                                                                                                                                                                                                          SHA-256:2BBDDAC831E555A48C093D6B8CF02D4099826C1FF43FB987ECD33F0C1388F067
                                                                                                                                                                                                                          SHA-512:B9C3B8EF194D1F2564BE1940E957A58444121D84ED3C0FC18E7416309DC1C6757D44DB1D4EA2A1BB3B607FAE22207613FD6BFA793217E11AD484FF9047E7608A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.. .......uuuNNN<<<;;;...SSS..............[[[............yyy.........UUU...............QQQ......VVV.........\\\...............aaa.........ggg............kkk...............qqq......www...|||....................................................................................................................................................................................................!.......,...... ........................................................................................................ !....! ...."#$%&'.....'&%$#"..h.B....*L.BE..(..h.....3j......,$R...$..C.1.F..6b.i.D..3d..sC....r..J....f..q...;fLXQ...5VL.....?<>..1...=&.......>v.P....@....-X.;...@..a.B.....`..#'^.......Of.w1..7W...3h.9;.l..h.O.~M..i.C....... ..!..G. ..#.......^..O..8.\0..w#...lP...$*^........_.@r.O.$.T.~.?...H$...-(...HT.... a..-...J4...f.a.J0......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\tbar-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 8 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):907
                                                                                                                                                                                                                          Entropy (8bit):7.94275390545049
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:i/qIsQAQ8Ic44Yo4bo4Y4ofXQLo4LoXgMXI7gAgXIL1QYEgmz:t3nfXP3nfXfX/HXPX/HXaQ+I
                                                                                                                                                                                                                          MD5:D054E1C23FE4CB7C86CE0247612DADE7
                                                                                                                                                                                                                          SHA1:796CA9F9BB8CA10E07DCC467E76929A4C73705DA
                                                                                                                                                                                                                          SHA-256:838737EE13B725EF4C26EA3A1FB783B0B3CA3C1D8FA4157EEE4D87CF494342EF
                                                                                                                                                                                                                          SHA-512:6377B33C28F9AFDBF241B7C98E0DE1C791A12818223CCFA9C6D1F47263010266D6B706AC103FA5C17E5834EE059702998F99EC740D2345031EEA532CB3FDD12C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a....................................................................................................... !!!"""###$$$%%%&&&'''((()))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{|||}}}~~~...................................................................................................................................................................................................................................................................................................................................................................................................!.......,..........h......_......._......Gq.D}..].(1..|...'..{%OJ....z0.)..Mz...'Q.Oy=.J.G4.DxH..M..g.+[.....D...j...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\tbar-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 8 x 29
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):238
                                                                                                                                                                                                                          Entropy (8bit):6.511461459787893
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:7nPUmZwrKMZk5dEQS6ElZ+xIYJZbJCcbFbn2002c1of:7TEL1UPF02cg
                                                                                                                                                                                                                          MD5:09A66F4F8141C6D46E01BA8E4C278CF8
                                                                                                                                                                                                                          SHA1:AEB2AB206550EE0F5EAC53B7E69D5A690C164BE4
                                                                                                                                                                                                                          SHA-256:CBA1AD1A8134CB1596C5616A682DD5C70A6602231E6BB071A623BE6EB412E6A4
                                                                                                                                                                                                                          SHA-512:270D5311387F16644BCE2489601C4F0027BF8C0F266BC9DF24AFD9ADE946E9FF4EABDBAE67E1AD265DD8FA2BC70BD77920AFB6F9E31BA5BABBAE95BD22CAAD60
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........k .c`.......!.Da..}...$. PA,*.....h:...t..X..d.L../.B.W,.4..n.1.8<C..5.<~...)........LOM.FE......,+....!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\tbar-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 8 x 28
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):927
                                                                                                                                                                                                                          Entropy (8bit):7.942807648072375
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:i/qIsQAQ8Ic44Yo4bo4Y4ofXQLo4LoXgMXI7gAgXIL11DAQaBq9x:t3nfXP3nfXfX/HXPX/HXaRCc9x
                                                                                                                                                                                                                          MD5:D978F5EE059C24DFE6DC7F1370C70F77
                                                                                                                                                                                                                          SHA1:F796713645A74E1C5F8EA04B9697048BFCA1B1DD
                                                                                                                                                                                                                          SHA-256:D942A636561DAEBF1952DE816205A1B825993C63801103A2D7E87676988FA664
                                                                                                                                                                                                                          SHA-512:502D47A02005D753A11F17B06A2D14E987DE77803DD6E9B38B6C933ECB7C7F708EA94A0167D487CA940C6C6B1C6C9F72198A8083D2424BABE1109F563AA359A6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a....................................................................................................... !!!"""###$$$%%%&&&'''((()))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{|||}}}~~~...................................................................................................................................................................................................................................................................................................................................................................................................!.......,..........|....8.Y....lk..?...J..b...i.q#G)....q$I.&.4....l.b.|)s.B..o.|..O.....:4(.R..[.4(.R..:..T........^.l...]..g..[.6 .;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\tree-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):358
                                                                                                                                                                                                                          Entropy (8bit):6.342665915776124
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:LwolDOI4dy1KRB9FBNBt+/9EPSap/WlxKekdyDvlBnpujR2eLmA68R:LwCCFdy8ndNBQVOHijnpv8R
                                                                                                                                                                                                                          MD5:BF1E465823500FE8F207DCD10A32DB68
                                                                                                                                                                                                                          SHA1:EE43D2115AE03D8F0E66855F09791C0D6C88EC77
                                                                                                                                                                                                                          SHA-256:4DE10F8EAB53223DD1257BE38439EE0CD2106919C1AB64937458B3EE79ADE27C
                                                                                                                                                                                                                          SHA-512:1D2C40D5D0ECDA5171E2D98E4F774501E485600251C210EF7EC5F2DF81981D640337F42DA7260C4092FE95FEABF1BAB4B4EF297D341FC09F7496AD4E4FCA285B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....). !!567..........................................................................................................................................................................................!.....?.,...........@I`H,.H..r)8...h.e.Z..Ti...P..x<8...4..j..k.|N..>...@....|.....#.....#.....#.....#.........#.....#.....$.........$....."..........A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\tree-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):688
                                                                                                                                                                                                                          Entropy (8bit):7.387970424337286
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:L4putgy3Y7lesVlMcCpYO56TAj0kWvqXYXEFTELYlj3nFPZi4OBdJYHUz7:vlI7lJXJ5m0ktvFwcB3nNZiFBIM7
                                                                                                                                                                                                                          MD5:906F9E15CE06056E5C6C4B9E37CE1FA0
                                                                                                                                                                                                                          SHA1:5363480DB31FDE94438C915BD215384D05C5B2A8
                                                                                                                                                                                                                          SHA-256:6F63E0ADE0752D300CBFE9F30B463C4AB0D5101DDB13BC55C59A5C10812B6CF3
                                                                                                                                                                                                                          SHA-512:4E2B273AF2A504D108B6B9FEA0DABF373F8606F0CE78D4470A21FCCB442594DEBA89B3CFFF54722C93D157CA665DE15CB578023F88C87D36D72BCA2B7B787D0A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....q.56767899:=>?AACEEGHIJMNOQRTWWY\]_abdghjmnpqruvwz|}........................................................................................................................................................................................................................................................................................................................................!.......,...................==>H\.\511.FGRal.l:.,.MK]hp.pB..EG^jo.oF,*.FAXkn.n?'(.@=Tgm.m;#'.=9Lei.i2!%.82?df.f,.#.3)6`b.b&.".-%/[.\$.!.+$,UQ.Q".!.'!T8.Bp... ...q....<Bd..`...@hh.!...'...Y....%B. ..%...>H@1....8}...b...1.0..D....X.....S(1B..."./Z.j.QB...7...B...(..qr%....:.Ly.!..x3$...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\vsb-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 16 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):373
                                                                                                                                                                                                                          Entropy (8bit):6.062659860599711
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:dM0LWgtyn5pkPhkKrHGYegOurrnmMVAf5eZ476Ew4hy83n:e06g83AhkKLGXgvDBi5eZ47Nhy83n
                                                                                                                                                                                                                          MD5:ED5A0FF418EA5A428F5393345E034BF1
                                                                                                                                                                                                                          SHA1:A289BE75B0E5E8E35CA7AEF2391B17AD95686541
                                                                                                                                                                                                                          SHA-256:11A112F88614A7302AEE995657E289EF54D905D68ACC088C8C9EFB55100841F0
                                                                                                                                                                                                                          SHA-512:5FE1E29190DAB66964EFF76D87C1AD76CB745F31137537B6F4841E772E5300A9AF6623D917569601C2A9413427C2B289101799CA5B90939F506B2C4C15CF15FE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.........................................................................................................vvv....................................................................................,...........@@`H,....r.\.....`8 ....x&...$..d'...|0D...BaQ....Ar...^.le..~tv.xe.........k.............y......w.......y{}.P...dpr......z........ ..!......M..O"#...."A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\vsb-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 16 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):240
                                                                                                                                                                                                                          Entropy (8bit):6.466282700686619
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:MUXfPa3D0kMga2iF9UCf775aVKt1WfLxDFsK9N3rzszloH9Tj4fCpcaxrGgK7O5f:daD0kl9mB7AuMf3hX3Ezla9TjyQTaE
                                                                                                                                                                                                                          MD5:294127365445FDF6CE0D1B30C1B4E21C
                                                                                                                                                                                                                          SHA1:D45C002ABFF9D7CEAB0ACB2BAC31E4BC85A96579
                                                                                                                                                                                                                          SHA-256:253F6B794062374BAF52A507F5FF6E907A4FA1327D6BC66A20C4E444324D496B
                                                                                                                                                                                                                          SHA-512:0ABE0711AB1F6C831D8E8572FED69FEAEA23EA7C6BA23C47BA2DB24B17488AE9305E1BCF26C2EBF92411F0B661174BE5FB5241C9FD9189D7E1330A7FEFEF3C75
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a..................................................................................vvv..................,..........u ..dY........@..q .*KK..F.......z..:AqUp".R..R}b...5..Z.D..KV....z.....3.o..0..F..X..-....X.......*..Q../.......!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\vsb-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):405
                                                                                                                                                                                                                          Entropy (8bit):6.22915381365906
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:LMZaRxTguDebckLwI7S7piLa/PdLbp/TWgu5NXb1OxRq396c+5EDLv7K3:LJxQbczI7+piMPvrLUQRq3ocI3
                                                                                                                                                                                                                          MD5:8FA646672359FD9C6F143881E41F0578
                                                                                                                                                                                                                          SHA1:7EEAA0101397711064519C482EDEABB968480C63
                                                                                                                                                                                                                          SHA-256:8DE4584A95FC89BF4E9A4714A4BF9A4D5F3CCF486877A7D3BDDC4B3AEC1F481D
                                                                                                                                                                                                                          SHA-512:C3DE065457A8A28D4F81B39B4752A7BCC8995A7325A6ABCAD084E3E21EFC1F16ADAB003BAE55A28B04C438F58DE2D4B2750BF43B1A043A12FC45978B00C91EE9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....".&=f&>g&>h'>h'?j-Ep1Is1It7Nx7OyEObFQc<T~AX.Lc.Mc.Rh.Xn.Yo.]s._u.fu.ez.ez.e{.j..j..k..o..p..r..w..}...............................................................................................!..Created with The GIMP.!.....?.,.............bH,....r.\*......h2.F.0x&.....d......t4....P.....c...^!l....~tv.x..........k.............y......w....y{}.P....oqs.....z..................M.!^F.DH....A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\vsb-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):399
                                                                                                                                                                                                                          Entropy (8bit):6.506893913520704
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:LrD3gWOlA02MfWVoKP3prZTMLPdLNJQoZ3Qd3AzODB1yzEi:LrDgVA01uCGzTuPeo5TCNczEi
                                                                                                                                                                                                                          MD5:FDAA21830F352AC546CAD920DEE12F04
                                                                                                                                                                                                                          SHA1:9F8559467F1C01FEA6BFBC603FAD3EB3FE9A7A28
                                                                                                                                                                                                                          SHA-256:2A0F1007C387B5D0EEF02D93E888E568FE51DFFD71F26998802B06D7849F8FA3
                                                                                                                                                                                                                          SHA-512:D2390D23FE8617C6D45A3CCF1FB2AC3B5B600ACD877456F155FE2726D5ACB1F59889476EA2290BA7E69B3F3211AC7182628EAF0381FD987D5133A1D480FF6E49
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....'.[fx\gzWo.Xp.Xq.Yq.Zs.`y.c|.c|.d}.i..i..n..q..r..|..|..........................................................................................................................!..Created with The GIMP.,.............`H,....r.\..&..4.}<...Px&...I..`..A....D............T.v^&m"....uw.y..........l.............z......x....z|~.P..."prt.....{...................M.&^F.DH....A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\vsb-t.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 9
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):124
                                                                                                                                                                                                                          Entropy (8bit):5.480316626393265
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C1e33qAQyDKK9tY/ySqp/+hMAtEbDSH3Z/PVlEn:f2ye4RSqp/eMIiuJ/PVWn
                                                                                                                                                                                                                          MD5:B5B314B77D92A02DF577D561857417E7
                                                                                                                                                                                                                          SHA1:47A9045092838B1190036A987E7687891549400E
                                                                                                                                                                                                                          SHA-256:6E0386101D9EB5D7352465FCC4815A57B951971102D9269BA788457F19965EBC
                                                                                                                                                                                                                          SHA-512:72C0C01D7219705B580BA9CB7FC2831D601F7A54DD4F381598CF60CDFC95AE7A4B691558C611C7E020CCC71DC1345A7A3666372A7505BA9C8461E7EE712DF2F5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................!.......,..........)..1H1......q.7UWF..*....#)..z.......D..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\vslider-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 11
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):587
                                                                                                                                                                                                                          Entropy (8bit):6.553514418937679
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:1wLOA3X9REpcbVPY3d9D84QAGoTPHIEFICblLpK+82rEXWXXe:1wN3XQpchPQo+GoT/DDdpKDbYO
                                                                                                                                                                                                                          MD5:D1B20B81C25A0874AC9839BDCF316A41
                                                                                                                                                                                                                          SHA1:D1839A17F7537A6F4F28F70E3CF20546016B463B
                                                                                                                                                                                                                          SHA-256:E19957476E274DEF383327A048CEFF28B4026B99A6D37792D2623C86DF69C8B3
                                                                                                                                                                                                                          SHA-512:8CB5046DE978F58623A4955C3CC9ED71E42AE058679818085B18DAC95E2BFCE98AC6FA4E99F7C0DF430586E9D6429B5FD58AEC98F288667FF215F7FA4B50CEF5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....[...... .....!..#..%..'..)..'..-.."..1. 6.#;.$=.&@!%/ &1!(4.*G.+H#+7(,3%-<..M./O.1R'0@ 3U 4W*3E!6Z*5G*5K%7X"8]#9_#9`$:b$;b%<e&=f&>g&>h'>h1=T'?i'@k(@k(Am)Bn)Bo)Cp*Cq*Dr,Hx/Hv:G_KKMINVPPP:S.J\{Of.Xf.klnlmoZp.ft.ax.uvwpy.yyzf|.}..s..x...........................................................................................................................................................!..Created with The GIMP.!.......,............ZWG9-! ........<NXU%,420+(&$#.....:TD6LKIC?=8531/.*..O)Q......*).H........).A.....B....F+....M>7...*..VP'6E../)..JYZS@"....0X..@..;.h....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik\vslider-t.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 15 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):581
                                                                                                                                                                                                                          Entropy (8bit):5.868642450449343
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:tcSG7HojUgXu7KBe0VumYnMQzIZ9oIgAln:tOIK1Kum2z4OSl
                                                                                                                                                                                                                          MD5:E78A70996339ECEDD390BA166F43DCB3
                                                                                                                                                                                                                          SHA1:2E25A079A2D7CDACADDD13041FEE0E1887E5ED26
                                                                                                                                                                                                                          SHA-256:B765F089626AD1C40A59B42D91E51F244766408D059A9BED0849D4F1D4F476BB
                                                                                                                                                                                                                          SHA-512:8964EF975713DB37EA1693A37BBDDF4BFABD12115007EF3C67D007886CC498244245280B4D0C7667EDAD78D4BBF373D1ABCBF67E831AFA22B7A10AAF57D88081
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....D.-./334567??AABCHIKMNOOPRSTUTTVZ[]]]`_`bbceefhpqsqru............................................................................................................................................................................................................................................................................................................................................!.......,........................(9-''&%....(6/(%.%...(<5*$!$....6CA=;-#....?B@>831&........6..................01-476:<)....+(".,2...(()'%'(......>.8."....X].p.....4\......N.8(..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik_alt\hsb-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 22 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):366
                                                                                                                                                                                                                          Entropy (8bit):5.997415539012234
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:rysymOOFxqdf3IkOBEUFMh9GRWg+YHvdG32mHGH4ChpX:ramQdf3Ik/UFMhAEiPdG3h1ChpX
                                                                                                                                                                                                                          MD5:1A0CEB4CA670D4D5C86B02D633616C7C
                                                                                                                                                                                                                          SHA1:83966CDCED5D49131017CF9FF095234A62A6198E
                                                                                                                                                                                                                          SHA-256:C0F3764172E03622F758E86A967726B612417567401894DE10A60EC8694D1546
                                                                                                                                                                                                                          SHA-512:F88E25C2B98F3B86F5FD7C6B42736FB01C903B6DE7289ED2DB36476981472A382F26BA03787890A8BC540C7298CE548DBFB8D8E08CA83B931D1E1AE029A850C0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.............vvv......................................................................................................................................................................................,...........@@`H,....r.l6..B.p.Z.W..:H ...x<fl.....n....y0...x|...O ........~...........s...........s..........f\........s......s.. !...."#s.......g......BG..A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik_alt\hsb-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 22 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):233
                                                                                                                                                                                                                          Entropy (8bit):6.40931422871708
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:rkhuvy5FMuMNB97KPUer6tW94UQZ1A0KD95wNGfn:rkn5F5MZ7Gr6tW94vA0i7
                                                                                                                                                                                                                          MD5:65AC45D255E2C86EB27BCA1CB18BB77F
                                                                                                                                                                                                                          SHA1:710B7167FABB6498D9553135C60E0F204C961362
                                                                                                                                                                                                                          SHA-256:20C339C477EC265F7044484875FE78714D624E5FF381121FA91173EA71DD292B
                                                                                                                                                                                                                          SHA-512:7D85EEC167B266561F5B535FBB5B0B9321A6042CD0A3910E64FBFDE5BD120A77838EF696B4B929D98EC402D7A32E2D6851E5290612FD2DD26EBE046C6E22AD6F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.............vvv.......................................................................................,..........n ..di...l..ia.Gm.72.C.(..p8d.R...r,.....M...V..AV..x.J#...`8y..dN..%..}/.P...........Q.......G......"'..!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik_alt\vsb-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 16 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):373
                                                                                                                                                                                                                          Entropy (8bit):6.062659860599711
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:dM0LWgtyn5pkPhkKrHGYegOurrnmMVAf5eZ476Ew4hy83n:e06g83AhkKLGXgvDBi5eZ47Nhy83n
                                                                                                                                                                                                                          MD5:ED5A0FF418EA5A428F5393345E034BF1
                                                                                                                                                                                                                          SHA1:A289BE75B0E5E8E35CA7AEF2391B17AD95686541
                                                                                                                                                                                                                          SHA-256:11A112F88614A7302AEE995657E289EF54D905D68ACC088C8C9EFB55100841F0
                                                                                                                                                                                                                          SHA-512:5FE1E29190DAB66964EFF76D87C1AD76CB745F31137537B6F4841E772E5300A9AF6623D917569601C2A9413427C2B289101799CA5B90939F506B2C4C15CF15FE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.........................................................................................................vvv....................................................................................,...........@@`H,....r.\.....`8 ....x&...$..d'...|0D...BaQ....Ar...^.le..~tv.xe.........k.............y......w.......y{}.P...dpr......z........ ..!......M..O"#...."A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\keramik_alt\vsb-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 16 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):240
                                                                                                                                                                                                                          Entropy (8bit):6.466282700686619
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:MUXfPa3D0kMga2iF9UCf775aVKt1WfLxDFsK9N3rzszloH9Tj4fCpcaxrGgK7O5f:daD0kl9mB7AuMf3hX3Ezla9TjyQTaE
                                                                                                                                                                                                                          MD5:294127365445FDF6CE0D1B30C1B4E21C
                                                                                                                                                                                                                          SHA1:D45C002ABFF9D7CEAB0ACB2BAC31E4BC85A96579
                                                                                                                                                                                                                          SHA-256:253F6B794062374BAF52A507F5FF6E907A4FA1327D6BC66A20C4E444324D496B
                                                                                                                                                                                                                          SHA-512:0ABE0711AB1F6C831D8E8572FED69FEAEA23EA7C6BA23C47BA2DB24B17488AE9305E1BCF26C2EBF92411F0B661174BE5FB5241C9FD9189D7E1330A7FEFEF3C75
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a..................................................................................vvv..................,..........u ..dY........@..q .*KK..F.......z..:AqUp".R..R}b...5..Z.D..KV....z.....3.o..0..F..X..-....X.......*..Q../.......!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\keramik\pkgIndex.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):314
                                                                                                                                                                                                                          Entropy (8bit):4.6474845144840975
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:CscL8MJ0B0ARVxXUgabAOgjDIxRVrMQ94L7rQ+pBdOcMQ94z7rQ+pBD:lcsB5dXGbyOerQ+pBdOtrQ+pBD
                                                                                                                                                                                                                          MD5:4950F2E4C2EC20D1A273FF3A91F91D2C
                                                                                                                                                                                                                          SHA1:9FD3397CA156DC911A4903850FB52FDC98E1A61A
                                                                                                                                                                                                                          SHA-256:C4AB8F7F48C9CE43449B010F3F359EAAF424227A395675D9A420C0E4129B750C
                                                                                                                                                                                                                          SHA-512:747D3E9270EB0EF03E950A3924B3BFE86851F110F501E81AD3DAB4EDF91C99C3F67E873EB060BF7A8912C39C0A8A121044DFAB3502C544CC65A67478286E64E4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:if {![file isdirectory [file join $dir keramik]]} { return }.if {![package vsatisfies [package provide Tcl] 8.4]} { return }..package ifneeded ttk::theme::keramik 0.6.2 \. [list source [file join $dir keramik.tcl]].package ifneeded ttk::theme::keramik_alt 0.6.2 \. [list source [file join $dir keramik.tcl]].

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\kroc\LICENSE

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2129
                                                                                                                                                                                                                          Entropy (8bit):5.13193662771335
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:Qze7RWpcbTvyJ3aoxxgHn6432sdICasG8yKxPgfjOXT3aZP0LYN:Qbcfkzxgx32l8dBXT3aZP8U
                                                                                                                                                                                                                          MD5:6BDBCB6E44CC21B2ACB125FDC908D2A9
                                                                                                                                                                                                                          SHA1:277A5E5F8079E04543C095AA6655CC0ED6AF178D
                                                                                                                                                                                                                          SHA-256:764995692B09422D3832F87F46249CB3201138368BE4FCAC73797066D08D2883
                                                                                                                                                                                                                          SHA-512:8A4983ACE4B43F55FF75FC13800DF2C922650A8F059B1BF922DAD4815C9666CB52AFFDFF8BE81B190E47EFD84C260948D38135B22BF7A20387295DB4DBD2CDA9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Copyright (C) 2004 David Zolli <kroc@kroc.tk>.The following terms apply to all files associated with the software unless explicitly disclaimed in individual files...The authors hereby grant permission to use, copy, modify, distribute, and license this software and its documentation.for any purpose, provided that existing copyright notices are retained in all copies and that this notice is included.verbatim in any distributions. No written agreement, license, or royalty fee is required for any of the authorized uses..Modifications to this software may be copyrighted by their authors and need not follow the licensing terms described.here, provided that the new terms are clearly indicated on the first page of each file where they apply...IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR.CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THIS SOFTWARE, ITS DOCUMENTATION, OR ANY DERIVATIVES THEREOF, EVEN IF.THE AUTHORS HAVE BEEN

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\kroc\kroc.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4538
                                                                                                                                                                                                                          Entropy (8bit):4.3100369811652515
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:BrRicCgbZTsZFx2RyeUrpyeJfc/oipwwurlyetKSCyT:Bdicn94ZFx2Ryegy+UA+wwurlye0SCyT
                                                                                                                                                                                                                          MD5:03DFC8447D207DBAB5FADC853B78F220
                                                                                                                                                                                                                          SHA1:AE43AF4AF2092017334B8108ADBFC289017E0E06
                                                                                                                                                                                                                          SHA-256:086DB04D5ED251D5D900120E38EAC391218CA3E8CE0F0501F83060AFD47C7888
                                                                                                                                                                                                                          SHA-512:5DF12614EE4E8A4F044FDC1721D0C7EAEB544744D8AB88E4D496F3280C33E43C552035E7E680B39CEB873D9FF18BCAB30886C6ABACA6FB85554DB3B4AA96EC48
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# kroc - Copyright (C) 2004 David Zolli <kroc@kroc.tk>.# Available under the BSD-like 2-clause Tcl License as described in LICENSE in this folder.namespace eval ttk::kroc {. . package provide ttk::theme::kroc 0.0.1. . set imgdir [file join [file dirname [info script]] kroc].. proc LoadImages {imgdir} {. variable Images. foreach file [glob -directory $imgdir *.gif] {. set img [file tail [file rootname $file]]. set Images($img) [image create photo -file $file -format gif89]. }. }. array set Images [LoadImages $imgdir]. set TNoteBook_Tab TNotebook.Tab. . ::ttk::style theme create kroc -parent alt -settings {. . ::ttk::style configure . -background #FCB64F -troughcolor #F8C278 -borderwidth 1.. ::ttk::style configure . -font TkDefaultFont -borderwidth 1. ::ttk::style map . -background [list active #694418]. ::ttk::style map . -foreground [list disabled #B2B2B2 active #FFE7CB]. ::tt

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\kroc\kroc\button-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):522
                                                                                                                                                                                                                          Entropy (8bit):7.2222334117663705
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:3ygHLPIAveZTnTf/UixEB4z5YxtBcFz7t9:3yg79v6Tz/UiqDtBmz3
                                                                                                                                                                                                                          MD5:659839F2A4EAAF731F2ADAB8EE8A3632
                                                                                                                                                                                                                          SHA1:D7A98AC1D7A3396BDD8130582FB8A1FE63779901
                                                                                                                                                                                                                          SHA-256:05876A2549656455BAE4C798915E3F1DC15A4BA513B08C53C17FA75DADA4E227
                                                                                                                                                                                                                          SHA-512:01FEF9DB5CB733ADFFDF3F56EECA5FD3299899CE7D3E40E440CAED28AE64CBC19B144D78C16E1F0BF89216F05604620D23FA3443059DE036B066A2613E895DDF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a . ..........6iD...Y..e.>..M..S..G.._.[..A.P..b..\.H.@.=.F.F.D..............................!.......,.... . .... ..di..(.b..0..q u.,.C4>.M.D8...@....N.........d:}5....e.a9..m..p.2...y.....bV6?.etz#...D.....>EBelM|s..R7B...H]3=I...@4.h...j.G...h.wYP.N...L.i8.`E5.I....Pq.:.T..[..X..=.9.h..5...w.4rO..8...O....4.......*.....n...8. ..-..\....P..MC.^.7...........D!........4.S.f.UAr...'...Z.h..P.A..%y.F..qj.4....Tb...}7-`.........-C...R.......,.(......F.Mn...!.^.6.!.lb,.L......H..3e.!..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\kroc\kroc\button-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):554
                                                                                                                                                                                                                          Entropy (8bit):7.274600327405029
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:3kDjkfpMez1HU0E7WhWXFvU1brpal/3Df5JcNoLJivO/4OyWY:3k/kfp/1Hg7WhSU1brY/3DoisvOyt
                                                                                                                                                                                                                          MD5:5DDAEDC2647E4E6F73A21F4F6C237A5D
                                                                                                                                                                                                                          SHA1:899344AFDFF33562F53194F2E0C428265002BAA0
                                                                                                                                                                                                                          SHA-256:E917E862EAC7E315149B01C512DAE88BC62446D63AB1518497EF581C3BA15EA0
                                                                                                                                                                                                                          SHA-512:92C93E8614DC707DCE5E92D72B63D3657EA3B7A0E364A44A631D56F3E81EC4D87BA9E2A6A071F5B4FC258672ED8F5914DAB94C89C71D7CC09796A059550A492C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a . ..........6..Y..S.._.>..G..b..e.P..A..MiD..[..\.H.@..J.=.F.J.F.D........................!.......,.... . .... ..di..(..Q....n...2..r.6...0....v(8....Y..h...l...a...Z....^...+..k..+...gMIE..0.dJ.>BaC8...S.E2..U....?p....F...@>^J.V.Xu.P...V.@.1..Sg..3...1..d?..4...Zp...R.K./...qPb.{.M.G..T.c...p.LK>..k...6.......TpG.....@....m.. .sC.:0..`;.._.k....A(d.......1.I.L..I.m"2.J.. d...kCPR$...N./..2g..W.j.....Ry:....e....m.5-..W.$.;.K..C.`R. .Ck...p.+-..~.D.G$3.^.Ip..?JXU...)I.M|.,...."1...o0..T.F,J.._.b.......s.!..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\kroc\kroc\button-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):548
                                                                                                                                                                                                                          Entropy (8bit):7.154526348235562
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:3ygHLPoJ3++9rKd4N39iLK8/O6IeQjcvPIRMhthD1KE:3yg78G4Ntid/KcvPIRKVUE
                                                                                                                                                                                                                          MD5:8CF1774C262E18FF1A63CE2AB486BB08
                                                                                                                                                                                                                          SHA1:E4FA9D3B7231AF7FEB84853067F236B74E040AE3
                                                                                                                                                                                                                          SHA-256:A6B75BC148F6ACCE036960C1EA711B6C668934C89E44F6F9915D3360466C4B20
                                                                                                                                                                                                                          SHA-512:B2A54537FD92CFFEB5F5B3B4BAA097CC9CE4E89888B3E89889820A4687677076D3FDA21828A5231922417A3D1E42313BDF1E24B11E130498026AF2257CA8DF05
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a . ..........6iD...Y..e.>..M..S..G.._.[..A.P..b..\.H.@.=.F.F.D..............................!..Fait avec le Gimp.!.......,.... . .....5.di..(.b.B0:.c(.Q.L...^..@ t..l...h..1(..rC.HQ......-...C.e....`S.}.GB.h?.\H=.d^et....m\...NB.G8e...8:.K\Q.`Q.9\.>t7....[.Q..>.vB...{.n.o`B.Df...D..a....O.g...>.T.N{.mrhG;._.C.........:mf.O....;...f.....!...'.U.:....(...nox5.......*d.F.V....p.d../..x1.o..k.%X.......0A....)G......G..P...ti%"...85..#.KU:BSJ+,).DU..._..v...B...f..XL....6l...{.o"n.....m.-46..]IWK.%.3k...@..C... ..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\kroc\kroc\check-hc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):281
                                                                                                                                                                                                                          Entropy (8bit):6.23205246233471
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HNPWQoaTlP8US6NjoMfz5YmP4iKWJvBScbZFpn:Hkd2Ltfz6m1JvMcbF
                                                                                                                                                                                                                          MD5:07046BF810A779FF9CC69DA905586197
                                                                                                                                                                                                                          SHA1:BB380DCCB04CD0D0F022DD606458795C7DAEF296
                                                                                                                                                                                                                          SHA-256:7FD97C9D3663D58B9241E2241F70058D10EA5F1703392B55AD2ACC48C1E9F853
                                                                                                                                                                                                                          SHA-512:B2964017A878BA0B67A6F67C028FA8A2954F4A93E359BFA0DD8C38D72C2FA4AA9A05729B2FB9E8597C0F921A1EC08278083B09C76325E5926BFC3401CFFA0564
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............6..G..Y..e.P.._..M..S.>..A.K..H.[.@..\..b...F....................................!.......,........... ..di.B0..1...$......s..9Vc.p<vD...b5..]/.....(............-b.6f.....6...*..V.......Xsc]7e;p...m>hfs.c...x..c..J...NX5.r}<q4....hA54i.;V2.a].KQ.c....!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\kroc\kroc\check-hu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):273
                                                                                                                                                                                                                          Entropy (8bit):6.173665448487711
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUJ8aL7WQeO6aT+aE5W++IlpUS6LUB6A70iVZIrEkuq2zl5iIfteh/iEweCN+7Ii:HNPWQoaTlP8US6E5MQnbKh/i8CE7Ii
                                                                                                                                                                                                                          MD5:05DF674453F57CF6E227FBE0D39A80D2
                                                                                                                                                                                                                          SHA1:2AD4EE1250D6B74695736651CB3B89FBC1175E3A
                                                                                                                                                                                                                          SHA-256:21EBC3E7D5B65620F031FDE4594F2CDF5385EBCEEB2D3276F8A5A703CDE2295C
                                                                                                                                                                                                                          SHA-512:99B3E3B64485CBCE6933FB56BCA2654B63B551A3CADD39678E241AC4CB588317C0236BEBCCB417B780768BFDA9C98866EEC4AF64949CB2C315797F13E1D1BAED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............6..G..Y..e.P.._..M..S.>..A.K..H.[.@..\..b...F....................................!.......,........... ..di.B0..1...$......s..9Vc.p<vD...b5..]/....P$!..5..[$..h.0...#j.V.<...5k0+I.so.+\blnPmWY<.J......oJ5~..;.?5..5Rah4.dS7..g..z3.[...........!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\kroc\kroc\check-nc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):303
                                                                                                                                                                                                                          Entropy (8bit):6.311058770954212
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HNPWQoaTlP8E8n3gWBycU35v0XsDX6mT1dyOALxmlE:Hkd2H8pnaSXZmT1dy3LxmW
                                                                                                                                                                                                                          MD5:5473BCF0DEDCD92082EC3371292B543C
                                                                                                                                                                                                                          SHA1:E9CB32C9AE5BACCFBF9989BF21BED2A1F4EFF120
                                                                                                                                                                                                                          SHA-256:8464EB7EAACB3A69DB55BE68604FF4D119E7BEB0B6FCD46C2B7D89B21CB1EC78
                                                                                                                                                                                                                          SHA-512:9D0BBCE0168A93C34EB2E2029FF9785D508B65B0ED9D06ED2207AA291A1F3ECAE1A7A5017CA43B80A145D3E9AA578931342CC5B3DF672B4761707794FBE31092
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............6..G..Y..e.P.._..M..S.>..A.K..H.[.@..\..b...F....................................!..Fait avec Le Gimp.!.......,........... .di2..@.`D....b.....[...[!.7 ..C...l9"$v.....!H.b.u..H?...`.I.*2z...mB.&.p$B...b~..`Q8r..%3.>.E0.$....H0.kmUHKCj.we.ZC.....8.m.;H9.6.>w.........!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\kroc\kroc\check-nu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):294
                                                                                                                                                                                                                          Entropy (8bit):6.26206529761745
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HNPWQoaTlP8E8n2ycU35yfTrpK+J1GxmjgukTNle:Hkd2H8ya2npP1FMNle
                                                                                                                                                                                                                          MD5:C5E2A0D843074E0B12EE157499CC1DFD
                                                                                                                                                                                                                          SHA1:ED09C2D3753639C32557990F0329D2F8A61BA8D6
                                                                                                                                                                                                                          SHA-256:FFE5CE196B6AA671B9FCEAF023A0212C38729C7A2D028D865FCD96D2C3FCFBD2
                                                                                                                                                                                                                          SHA-512:CC09C35FD004B2E10E75411E894637101F9317F2CF63DB0430B40F9947C54487F62D636D1223EC395774181F60D6BC50885BF07AC29B04D3CD2BE460FEBD22D3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............6..G..Y..e.P.._..M..S.>..A.K..H.[.@..\..b...F....................................!..Fait avec Le Gimp.!.......,........... .di2..@.`D....b.....[...[!.7 ..C...ly#$v.....E.NU.U.j..B.iU..W....x...X.[...i.>.we.l~=C.r|1...t.ikUHTjan.U.gj......}..D.H935............!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\kroc\kroc\radio-hc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):652
                                                                                                                                                                                                                          Entropy (8bit):5.967506546149714
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:Hnp1Vx++cRLjj87av8FNpKM5ysohnMNIPnWR+XmngjFMyDn:Hp97hNI2yGNUnWFnqDn
                                                                                                                                                                                                                          MD5:AED3488C9996D1CA5A69FA8BB9C838E4
                                                                                                                                                                                                                          SHA1:22F7F8067D3C5690B4599EE5023D7CFE2E149CC9
                                                                                                                                                                                                                          SHA-256:933B42FA18C588AB1733C82B1C8D8A16D20AC5EE525460DB60621C7CFB7D916E
                                                                                                                                                                                                                          SHA-512:69D98113709FF3BB15856D516D655266110E0CBE688F4791418B20C9CCF776BFAD6D3A04984E44BE0AF2E7D13EB797A502E2FA862695D3372E332F897C6B186A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........b&zQ.kE..Z".p*.@..[.O..M..P.O.i(.F..A..S.._.P..Y..e.H.A.Z..M......G.R.C.F?#...m...p+..b...b'.A.V..zQ...P...b'.B....G..\.>..R.C...D.o+.H...J..i..e..V.a..]......b.._..Y..k....................................................................................................................................................................................!..Fait avec Le Gimp.!.......,...............,..E....DCBA./@?>=...<..../...;...:...5....9...8........5.7..6..5......4.)%......3*21.#...&..../!.....0........-.,+.*..).('L@..o...$F..."..y.04.!.W......C0A.4d.t...[.*.`$..... xj.`%....$@p.@...1...@.......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\kroc\kroc\radio-hu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):644
                                                                                                                                                                                                                          Entropy (8bit):5.888132044114978
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:HnpVHVx+uTiRjzI87akILIZIHHC14xXtzEEO:HpVtC77IHmqtz5O
                                                                                                                                                                                                                          MD5:703BE944899ABEAD070434F5B6D7E628
                                                                                                                                                                                                                          SHA1:6521D1627258C7D2ABB9093893250C89D38E1619
                                                                                                                                                                                                                          SHA-256:67123E6A4D9039384AC06EBEFCF49BFD7B759F0175F2B907BCFCD5374850FC83
                                                                                                                                                                                                                          SHA-512:F7FE9A2BE79CC40A117701AA878C3448D4452315C1745A6DAB857EAD1D65A7BA85E3AB0972281D497DC1547FE40620BB5D899688D7D4055A2EECF0BF588A82C0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........b&zQ.kE..Z".p*.@..[.O..M..P.O.i(.F..A..S.._.P..Y..e.H.A.Z..M..\..G.R.C.F..m...p+..b...b'.A.>.V..zQ...P.B....G....R.C..b'.D...o+...J..i..e..V.a..]......b.._..Y..k............................................................................................................................................................................................!..Fait avec Le GIMP.!.......,..............B)++CB...A@?>.#=<;:..+9....#...8+.+7......6...5......4..3........2.1$.........0/.-.......+#........,.........*.)(.....'&%..D...@D.? .q.0...T.<.....;..jm.%HC.|..A.PA.#..&\...$....$@p.@...1...@....0...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\kroc\kroc\radio-nc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):632
                                                                                                                                                                                                                          Entropy (8bit):5.927171301289203
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:Hnp1Vx++cRLjj87azQNpRM4Z+5Pz9l5hmn:Hp975NfHwPzj5hmn
                                                                                                                                                                                                                          MD5:F70454ACC3EAB4663D8ED6F1B7B24400
                                                                                                                                                                                                                          SHA1:B56F5FF49F60EF6F19E66D9CA6C2F2336A4720D0
                                                                                                                                                                                                                          SHA-256:D3635125AA4E22B58A9014135E46310116E25C497FE0E8D1EC820E5E43A72A04
                                                                                                                                                                                                                          SHA-512:C0B02C211880C1E465B23347E421056383082C65732EFCC1D43A4C6C91BB74A89805909053318EE3A61328FB0E504B88EDAA6954294C8A22965437696E66E342
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........b&zQ.kE..Z".p*.@..[.O..M..P.O.i(.F..A..S.._.P..Y..e.H.A.Z..M......G.R.C.F?#...m...p+..b...b'.A.V..zQ...P...b'.B....G..\.>..R.C...D.o+.H...J..i..e..V.a..]......b.._..Y..k....................................................................................................................................................................................!.......,.......................................................................... .!.......".#$........%&'(.)..*.+,.-....../..0.....!....&..#.12*f<......%R..1pCA\5,..!h..W5......._.6........^5..........GKL=|....A.!C.`Zt..+..0...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\kroc\kroc\radio-nu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):621
                                                                                                                                                                                                                          Entropy (8bit):5.827582089364787
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:HnpVHVx+uTiRjzI87akI/88E5/3bczafJS1x:HpVtC7J8MbckSb
                                                                                                                                                                                                                          MD5:F67484DE189E81E95BBE88BCF95DE96E
                                                                                                                                                                                                                          SHA1:D516BB3FCA50CB1C074D7BB1208972CA9E8257A0
                                                                                                                                                                                                                          SHA-256:88F48FE37328944EE3673A3EB2BB6B019AD07B193323A6152C76DC4FE341848B
                                                                                                                                                                                                                          SHA-512:8982095F3F52E7EEB0C55C79161B6A8DD2743E210359C16266D0B9F9D4705419B00682F1679AA83FCD6D7E2BA08409CF76416D02855119DC947BACC5139064CB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a........b&zQ.kE..Z".p*.@..[.O..M..P.O.i(.F..A..S.._.P..Y..e.H.A.Z..M..\..G.R.C.F..m...p+..b...b'.A.>.V..zQ...P.B....G....R.C..b'.D...o+...J..i..e..V.a..]......b.._..Y..k............................................................................................................................................................................................!.......,................................................................................ .!"....#...$%&'...#..().*......#+.,.............-./0..T......1....n`...f..@#.3l.k....F.l...X.h..P .. .I...=F ...H.L...Y."..L...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\kroc\pkgIndex.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):209
                                                                                                                                                                                                                          Entropy (8bit):4.644422957157522
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:CscL8MJ0BFUMXARVxXUgabAOgjDIxRVrMQ9sCu7rQ+pBFgv:lcsBfQdXGbyOsCCrQ+pBmv
                                                                                                                                                                                                                          MD5:2370EF2204F608CF759D2D4334541013
                                                                                                                                                                                                                          SHA1:765C7387B775D73C099917EBC18F1C7D8D4F6F7F
                                                                                                                                                                                                                          SHA-256:E1CC378252FC8780D21BAF19CD61BF2B99BA67A59DF8588F5CD5C1D5E82CFA62
                                                                                                                                                                                                                          SHA-512:44FAD593B3B5B4EA05646D41B3CD0E4F2966532C7478CED911B6A5189DFF64D96763A9F986DCFDCDE1F0D18D8736DFD90385E65BD0025B47248963BFA00A3577
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:if {![file isdirectory [file join $dir kroc]]} { return }.if {![package vsatisfies [package provide Tcl] 8.4]} { return }..package ifneeded ttk::theme::kroc 0.0.1 \. [list source [file join $dir kroc.tcl]].

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\pkgIndex.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):511
                                                                                                                                                                                                                          Entropy (8bit):4.912867571092012
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:Ai010F3AqMtryM0mvqS/swrD62NVdM0F7JrQ+pUtq4v:4iWJ0+/swrDU0hJrBUEi
                                                                                                                                                                                                                          MD5:230381D9C00AF0D9DACA118CD2CFE53B
                                                                                                                                                                                                                          SHA1:473E0F04077F16B27BC6B3B1CD6666AEC45AF5B0
                                                                                                                                                                                                                          SHA-256:00010F3DB870B58C49342FB7EA0438BCCE0159B713C57E87CBD7D8BEF0F0EFA2
                                                                                                                                                                                                                          SHA-512:B119FB068D7FC8AC6D9DB610FA3F96CBC352EAE5DE30F559B7EB4AADE95E8DD454D441B566F574153BA8D54B3C1701D1A18B79AE068BB6F88A734B31AA60202D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Author: RedFantom.# License: GNU GPLv3.# Copyright (c) 2017-2018 RedFantom..set base_theme_dir [file join [pwd] [file dirname [info script]]]..array set base_themes {. aquativo 0.0.1. black 0.1. blue 0.7. clearlooks 0.1. elegance 0.1. itft1 0.14. keramik 0.6.2. kroc 0.0.1. plastik 0.6.2. radiance 0.1. smog 0.1.1. winxpblue 0.6.}..foreach {theme version} [array get base_themes] {. package ifneeded ttk::theme::$theme $version \. [list source [file join $base_theme_dir $theme $theme.tcl]].}.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\LICENSE

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2147
                                                                                                                                                                                                                          Entropy (8bit):5.118927071773829
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:T7RWpcbTvyJ3aoxxgHn6432sdICasG8yKxPgfjOXT3aZP0LYN:kcfkzxgx32l8dBXT3aZP8U
                                                                                                                                                                                                                          MD5:068C97C6C8E124BC92F1BC75D98B8576
                                                                                                                                                                                                                          SHA1:B403245714412EF38CCBD210D00E44ED668C74A3
                                                                                                                                                                                                                          SHA-256:71E39EF5D3E58F2F00FA1EA3BB0419CB5B447FC9CCD35F8E30FE2D88EE9D70F7
                                                                                                                                                                                                                          SHA-512:6998E7F5F95F3043B94DEA0185DB4AD1B5403884174462BE7395D456920D3830773164C98D470DF01CF51629A663B4D26BC8F67864077D9E891383FFB14FC73E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>.The following terms apply to all files associated with the software unless explicitly disclaimed in individual files...The authors hereby grant permission to use, copy, modify, distribute, and license this software and its documentation.for any purpose, provided that existing copyright notices are retained in all copies and that this notice is included.verbatim in any distributions. No written agreement, license, or royalty fee is required for any of the authorized uses..Modifications to this software may be copyrighted by their authors and need not follow the licensing terms described.here, provided that the new terms are clearly indicated on the first page of each file where they apply...IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR.CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THIS SOFTWARE, ITS DOCUMENTATION, OR ANY DERIVATIVES THEREOF, EVEN IF.THE

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\pkgIndex.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):219
                                                                                                                                                                                                                          Entropy (8bit):4.653013395678063
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:CscL8MJ0BW3ARVxXUgabAOgjDIxRVrMQ9Dm7rQ+pBWK:lcsBRdXGbyOmrQ+pBL
                                                                                                                                                                                                                          MD5:41FE8EB7C263CFCF2652BBF7FD6853D5
                                                                                                                                                                                                                          SHA1:34CD3FDB569425FAD8F5DE4130CC01E388153750
                                                                                                                                                                                                                          SHA-256:9B17733ACB01F7263CBCA38222B9D0EC88D286B627B0E408248BB9E1922FF70F
                                                                                                                                                                                                                          SHA-512:A6F0022C60DF23223DCCC82089D76AEFDC8BBB2F33E515B6BF2D9181C82E71DE9D62E554F67033807B559932C94C80E4260A74BF977CF9A80CC99A85F6939E32
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:if {![file isdirectory [file join $dir plastik]]} { return }.if {![package vsatisfies [package provide Tcl] 8.4]} { return }..package ifneeded ttk::theme::plastik 0.6.2 \. [list source [file join $dir plastik.tcl]]..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9272
                                                                                                                                                                                                                          Entropy (8bit):4.836283088228762
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:yGj54NynOuqCyn2S70RDUVrNRqZSNPZa1K2c:yomA/u2SQNUVrNRqKZILc
                                                                                                                                                                                                                          MD5:252B7308A7E120876F3B71A27727C69F
                                                                                                                                                                                                                          SHA1:A6C91262A773E217A5033BA3BEF5FE934212B60B
                                                                                                                                                                                                                          SHA-256:1F4F4E3E670766D7C2CABC16D094E66F86A5ACA74086069B496F28CF90918B3F
                                                                                                                                                                                                                          SHA-512:98EC3FC2B79D633BCBB62CD60BB956A433DBA9565F070097F0388A5AA91E46BD408727371CA78BEE1F8CA06EC22F3F8DC6DCDC4CEB52C28A3761BFC8B6FDE030
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# plastik - Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>.# Available under the BSD-like 2-clause Tcl License as described in LICENSE in this folder..package require Tk 8.4.package require tile 0.8.0..namespace eval ttk::theme::plastik {.. variable version 0.6.2. package provide ttk::theme::plastik $version.. variable colors. array set colors {. .-frame .."#efefef"..-disabledfg."#aaaaaa"..-selectbg."#657a9e"..-selectfg."#ffffff"..-window.."#ffffff". }.. variable hover hover. if {[package vsatisfies [package present Ttk] 8-8.5.9] || \. [package vsatisfies [package present Ttk] 8.6-8.6b1]} {..# The hover state is not supported prior to 8.6b1 or 8.5.9..set hover active. }.. proc LoadImages {imgdir} {. variable I. foreach file [glob -directory $imgdir *.gif] {. set img [file tail [file rootname $file]]. set I($img) [image create photo -file $file -format gif89]. }. }.. LoadImages [file joi

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\arrow-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 7 x 4
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49
                                                                                                                                                                                                                          Entropy (8bit):4.137763337128992
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CHMxkLIeBe:WIkO
                                                                                                                                                                                                                          MD5:68A39E77E53F1E0CB5A83FF06485469C
                                                                                                                                                                                                                          SHA1:4A3E51F3A226B50F647681426E4A573F017A2DDC
                                                                                                                                                                                                                          SHA-256:9340F4CF8C07D80DFB4FCE0196042AA3272ABDCF731827586B15B5BEE556A2FC
                                                                                                                                                                                                                          SHA-512:8806AAB4A576B1F2358FB695ABDF53192756450825D539B58AF2A1038795208CB47BDD3D9A53F5F37972442861CD805AEE93AB1458ACBA0A04006EE0B713AC1D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...............j.Y(.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\arrow-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 7 x 4
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49
                                                                                                                                                                                                                          Entropy (8bit):3.9766555072480574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CHM/RPQSkLIeBe:W+QSkO
                                                                                                                                                                                                                          MD5:5F9AB7F87E4457D6D3D680F6DBB8EE7C
                                                                                                                                                                                                                          SHA1:CF664F2F177ABE47D9EEB423FAA19A3850540888
                                                                                                                                                                                                                          SHA-256:15194CAA941506CD234D281D5707123C76E3CF7281AB1B38F158340320AB02EC
                                                                                                                                                                                                                          SHA-512:5EA329A51F3E4D4264DA1891D62BA5CAEA17FC360B0C4A2560F4C39E3581BC3E042D9AAFD789744F6470D88AF1E84786B42A9AA0F82F0E03F758D07D2D274CFF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...............j.Y(.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\arrowdown-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):218
                                                                                                                                                                                                                          Entropy (8bit):6.169143976825048
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:N2c81T2QLDXN6JTO9zOzOzOzOzOzOzOzOzOzOzOzu6H9UWxJWJEcBzYH0n14jU:wckWJTO9zOzOzOzOzOzOzOzOzOzOzOzY
                                                                                                                                                                                                                          MD5:A6ED1040B421CC62004A58B7FECF0940
                                                                                                                                                                                                                          SHA1:23CC9616D34B25BEB2BB1FE97A34C23424EB4BC7
                                                                                                                                                                                                                          SHA-256:E398C120DF7B4C0EBBEE92EBABE4E5E982B7F8C8E1E12DF1F8B2B47797EBDDAE
                                                                                                                                                                                                                          SHA-512:3A662481080008EBD49FA94275B233D576EEC39CDF34DCE988DFEDEE5DA2297A12FB052B82F49B0C56B4A90117AA3776D4D58D12AB4C67DB22A6519F529B0C5F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........W...dY.P....=N.,J..FA..,.6...x.f.[n.;...&`J.,..F. d.}.*....../...m5...:.i.`......"&..!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\arrowdown-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):225
                                                                                                                                                                                                                          Entropy (8bit):6.039048233149024
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CstMk/tNw5jAtE9vgppgjRa1N0aaJS6LotYh2vxa2NvbkyjUeO/DPHy0iUVLb7At:NtMkF8XIkaLjaJS60ZN4wUeMPQOL38
                                                                                                                                                                                                                          MD5:42CA714678608C49828B49D968430419
                                                                                                                                                                                                                          SHA1:7021A7024B90FC1851388145373A308F9413C0A3
                                                                                                                                                                                                                          SHA-256:CEA5F5AA47E248A765632ABA66DA0B2F9836F9C3F93621DAF08B9C5D4FA74F0F
                                                                                                                                                                                                                          SHA-512:73B93D2058D58D4C988FFF64FD5DC16AD84CE914B91D3001D9D397E0274BE89CDD3B68C2A3820E3B4F6688482B096F53ECE9C8227975B04B56C4697044EFEE8F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........^`..dY.B:....p1.. ..,L.8.Y...~A....|@!..DJ..cT9.x..+...@.K.W..6).m.i<_...4k.=.........."&..!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\arrowleft-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):353
                                                                                                                                                                                                                          Entropy (8bit):6.431160357529578
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NF/lic8IeptKvjrn0nnkxLSWNesCtIVcqW19zOzOzOzOzOzOzOzOzOzOzOzOzOzi:JicAKvjr0n2dWqWrzOzOzOzOzOzOzOzw
                                                                                                                                                                                                                          MD5:6E54DE9DCE418FE16A71B4E1D02D0E2B
                                                                                                                                                                                                                          SHA1:5877ACC483873547CE506E9F566F5E3E1A5D89FC
                                                                                                                                                                                                                          SHA-256:5A5058BEB876761ECE7912298E98DDD8AE1943294BFD7B5D8CD5F59A5385097E
                                                                                                                                                                                                                          SHA-512:4F291C6F6026065DEC370E82BC7C3B55424BC379E981353D6503613C6D95BB1EF8BD0051C9A9AB8C33E923544270E51499BA2214F8B6EFF0DE640C9E6FDCD22A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....).................................................................................................................................................................................................!.....?.,..........~.. @,...!j.l2.'.tJ.R.&.v..N...x...#D.f......q..c..{.A.Y.x....D....x...D....n...D........D.......D.......D........C......BG.D.A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\arrowleft-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):242
                                                                                                                                                                                                                          Entropy (8bit):5.987729382428325
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NtMkF8XIkaLjaJS6OMz5Um7Ni3MF9g9NRGEKn:3OXIkaLmJ1z7KsCNIEK
                                                                                                                                                                                                                          MD5:CC944C0EB1031708E44AF4E13DABCD1C
                                                                                                                                                                                                                          SHA1:DFABCBB2ECC59DEFCC369C1667ADB605FB5C5F84
                                                                                                                                                                                                                          SHA-256:69A9467A3BA3EC92ED9EEACF2421EEB1FB63C77AE679D6F41EE8D5E2556E1C0A
                                                                                                                                                                                                                          SHA-512:A281B8F58224706633E1A17CEAA5A6C475ACA5B4E810252D023BEB653EB75A23622DC129DB5F97A28D5A082ECA7C9AF06285BBB856855C73197018311C72EEE3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........o...di..(.l..!....~...pH.6H.".B<.....B.&.$.b..R..,.(/....A"..j.....v...h......$a............#......"'.$.!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\arrowright-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):354
                                                                                                                                                                                                                          Entropy (8bit):6.341139471940147
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NG/Kc8K0P5SK+1vAj2emFbQzOzOzOzOzOzOzOzOzOzOzOzOzOzOzOzOzOzOzOzO0:jcCP57+FACLFMzOzOzOzOzOzOzOzOzOV
                                                                                                                                                                                                                          MD5:3645EF01E46DA179BE75AAB4721FA10C
                                                                                                                                                                                                                          SHA1:97A6A32F05D57A38F046ED5EF44C006CEA9B8108
                                                                                                                                                                                                                          SHA-256:9AB7CD5D612217374C3C2BABA3EA85A4928659916142D46A25689BF153A0EC60
                                                                                                                                                                                                                          SHA-512:64336718316AD2F140E854D13B4AE918562C689C5AD21FAC9B69EA02BB5AC211F940D7CCE90186DFE942173537A82E525CA3064FF3365F17E515481E50F9E32B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....(.................................................................................................................................................................................................!.....?.,...........@A`H,....i.l2.BShJ.N).g..n%C.f.....(.....c(..-o.....*..y....C....y...C....o...C........C.......C.......C.......C.....PBF.P?A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\arrowright-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):242
                                                                                                                                                                                                                          Entropy (8bit):6.153044294986793
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NtMkF8XIkaLjaJS6fz09LegHzt9jc/0m97Gs4Den:3OXIkaLmJ9z09Legh9j80Sqs8e
                                                                                                                                                                                                                          MD5:3360AD5668CC9737E9891A235CFB4416
                                                                                                                                                                                                                          SHA1:BE88F279E975C2FFC5DC5EBF5E18FEF2903EDA43
                                                                                                                                                                                                                          SHA-256:0618F2567900DB5EC6599205EF455028978A078E5EB214F6250D18D73102D56B
                                                                                                                                                                                                                          SHA-512:137CAB8991052E4AE7D313EE995FF04BE104DE0D36A8AD6C924DCA7438A9BD26DA3ED06CB1E4EDE939721D7E1B9A2CF8CAB3CDA745E602A7947C89EC353ED494
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........o`..dI.. .l...`.t=/.p.|.3#.bH,.....bD4F..TJ.L...A..V)]E.pX.._..1*...7d.`...}.H4......#.......#b.........0"&.0.!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\arrowup-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):219
                                                                                                                                                                                                                          Entropy (8bit):6.210033529514904
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:N2c81T2QLDXN6JTO9zOzOzOzOzOzOzOzOzOzOzOzu6FnkAmcwi7dv+5Skt2:wckWJTO9zOzOzOzOzOzOzOzOzOzOzOzh
                                                                                                                                                                                                                          MD5:3741FC63A91BFE210EA66142A6B2774B
                                                                                                                                                                                                                          SHA1:AF41EFC299EA1DD62723FC2A233E1493469C7CE7
                                                                                                                                                                                                                          SHA-256:07F14834F0DC7956DB1562677836A8BB2A53C53F66EAE3AC01A809DE98B22AEC
                                                                                                                                                                                                                          SHA-512:80CE81450F50DDEB2F47EED0D7FEB6E40A895E8AC64220D882F844ADCABC459C7DB8789EF525A49035FC16A91B900DC9AF31C21228CD9E14372048B4C8C39386
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........X.'.di...@l...=N.,J..FA..Y...~A.........DF.7@...2.`.3Y...].y.%O...).z.h7.n.....1'.%.!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\arrowup-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):226
                                                                                                                                                                                                                          Entropy (8bit):5.855112095500455
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NtMkF8XIkaLjaJS6TiutuNiHFP4lmdIyNEn:3OXIkaLmJloiHt4lmde
                                                                                                                                                                                                                          MD5:D9766B0205C0E57993943093A190EB06
                                                                                                                                                                                                                          SHA1:70CB4F43BC4D41EC61C0C63095E2CC6765BDE3D3
                                                                                                                                                                                                                          SHA-256:EF55AF1FA8A99FC24A6759968D4FA715AC03EBE9A8DC26A75C149EAB87B29CC0
                                                                                                                                                                                                                          SHA-512:45A5C9D68214B26D0A06E3E9E2E6A26926ABA24A1DF77A3E09624632A02F158CDFAD056E38940554E1EDCEAC4B7B2C827F3FFCA7B5F24282C982136C8E6938A4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,.........._...di.......p!..`...(..4..d..x>..x..z..p.<B....]R.;JR..S..l.....8........O..........4'.%.!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\border.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 15 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):88
                                                                                                                                                                                                                          Entropy (8bit):5.455766630938888
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C4E2jTTGRRjmp/Q70bDGZ19HLXFr:r1jTiLjmp/QIbA19HLXFr
                                                                                                                                                                                                                          MD5:EE0662329970E326972B7EB05A4B7197
                                                                                                                                                                                                                          SHA1:1F001FF5A5DFC72F3289718BC19FF16957A99105
                                                                                                                                                                                                                          SHA-256:B722538F2A6AD94316CFC5233EBE748B279A0EF9BF21EC7A63E0D71AB6F82830
                                                                                                                                                                                                                          SHA-512:86B238136A7C9AA09342710C082E5D1DBE189BF7A4A8226AAEEA15ADFF26E12399D005BFE6DCC89D4F95C90756271E95E992A7AEBE556E03B24377BF92A87B0E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......,..........)\.........K-.h..E`.........{......$.,KS..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\button-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 23 x 23
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1209
                                                                                                                                                                                                                          Entropy (8bit):6.144757221365747
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:MHl8L9Ce5/112cOcEXccccccccccccccccccccccccccccccccccccccccccccc5:Zce5r2BTE4pU
                                                                                                                                                                                                                          MD5:4786E7A91C526CD1AD4C3718CFD6142C
                                                                                                                                                                                                                          SHA1:BB3DCAA5F5A478E8C0232F92797F4F43E930ABED
                                                                                                                                                                                                                          SHA-256:C06BFDD65FB8B5D060F227391A4788DA6EFD2966B93FAE9FB6088DE5989018A1
                                                                                                                                                                                                                          SHA-512:A6A16263947EA80B6A50CD77535B9C83137865F94827E98923DB51D20603F350D56F8EEC9C1EE2FE17F21F92E9E2EFEED2219013C7DB654A56BFC954C3B2B6F8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,...............@........ .......X....3..3... ?. ....8&..A.G..:t...3....}.I....7n..e...6B.. .G.S2P..cF..c..S...=[.p...L..].Q.......X.{e..+X.d..%...y=......(S.......(S.P..8.A<H2kV.3.&..0...A;D..&"dH.!E

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\button-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 23 x 23
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1221
                                                                                                                                                                                                                          Entropy (8bit):6.251275888766585
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:2HIY7W3t/k/BMGeRatTEk111111111111111111111111111111111111111111m:2v7W3pFGdtwhCsUN+Yxtu1NIQ
                                                                                                                                                                                                                          MD5:E652BD7FA0FAACD15AF938A344C1B2D6
                                                                                                                                                                                                                          SHA1:B94938B1010DEC9FD38F881353CFF1F008B37EF0
                                                                                                                                                                                                                          SHA-256:F75A07D0879413FA688A979CC4675C6444CEA21C200ABA4C469EC9E3783EEC99
                                                                                                                                                                                                                          SHA-512:1B99CF2B5C1C2A4396BC74A93E72DFCF2A821BF3EDA292D04FB26BDFE0B32969781BF17630D2E422287B99F7D24980A2D65F12CFBFDDB8D2932436BEC8201350
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,...............@........P.......H(...3b,Bp..=.A..3R.. ...s...;r..3...9q.y....@k.q...P.C...:. 3d..J.1a...F.2cV...K./\..]....~.h.b...,V.\....].V.x .G..*T.+."eJb.5...D..(L.\....'M.<.@...#H..A...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\button-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 23 x 23
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):302
                                                                                                                                                                                                                          Entropy (8bit):6.523969881196499
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:qmvIkaLUAVqPdLNXFuJkKmUOQFIBkk0PbBs8xIGgnn:pvIkaLUAVqPYkFxMdUd
                                                                                                                                                                                                                          MD5:631F3CB449426CD4E7D22B7A1B7EEE99
                                                                                                                                                                                                                          SHA1:103C3CB2C3732E51CF0BC12F719960EB71677B34
                                                                                                                                                                                                                          SHA-256:7CF74CF236436235A45B7B9A3BDD3B7A0D29BB4C89979D84CA04528BE8B413F3
                                                                                                                                                                                                                          SHA-512:4EFF79E51D961F1A42EE1F5D993F8F703879271423000BFF1F31BADA2C3FC94C62BE185BDE8FD2829395B2F271A4686464F04F43D7F37F91D0BE7EFA38442A9A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!..Created with The GIMP.,........... ..di.f .B.....a.x.3..:.`p(...c.DH:.K..A.Z..h...:H..xL.....ymF...|.....<..8,......$...................$......................$...........#......3+(.'*!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\check-hc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 13
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):141
                                                                                                                                                                                                                          Entropy (8bit):6.01442753004818
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C6Ee6xANOqRQaaESqq/J4VYDAOvvN+nnrpJhnTyFhE:QeQANOq9aESq62y9V+jwy
                                                                                                                                                                                                                          MD5:0C478DC4F715E09417132DF50155D618
                                                                                                                                                                                                                          SHA1:0782415DEDD2FA697C4B9FE280D267E6EAC4C0E7
                                                                                                                                                                                                                          SHA-256:F29589FEBC59B680B60B15D3A17555879407F00EB5F539010AFEE09F94425CDE
                                                                                                                                                                                                                          SHA-512:363B838EE3435B1EA56F2D4191972EF3B1D4B507C7927383B1B1AD17166B3C6BF9DBA4DF50373E31DF0D3222E0A00B09AC63E97DB0763DCD707E098D6E578BF1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......222...........................................!.......,..........:.Ik.$.=&..p.............w.t....$:.n.D.h0...+..%.`J.^,XC..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\check-hu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 13
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):145
                                                                                                                                                                                                                          Entropy (8bit):6.125758442218798
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C6N/HYxLxAH2cIWXRQwSqq/N1pc9VIUZVnx2E+mahriAhW:Ox1AH2cXQwSq6nmV3Nx2TEAQ
                                                                                                                                                                                                                          MD5:4FDBCD482C3D8F476BF0BF9366B264C1
                                                                                                                                                                                                                          SHA1:F019CABF2746328CA980A3E7964912DE5CA62710
                                                                                                                                                                                                                          SHA-256:94F2A57816CD6F169A2ABD45BE7FDA91BD023399F01B7E1E1732AE24111E84B5
                                                                                                                                                                                                                          SHA-512:42497067268CD3F19EA8CFCA97CDA2AE5A424ACDCBAF201A9CDAFEA49409344FCDC0CE92D61EE13570F7F6C11FC4EEA9E46470417CF2EE4DDE1E91FB30BB175C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....................................................!.......,..........>..I+."...(`....1h.^.....b...%|....p........l....4Z.......%D..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\check-nc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 13
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):198
                                                                                                                                                                                                                          Entropy (8bit):5.8019454155917884
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C6mmBc5J1sLRKH8ZbpRaHS6ed8T0Plr5eMfUAxLJCg5ODZ:imAk1W2aHS6eM0dTcAxLYgQDZ
                                                                                                                                                                                                                          MD5:4C4681C4463A131E5CFAF0B0B47BC893
                                                                                                                                                                                                                          SHA1:1F36992CF7FB32DA4A5CD0F13E2E7107075036C4
                                                                                                                                                                                                                          SHA-256:0F4772AB1F4806C61CEC5C4973DA7C9C18C3BE46B6C63FD4AFC06191EB0D46AA
                                                                                                                                                                                                                          SHA-512:3702F0A18D958FD251BC04033317ECBDD812CE8C28C591AF45D328638F529DA69342EAE87DCC035C6EE50E0C209A67DB76A0F1D269DB7674F468AE2A3EEA10B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......222.............................................................................................!.......,..........C...d..T...H..0...@.Hp...X..pA.:...p..M...$".....[..XAb\+...p2..!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\check-nu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 13
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):197
                                                                                                                                                                                                                          Entropy (8bit):5.688637875392423
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C66L6t5J1sLRKdXH3RaZbpRaCS6ecFzaEPesJZUd82LhzBnRArJe:Wyk1omaCS6ecFeEWYE82LhzBRA9e
                                                                                                                                                                                                                          MD5:2B7C40867A26DACCBD83B8D92660EEC5
                                                                                                                                                                                                                          SHA1:CC156984767327E999608FF972299CFB1DE2B6BF
                                                                                                                                                                                                                          SHA-256:966E1864D869CEA255F74F61293D7834977E8E851C67C19CB6A1A54C6D5AC236
                                                                                                                                                                                                                          SHA-512:BBCCC33F1718ABAEAA52894F7F8509E411CE75EED09FE64531895D1EE1E097EF62E113B6DC34C8ACB0DC2AA77FD0A22A2AE0E8B90177670D6F43600EB08F9548
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........B`..d..S...8Ip.Cnd..B|.3..p8T...d..b8.O.kA.V...v.%...px0...h.......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\check-pc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 13
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):144
                                                                                                                                                                                                                          Entropy (8bit):6.016473915134837
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C6LNtbkIOqRQaaRSqq/O1l6YD9pZFhu5MGRfO5hPl9CRPgE:HzVOq9aRSq6Off7hafO5EPgE
                                                                                                                                                                                                                          MD5:B89473A19C86C733E62828F8D4AB5881
                                                                                                                                                                                                                          SHA1:7DD191731602CC7F117470A0B50F810B79C66735
                                                                                                                                                                                                                          SHA-256:48C9CEF4505625279FD5AEDE59E639D1362D2604A42B705D948F7F50F6ACDCDB
                                                                                                                                                                                                                          SHA-512:97C37144DDC48DA0D0A8D872FB50C15D30561E6848290B06C2A8BE8D6947FE287512861D3AFA632D9883C53444A7CDE57C2424B5C5E6F1CEA7D11074720E0027
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....................................................!.......,..........=.Ik.$.=&9....... .........t.#.~(:.....|......a.....X..ek...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\combo-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):320
                                                                                                                                                                                                                          Entropy (8bit):6.958514168278555
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:7lhV3oUrhLeIK7oTBjT8S64ziYQ9pwK9YT8LqsEoG+I4/EvtionjdMMr:75beIeoCWa9uFoXI6EvtiojdNr
                                                                                                                                                                                                                          MD5:74ABB8048743E634DE760EA76ED8B688
                                                                                                                                                                                                                          SHA1:9CA183B5E085584930193C918F185D11DA4658A3
                                                                                                                                                                                                                          SHA-256:FD8A82023CABCE4D9CD8F27490287152AF54DFF3EE0AF78D519B25EAD0F4A8B7
                                                                                                                                                                                                                          SHA-512:8A29D0C825A6B9150E3ED8DEB4D1A95A80AAC655CC5C938D928FEADD0642CF5DC686AFBD54E6C43625673D69E7DE97E103F2D780EE5E7EB7377C98913DF55C3F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ....................................................................................................!.......,.... .......G.di.hJ......tm..h\|....pH.....oy.Z...d....v[.... eL.S.J0/8i.....((H...D>o.#....|sA......jA......`A......VA......LA......Wu......au......>A......t.......ku......~......H#}~.....9,)..%+!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\combo-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):453
                                                                                                                                                                                                                          Entropy (8bit):7.046271776347947
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:74oOIMPqxswF4ISkMHeeYwrxrk/4w7+8Ib:0HPKswekaVkn7+8m
                                                                                                                                                                                                                          MD5:C698C8C99FE9393588DE01586FB41471
                                                                                                                                                                                                                          SHA1:8CC98C1608C312902A42C46267BBCF4EF87582F3
                                                                                                                                                                                                                          SHA-256:941F35601C1BD77437A21C39BF6ABF5E40129077FA881E6596D03A33EF1E6C91
                                                                                                                                                                                                                          SHA-512:E79F7213B979582D846AD9B584FAAA4DF09A42EA44A8C88C7606F42F7168257837F0187C97A6ACE7B5A10BAA42FEFDB1EB178D4116773890A4B9CDF7DE924BF0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ....:.................................................................................................................................................................................................!.....?.,.... ......._.@,...d@..8..' G.Z......z.:..F.........\.<.Q....k...3vw^a5).......`.4&.......a3$.......a2!......wa0.......x/......._a-.........+.......]a*.......(.......5a'.......a%........#.......D4.H. A..@,X.!..Y..H."E..2j.1..$ C.Y...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\combo-f.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):463
                                                                                                                                                                                                                          Entropy (8bit):7.205476207228891
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:7VgHIMPqxswF4ISk3HAvSNn+mygJ/vZiwr5t5Lt/ev57xOn:eHPKswekXQS5Xvco5tRtSc
                                                                                                                                                                                                                          MD5:B6357A2CC365AC77637531304B12B4BE
                                                                                                                                                                                                                          SHA1:E06AE435D103A916E7FB37AFF858BFC695F35C05
                                                                                                                                                                                                                          SHA-256:3B4179B174A3E91AE3A40AD3A6F68A5C043A649B9E84FDB0E3FC9700133AF576
                                                                                                                                                                                                                          SHA-512:F9552F798ADC4F53FD5E030D0FA1F6D629F9AE1781D59962C10F5E579EF58C65AB96142CD5E482F329B21114C48831577D267D49BEF7D8189ADF9B6E981511B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ....=.Ok............................................................................................................................................................................................!.....?.,.... ......._A@,....r......tJ..x.V.....w.....4.....d]lN..?m.........y{bd8,.......`d7).......=d6'.......d5$.......d3"......{d2!......|0................ad-........+.......c.*........(.......d&$..Hp ...J@X.!...G8.H."E......#...B..9...#(..T.$..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\combo-fa.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):330
                                                                                                                                                                                                                          Entropy (8bit):7.0272668882289455
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:7lhWjuw2LeIK7oTBjTnS64oUMx0+5/JMKQ7czj4lMq8Bbq5kmjhg19LyZ:7ijuteIeo9Wow+5x9hzqgSkag19yZ
                                                                                                                                                                                                                          MD5:28F652313716D16BEE7053CF65ED6628
                                                                                                                                                                                                                          SHA1:66A97D2C07309CA06EDAF4A0DD3F1BE4A966C54E
                                                                                                                                                                                                                          SHA-256:9452DAE16EAA85490FCB7E9CD13BCD2FA30314921259599FE88FFFBF8766E030
                                                                                                                                                                                                                          SHA-512:CF96106BD3752434F920914C34018481AF2D0EB24FE7875E32ADEF13F2D50F3121968D3EE699C71A0D85EF2E1960DF287E80545812BC4DB239CE1DD66BDE2A45
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ......Ok.........................................................................................!.......,.... .........di.A..lp.. ....x..n.....pC..HcA....D."C.Z3.&..-b..0&......z....s.B..-.\Z....yz.h......zh......qh......fh......\h......]R......Bh......Ah......{.......CE......E......h.....L#.....7......0'.-.*/!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\combo-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):446
                                                                                                                                                                                                                          Entropy (8bit):6.997548694946745
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:74oOIMPqxswF4ISkMHUYXCx28QnVVwrwMOcZwu:0HPKswekaTCg8QVVwrwMjZp
                                                                                                                                                                                                                          MD5:36065635B172F0DE481B7EC60452EC46
                                                                                                                                                                                                                          SHA1:6CF4088C2ED5A5B13F910A68D68FA3442DD17517
                                                                                                                                                                                                                          SHA-256:70A5017BB6EB3656566248685A7770D0F57E6BA79F989E5398EC7E7133BCD3BF
                                                                                                                                                                                                                          SHA-512:34F4E024596AB30B14437C8C99ACD423CF744ECE53891E654586AF2E136D3B3FD0E27BA0063881091113AAAAE8A56A196212A8E746D144F60BBBFDF1E8F7DCB1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ....:.................................................................................................................................................................................................!.....?.,.... ......._.@,...d@..8..' G.Z...@..z..\lL..;..w...\.<.I....k...3vw^.5).......\.4&........3$........2!......w.0.......l./.......x-......._.+.......*.......`(.......'.......m%........#......."....(..=...*\.p@......H.b.,L.h.XdI..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\combo-r.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):728
                                                                                                                                                                                                                          Entropy (8bit):6.468614032450755
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:75Vn0M1kChF74RBtDDgLtSfPB2saTi+qNhyAS3kxX+BEgAAEAIg8H3joVMNW:1VnD1kChFwBRgLofp2i+OkA2kX2lB5Se
                                                                                                                                                                                                                          MD5:F79B191EFEF9EF7AB4A0287B1FCBC714
                                                                                                                                                                                                                          SHA1:B8FFC94D94158E143C161D6C6708928654B16D3F
                                                                                                                                                                                                                          SHA-256:D868F4633D918FBBF73925C9FFD7B7C82E0DB22FA59BFDCA03EC23F189733B1C
                                                                                                                                                                                                                          SHA-512:F87364294676A19F749080BC919A9CC17D2231E31A75C09E8AA37054E0144FF9DEABBA935C5FC6DF38ED0CA3BC0871EF96C0B854D1875A2D2FA3A925BE2A7F21
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ....R.................................................................................................................................................................................................................................................................................................................................................................................................!.......,.... ...................Q..........PD....&.O...'.O@....#.N.....>....!.M...".L9......K....J5......I.....H2......G.....F-......E...C*......B...g.P....*D8.....Q4....-F....FB<H..IR...=J.4IH...0c.t.`../.....=.....h...hhX..R..l8..4.....j.....\.f=@.E..h.5....6g..b!...u..p..o...R@.L..`.+.+.,.....#K..x.e..%...@.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\combo-ra.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):721
                                                                                                                                                                                                                          Entropy (8bit):6.341775210673681
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:75wCn0M9kChF7K+AgLtSu2oiHqJrHNTuMoj8Ihy/MWT+ED4FI:11nD9kChFrAgLou2TKVHNapynTB
                                                                                                                                                                                                                          MD5:AD83B9A2B02E9C59657DCADD4BB0F2CC
                                                                                                                                                                                                                          SHA1:1956FE3FC7E055BBBA3F9A490C62926FA5689B37
                                                                                                                                                                                                                          SHA-256:C7D47947E0E2C16B2EE7F4B7348FA8AB33E8A595A5DB8B2325DE1DC8A599C853
                                                                                                                                                                                                                          SHA-512:367CC17EF3B32DAFB093418DE71AC4EB1E3C6AE6709F0752291A77470CEF11EF52726619C8F89B8447E92ACACD4FA0BBB70CEDE76B04EEE716A4B90412D3FC62
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ....N...............................................................................................................................................................................................................................................................................................................................................................................................!.......,.... ........................................M?....%.L...(.L=....#.K...$.J8....!.I.....H4......G.....F1......E.....D,......C...B*......A...0........+. ..a...|..H.....-j.Hh... C~.....#......K....xI.%.B6@...S...7z......H.*E..@..P.2 .#..X... #.W.....@..Y....8.,.B/+(.KW...-..k....... ...A..+^.......JD.r.E...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\entry-f.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 15 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):111
                                                                                                                                                                                                                          Entropy (8bit):5.84257270096751
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C4nWthxW88aLGSiLHzZ0Fs4ejHqR2Es:rnWtrWVSinWsPjKRvs
                                                                                                                                                                                                                          MD5:E5CC1A8E64EA615FFCD2C2C3F1686331
                                                                                                                                                                                                                          SHA1:A4A647BEDEB42BA9F335FF6E03A2E485B6B311A3
                                                                                                                                                                                                                          SHA-256:8A59D5917A659E26E4E4F3605ACE91C85A9166363363B4FE76D4889FE9857A30
                                                                                                                                                                                                                          SHA-512:A07C382BF3FC186CA7E28B9ECDD4FE14218E0953527308961E63C3741490550BD575D75958EA063224C3FA7EAB16A85E8DCCDDDE06EEDF0FC286B24C7BED8B75
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......Ok.....................!.......,..........4x...C.@..p..{.....6v.xr.....[....0..?\P....HPd.xD..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\entry-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 15 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):106
                                                                                                                                                                                                                          Entropy (8bit):5.549621361588617
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C4nFp+RButSiLdkAsmiDVIW92jfhE:rnFeBOSixDA4E
                                                                                                                                                                                                                          MD5:E520C96DD674CAE37FE60CA8A38C692B
                                                                                                                                                                                                                          SHA1:4C332C67CA95378B03D61F2DE0399801B7BFE8EE
                                                                                                                                                                                                                          SHA-256:05F234914EC13AABB96A90BD062C02EBD92DCE320D8A2498CB399B46D9C774CB
                                                                                                                                                                                                                          SHA-512:EFBF0B421C22A2A94D6C1557CBF3F003DC550EC27DCAA1ECB99472B93A22B4043B16D0C6ADCB2329802D00CC7722D1C50A2C51FBD2D9D5A5718A1FAB65CD9893
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......,........../x...A.A..p...f.'...&......Y......w?.B.Y<....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\hprogress-b.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 24 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):446
                                                                                                                                                                                                                          Entropy (8bit):6.981270097498453
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:bkmGbxElyy9wC16TWYAqUqrwAP9zhSap/dXCHmHQ8bMVn0sgoT2mUOWN6K0XXmh2:Tlyy9L1SVMowATHxCaQ8oX/HK6ksjTYE
                                                                                                                                                                                                                          MD5:ADEFCE1544ED1942A7DE1FE1A257DAD5
                                                                                                                                                                                                                          SHA1:B8B7E18274539B3432ADFC8A937BAAC002BCF5CA
                                                                                                                                                                                                                          SHA-256:060A1F3DF55DA4217FD3C3851D36FA75AE7E125998508F6598DA68BB4C7E12BE
                                                                                                                                                                                                                          SHA-512:9FB58D30483902B4D0C407B12635ED662CCCB1645D8CBDFCE3071B21BE9EF7EAA7BEE27BCA28A3AF33795D0C1752D71F2B3DD76F667AF649EEC3AD57B96DDE04
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....7.ex.`..`..a..a..b..b..c..b..c..c..d..c..d..d..d..d..d..e..e..d..e..f..e..f..f..g..g..f..g..g..g..h..g..h..h..i..h..i..i..i..i..i..j..j..j..j..k..k..k..k..l..l..o................................!.....?.,..............@,..G.. k:...t*..]..V{.y._.......l.f.fD.zN...wU.......0...)0D(.../...(/D%.....,...%,......+...%+D#.....'...#'......&...#&D!.....$...!$D......"...."D...... .... D............D...........A.>.....X.....#Fl@....V. .DI..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\hprogress-t.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 23 x 23
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):124
                                                                                                                                                                                                                          Entropy (8bit):5.646832327012238
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CWc0LOShLdlubKGLIMrLsi3uV8WjVvfn:R1OSvobH9Ei3uWwVH
                                                                                                                                                                                                                          MD5:5D87594C440870E2899B5FB0E905F4F3
                                                                                                                                                                                                                          SHA1:A4C70F48D2442D73C39B44602FD4842C37574FEB
                                                                                                                                                                                                                          SHA-256:37DBB74A83E52D644A9D59B225251D3EABF3839DDF9DEB265E94995ED0B537DE
                                                                                                                                                                                                                          SHA-512:406E9F40CD7CBE581FA95C35B313EB563F7D4B4BF4D832E9AFAE5EC7CD08B04465354C0CFEDB3DB423575310995F7638DE1368939B28BB2228EFE8609FEF5389
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......,..........AH....( ....%..`.2.h..~....#E..].:...YO.#.4dL.b....p...%...!I..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\hsb-g.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 18 x 10
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):139
                                                                                                                                                                                                                          Entropy (8bit):6.156253752377293
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:M6vlGDbT2QLTPXQmt3ipWb2pmg7CdkXoLCOEiXe:3vlwT2QLDXfnb2m+mlLCIO
                                                                                                                                                                                                                          MD5:E163BAA304E4C12E77720E72EAE38D94
                                                                                                                                                                                                                          SHA1:80BDA308B1B57C88BA7F2BECB04C313792DDD196
                                                                                                                                                                                                                          SHA-256:87E7533B5BE44D0CF829045EEAC2194312026BFB915AD9F0AC363BDA677B5214
                                                                                                                                                                                                                          SHA-512:9610C808179B34B58E8E1B781A5A666FD0FA3CAC6561450A0921979FCFA753A91772E7AEEABE8D2AE5CCDBAA3705B186B2991D4BD03FAF8C989802B53C6A48C0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.......................................................,..........@...$.uf.R...u#b.hz.l.d.2....../<..@,...r.l.%..T..Nu.@...n....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\hsb-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 22 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):348
                                                                                                                                                                                                                          Entropy (8bit):6.457975350350503
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:rgzeIeptKvjrn0nnkxyvAj2emFbQzOzOzOzOzOzOzOzOzOzOzOzOzOzOzOzOzOzG:rgGKvjr0n/ACLFMzOzOzOzOzOzOzOzOb
                                                                                                                                                                                                                          MD5:F7A0FA7A112035EF0514DDCB78E56A68
                                                                                                                                                                                                                          SHA1:86E030C58F842BF1128B265545DFC3FE10EBC946
                                                                                                                                                                                                                          SHA-256:BB7EF493C7B96C568247D0C59928B31BB40BF0414FE096DD15159CAA7719E5AD
                                                                                                                                                                                                                          SHA-512:C4E1AD3EF5D2AAC539554A9D4E98CF74D9A70F8D88FC244930252A20908417C3CBDA6A2C40D4A3AB126E26C1D4731CFD905B54B6368E2B4B745B66CE382A2E00
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.....(.................................................................................................................................................................................................,.............`H,...r.l6...tJ.N'.g..z..!iC...e.p.i..p.c(......1.U......C........C........C........C........C........C........C.......BG.G.A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\hsb-t.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 8 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):85
                                                                                                                                                                                                                          Entropy (8bit):4.774405785826499
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:ChltjYaaLwShL9llmlZYAJfFeOuEn:elthSGXJteOuE
                                                                                                                                                                                                                          MD5:F28EB5431B2D0BA72C2A20CCD145CC01
                                                                                                                                                                                                                          SHA1:805CAE61D50786BE9888146ECA892ABE1BB2501F
                                                                                                                                                                                                                          SHA-256:C2A933044AFB101A479A2C350E5F4926C2D795722C1EC8F0E74B1A02BDFC97F0
                                                                                                                                                                                                                          SHA-512:5625BFCD6ED24064ECE229756E132B3CA62027DBFA3716B34E0C0AA21703DE8FF4B4A35FEB91AAEA0E2D421D8EFCE093B0BED2F2BC7AFA0AF871335227879EF8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......,.............<./.H...^.m...}.F.`7.k+$.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\hslider-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 11 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):319
                                                                                                                                                                                                                          Entropy (8bit):5.349167486432388
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C1fBi000NSH3HFk1N0mWfX66hz5Oo5HxHnR8ReSFTXRlnlvfH11eM1XqA5LWDOND:N003HqL9WfJueShhXH/eg6efjACNdwcb
                                                                                                                                                                                                                          MD5:460DFEC57B8AD0D4FA6DDC778C770647
                                                                                                                                                                                                                          SHA1:F398805E419599DD290263CC65247C5059FD0346
                                                                                                                                                                                                                          SHA-256:0A967C834759D27CA2C062CAABD292A747E89FA7C22388BF7779216313442B3C
                                                                                                                                                                                                                          SHA-512:DF2A89F5C154938F6319B2BAA640D46C47EDE4F1AAACC5D474FBA5DC2E8582562DBC01EC3B422D27BFA3F3436CC068C9B8AD165E824D908709E02A9A2279D744
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a..... .................................................................................................................................................................................................!..... .,..........\@..@,..B.g......t...;..e.}.9.Oe.n.7.... j&..$A.H.x.h.....D......O....GI.... I....I... ....A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\hslider-t.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 7 x 17
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):63
                                                                                                                                                                                                                          Entropy (8bit):4.49207942484441
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CSelIv8rSnTfQxU6e:hOST4xs
                                                                                                                                                                                                                          MD5:2BD04E8EB56F2B564D794D90CFB4067F
                                                                                                                                                                                                                          SHA1:E7F25A261EFB0C8E76C77FAEE57A08E497E44D23
                                                                                                                                                                                                                          SHA-256:CD39AE6349592A7B0CF9C2426CF8C6F9D2501B1AF650BBADAB4121D877CC8983
                                                                                                                                                                                                                          SHA-512:B4A7FCFC05ACC9D7EA7F3CABDA5BA0CDB793663DBB9718D89E63FC21A95841369FD2F622982B5AA3D23C609F4077417FBB56D27C4F99A28310D258C0E1454D3C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................!.......,..................K...B....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\notebook-c.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 13 x 13
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):99
                                                                                                                                                                                                                          Entropy (8bit):5.2667333488139
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ck6dKbGSiLz4v7xYg2CsfGWrBDe:8Y6SifUNyXVe
                                                                                                                                                                                                                          MD5:2132A292085187373907209FC0185AEB
                                                                                                                                                                                                                          SHA1:180E232ADD74464CF3AC3A6678A36BF4C595FAEF
                                                                                                                                                                                                                          SHA-256:1EC0139D17A22138359B1FB130B2AC8A96FB73EDF92A3012DDE1A499B34E6CCF
                                                                                                                                                                                                                          SHA-512:C4257202FFC549D7FCD69714363E711885D1EB0691E9FD1EE6F58CAAE7E310AE65CB74A9791ED353BA51AA292CFC470BA4D72EFF4BC5F3089F6E2AD532622694
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......,..........(x.....I)Xd.....I.....#..+..s.-B..W.8...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\notebook-ta.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):376
                                                                                                                                                                                                                          Entropy (8bit):6.767731199986674
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:lg0vEgI2MhNrtDFhvf5q+cuHas6WHAPOCMNIBQSap/KelUf5ZWn13OWlEhwxV6Pu:TvrI5Qd7JTPOZaBQHIPWZEG34K
                                                                                                                                                                                                                          MD5:6936B48C4C60E65096F287BECA05930A
                                                                                                                                                                                                                          SHA1:D8D27A1DD249C52F9379A63FD524D389B417EBE3
                                                                                                                                                                                                                          SHA-256:5ACEEB9826973AF8A7026FF6DE4D72993BAA9AECA56967ED9B18892CB8240D07
                                                                                                                                                                                                                          SHA-512:50F081976659E44DDB9A37051F1D51F9BCA24C693609409FB91FB1C6337988A26EDE8117DB056AEAE4FF9B0650D2228149C229C455AADABF0FE7D0B877628EB8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....;................................................................................................................................................................................................!.....?.,.............O.(...!1.l..?.`J...:.v..].9.x..|q..Z...P.8J..x..[#..$._4".."._3!..!._2....._1....._0....._/....._-....._+....._)....._'....._%....._#....._.....A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\notebook-tn.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):378
                                                                                                                                                                                                                          Entropy (8bit):6.804979025863608
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:lgII2MhNrtDFhvf5q+cuHas6WHAPcDOAcNIBoSap/AzjkvD8S+WKRiYrUtlCr+V:mII5Qd7JTPyOjaBoHozAvD8S+NEYrUtt
                                                                                                                                                                                                                          MD5:97B9A5C6252A7C0542AA4EF9D0E4C2CF
                                                                                                                                                                                                                          SHA1:2155E08E4DA4EDFB32A2E3172C0236F7D92E7301
                                                                                                                                                                                                                          SHA-256:E1A157E0CD02DEC630DC485726C9CBE33A78A38849B4BD05DE7B58BD509AC1BC
                                                                                                                                                                                                                          SHA-512:F28CAFB6CF22E3AFF60CF4871011562A1A72A50B70B7015030E5DF429FBDB31251AEBD8F4B563AD9825D74926D712F53D83D1595323A211A0B107467B719AD6A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....<.................................................................................................................................................................................................!.....?.,............./.(...!q.l.?..E..>.h...<Y.NE..8..j.Fi.6.|n.k...d..D..".a3 .. .a2.....a1.....a0.....a/.....a-.....a+.....a).....a'.....a%.....a#.....a!.....a.....A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\notebook-ts.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 12 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):156
                                                                                                                                                                                                                          Entropy (8bit):5.8280580947874245
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CiGSPaalFNrGNwSqp/IVIPII9pP3csEkKLtnTm/A6le:l7igpGqSqp/IV23MkKZS/ne
                                                                                                                                                                                                                          MD5:C987A6CF39F352124CDF5C38CB596CB1
                                                                                                                                                                                                                          SHA1:FC4EE27AFA06A2F71D2A8A314A845FB389439296
                                                                                                                                                                                                                          SHA-256:F2BB20A82F01DB6D3F31599E7B9101DB707A86D06710022A66A7B1E6993E8F81
                                                                                                                                                                                                                          SHA-512:7AFA177D0FF0B3D65B3273CFA72463A4446684D792CBB05A9D3E345323313AA67ABB5E393897C7D8E6D4389123E23A718122E48A149E3AD836DDA3AFB625DEF0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................!.......,..........I....r..;.....H"9....g.D..u.&...7R.6S.u...u .H.t)u..V.6J.V..@...%.$..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\radio-hc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):120
                                                                                                                                                                                                                          Entropy (8bit):6.037137438589155
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ckw+w+2Uq5aajiePlT/4rnjTV2CNiFK8C1ka:q+wWCRjiePFmjTVXbz
                                                                                                                                                                                                                          MD5:6BCBFB3D4C08B63A5246C451CC50FDF0
                                                                                                                                                                                                                          SHA1:E3D80BC0609047927DED9D8807A80095A4FE9DD6
                                                                                                                                                                                                                          SHA-256:31DF5F022ED293ECC40A9373A8027288E30508593AB6F516FF2B00B869F2B428
                                                                                                                                                                                                                          SHA-512:4DF57C6A1C5F4789E3079D0E47AB2C8602BA0D0FC139B5F34AC26B3A94131A9FE2B73394EAEC47ACC0440C1F20753E600944BA17414E53A90559F3EAE35B061B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......001j...................!.......,..........=xZ.]*.@jh...8.6..`..C.dI\...g#.d..x..+.....&..X......9....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\radio-hu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):154
                                                                                                                                                                                                                          Entropy (8bit):6.267902220462264
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CkccR5NdXX9WBdSqq9PlmVioNOyVJm1EXGkiVpqFCm4HznUU78E:DfNuLSq4PMUQEOh9FeHj7n
                                                                                                                                                                                                                          MD5:0013DBD76AFA3187A0D320AC3436C82E
                                                                                                                                                                                                                          SHA1:BE1EDF7B4AE2346F425FDF4D22DEDA7C86944F0F
                                                                                                                                                                                                                          SHA-256:597B23E455526B1008302CAC47E346B76BCFAB214F0A38DDE8BD902A6CB08B24
                                                                                                                                                                                                                          SHA-512:70AF0617661C763075BE8988293A0B24C5FD1E3EF5C4E7C92BB3B60B55C727E89181C5AAA78855137D7E469A6466AB1D26A4D4CFE242E6759D10F349354AAA87
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......j..............................................!.......,..........G...j.2W :..'...<.H,l.P...3!|...|bW#.p.......`...O.'E*X]...d..$.....X^...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\radio-nc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):208
                                                                                                                                                                                                                          Entropy (8bit):5.6280123102251505
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CkFtJHIi9H3R8vcaka1S1ePlD7VbAz9sfPjyMV03S080y:/bxy1kSSAP5VbZf7Vs8j
                                                                                                                                                                                                                          MD5:53C8CDFDF7F971B44FB2CE058928B4D4
                                                                                                                                                                                                                          SHA1:1596503E74D0BDC67DA367DE1EDFAA8FA601D3E9
                                                                                                                                                                                                                          SHA-256:A312E8D8AA04E69EBF1E1EBD7262DA7AF3A0074B8F3516AE8A754F3179D1F4DC
                                                                                                                                                                                                                          SHA-512:ACC5AD6C2D9A0F6DF03FCDE2023A0B762BB5C2A107FC2743413A2CB6889F762B176BBC7651BACE5EA6C0F68F5ECB7D771BF525CA849B42D0ED9E7757C4C89655
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......222.............................................................................................!.......,..........M $.AY.bZ.OK.*...Bd..@/..........bal.K.E..-%...u.(.....p...AH.`h..7.@O.F.S*..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\radio-nu.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):151
                                                                                                                                                                                                                          Entropy (8bit):6.093267545376015
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CkofHIi9H3R8vcakaPSqq9PllVf1tBalsI6155kNxdzF:qfxy1k8Sq4PtnBjIm5Wxdx
                                                                                                                                                                                                                          MD5:3109F7DC0E82FCEEC368FCE1DDD91F82
                                                                                                                                                                                                                          SHA1:22491407C3458555165BAC820B6AD2E222278D6C
                                                                                                                                                                                                                          SHA-256:E55BFE21B9AA33C5C9D9F84EB812C116E071EFA371AA632DD0541C5A379F8BC3
                                                                                                                                                                                                                          SHA-512:70AF29826DAB50DD8770CDD32815E82C6EB15A6843E6A2776842F3545B56217AF1506BB87195C90CF1530CE4728E983F51A6D5F72379217F8ECF463168DEA3E2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................!.......,..........D...j.2W.....$.=..+@.J,....x.TH....aH,.6..R....P......X.I..xk.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\radio-pc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):121
                                                                                                                                                                                                                          Entropy (8bit):6.056727614865503
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ckw+w+2Uq5aajiePlq4PbjTO9faqxbv3XxKdDXqle:q+wWCRjiePdbjTOQgXxKdDX
                                                                                                                                                                                                                          MD5:E92DF62D52D58D0C8C1B1E16D4CA133E
                                                                                                                                                                                                                          SHA1:6EF2F1F897F36CBC25405EDDD33F6C24291649E0
                                                                                                                                                                                                                          SHA-256:11D1407D7627C8A782B30602D979EAE3D7C7F8E85444210A44A6F00F20A41D54
                                                                                                                                                                                                                          SHA-512:DE2D83E5F3D58435A35364E522AE3F1BCBA13A42421A6E9F8E655D82AABB2D9B9946262CC037D71B7922062057EBEE8CF35D2882207EF5207B56599207D85AAE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......001j...................!.......,..........>xZ.]*.@jh...8.68.A..5:.@\..:f#.B..x~.....2.Z5...1.>.I...0X.E..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\spinbox-f.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 23
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):201
                                                                                                                                                                                                                          Entropy (8bit):6.266616976205407
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CblyB1bxCa6StTXalX1YkNv3HC6nOKRICpDd15DzucWM4MUEzdFmo+r37NM:Xb6SZKllJN66OKICpp1ZScWM40X+ru
                                                                                                                                                                                                                          MD5:2758D85E9696E3041C8E2BCDF6261B23
                                                                                                                                                                                                                          SHA1:CCE83C6D8C967344ED95C86A8C5FD3B92405F701
                                                                                                                                                                                                                          SHA-256:BF7AEF8DC0174D9C9E4702D8ABEF4E0271B9A965FAAFE180D22D97F80DC9E652
                                                                                                                                                                                                                          SHA-512:BDEEA84D1FBCD01D5A61209DEA98EAC137E8D7E4F170FFDC1FD4FE3DBC178B88233249887B3366372EC3CB1B2634D251DECA7E40B1F864580CE399E56608663B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ......4^.d....`.....................................!.......,.... .....v..@.."..E.. ..(.h..^x.p...j..+.......[...^.C.K......N..0.j..,4.F~.X.xY...i....n.q......}w\.1ot.0.?......~6. ........;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\spinbox-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 32 x 23
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):160
                                                                                                                                                                                                                          Entropy (8bit):6.311586898903184
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CbltJBdpRTSiLClR00dLMSQ5wI84rP/O9g/y40sI9uxqm01vZc8r0f4:gbjTSiWlK0dLtQuI3Cg/rb++qmkcvQ
                                                                                                                                                                                                                          MD5:8EBEECF4E7B9DE5E9AF833927699F9C8
                                                                                                                                                                                                                          SHA1:6C182F0E9E6A522701CC8D29C3CA1BD8947CCECF
                                                                                                                                                                                                                          SHA-256:09B3551472160DCBC09A4F947C2B493DBD81FABFFA3D22D69A76C79C4FCB0915
                                                                                                                                                                                                                          SHA-512:44B053A13774B16DD4F3E4EE0F641EA0A983EAC391585D38D9BF1C8869FBB88D8FC470432BB4D74DE583A282FF043A062D93EF7E9061BCF74D1AAA705D506CE4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a ..............................!.......,.... .....ex...0..........".di..v.x.D..-..3X.'.s5.....cD..........Mm.......$.....P.`{S.{nr..6u.r.{..'C........;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\spinbut-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 23
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):130
                                                                                                                                                                                                                          Entropy (8bit):5.984620724890564
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cg9gVZyIEwUk8PSiLrjvcm54+hmH+NHg0ZLItVM+9K93aqIW:7gVBEwUkqSiXjEehmHyA0CDebIW
                                                                                                                                                                                                                          MD5:F6958168C7B3D4154CDFB57056E370D6
                                                                                                                                                                                                                          SHA1:11B0E77F613F76C4A673F7A2F7CC24218E799C37
                                                                                                                                                                                                                          SHA-256:9A3A70EE9B38B114F4DBA803832C6E1ED6053A2A9E0BBE669860CF9CD0BF595D
                                                                                                                                                                                                                          SHA-512:0FD625E779E775F74C944432949A143F7B2EB50F47FBD16FF62423F82D528EA338B98CA75FC3EB92D073521F40C2585C9ABE401E6FD567979B00512B19A2EAD0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......p....{...............!.......,..........Gx..~".9..$.....x....f*...-.._:....-..pu..JG..C6...'.X.X+U..z.^.Q...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\spinbut-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 23
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.501515280317513
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cg//tSkLzIV1MEn:5lSk01X
                                                                                                                                                                                                                          MD5:DC26B3B74F8DF1937C311E99132CEEAD
                                                                                                                                                                                                                          SHA1:3F76D19D1A2026AA9AABE32BC0B4ABFA03272D7A
                                                                                                                                                                                                                          SHA-256:04DF3A79762A2D707E913A7EE38501EB8367B1BE94BC4FDB58555E77247D7D50
                                                                                                                                                                                                                          SHA-512:EBB598C95CCD666878B10A29278DF88ACB88336BB7FAAB676BFF5F9CFFE574AAC53BC95340F8338B186AF5A46031DBE24F9C8320A10C9946488CAD0CA5155D46
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,..........................F..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\spindown-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 10
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):144
                                                                                                                                                                                                                          Entropy (8bit):5.856615928963621
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CMGOlAZfC7o+fo9LRKdUU4XsLqp/3tke9ijhIO8SF+eZT67N483W:/fle1A4cLqp/3p9cIOZJZTWq83W
                                                                                                                                                                                                                          MD5:A9A27BBFF3368EC8007EA91CC1FE93F6
                                                                                                                                                                                                                          SHA1:97F4F0D86598BE93581B968FF4E73FE620A06674
                                                                                                                                                                                                                          SHA-256:E68C1D0194E0C1BD627D823543E56BE664A2B5AD744A4114F9FC26FEC6CAFF92
                                                                                                                                                                                                                          SHA-512:3138A67C53A86B63ECFB7D9F0B7CADC86257E5796807D48B017B00706D9DD4103278EB57632F7C1427DA7346AD1934AC39F83AD6B2B4282E5A3BA1D6ED6C8D16
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................!.......,..........=.IG...5..G.$di....@..+RdK..pL.G... .0....Q@,8..g ..Z..v....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\spindown-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 10
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):189
                                                                                                                                                                                                                          Entropy (8bit):5.3999743515767475
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CMhP//pAABWfXQIABFR8vS6ee7GKDt+cHowlv/zXqJjd1vdYe:/hW7fX7aCS6ee7GKDt+1wQtd1vdYe
                                                                                                                                                                                                                          MD5:06C3DD2630A3DECEC5168A0AC36CCB88
                                                                                                                                                                                                                          SHA1:60EFA078D201648C726866974A69F11109232F42
                                                                                                                                                                                                                          SHA-256:982833AE497C514C425D6A4E5EB416883942AC028D128E0164790B062A793FC4
                                                                                                                                                                                                                          SHA-512:CA565285ADADF4FE6FC87A681B566DE3ECBB9951739C4A2876A0C5CF39CD394A2CC3F2FE0AFC0EF5DC9848ABC47F018665740B8B8FD55D6B416246124529FFDF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........:`$.d.=h....p...b.x...$....L...d2.L..... .....v..(..8....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\spindown-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 10
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):202
                                                                                                                                                                                                                          Entropy (8bit):5.525880309389125
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CMhP/6LUtE9vgppgjRa1N0XRWFYS6LReaFPIyovF7alBF81b3DTpjMDGo+0HSwle:/hqIkaLUAYS6dPPIR7uBeR3Ddw60ywE
                                                                                                                                                                                                                          MD5:B5A4EA0D6C7E1A1E3C0F074005C3D1F8
                                                                                                                                                                                                                          SHA1:14491B4FB5A28162210DFA398B042E83513274A0
                                                                                                                                                                                                                          SHA-256:29999C5F30C4C7F1F9E4FC79ED201787DFC577CC8E500596178F57EE29A17E94
                                                                                                                                                                                                                          SHA-512:01F89E6B16D0ABCC901715BAD28877B48BC71210073B1D9BCCB570A95157A0BC44B53D35D3443AC2448200072484665387334FB75B3B4F69ADE3C20A9695171B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........G.'.di..'.l.L:.tm.MJ <.....*$.. .. ...h.'.>R..v..n!).cL..#..c.n..".....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\spinup-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 11
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):147
                                                                                                                                                                                                                          Entropy (8bit):5.967261689313944
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cf9l/l//IAp7o+fo9LRKdUUSEchSqp/uhPjG6Uc1KAGGGzt8tL9/aFO:ql/l/wt1AshSqp/uPfUc1TdL5YFO
                                                                                                                                                                                                                          MD5:10485149718030E1FC1C5B6DCFA4F869
                                                                                                                                                                                                                          SHA1:6921A096799ABAB53EDCF1DDD90F60D74C70203B
                                                                                                                                                                                                                          SHA-256:99EAC2389D2B4D06A94A6469BECFB4D220021CF54566217640C09AACEC433F61
                                                                                                                                                                                                                          SHA-512:78E1D2A175B4FA3E19BC8E8441D198AE662D9D00FB9F9BC1D114C4E31365A7CE56963396410DE0711C7855DF625A25BAC2198384667FD01AF308CAC42CDD14B8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................!.......,..........@..I.u+..lJ(.".%h...11l..."82.9RL..pG...@.r.\.&..T)....v..z....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\spinup-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 11
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):192
                                                                                                                                                                                                                          Entropy (8bit):5.587504920101112
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cfg/lotVHAABWfJjQIA8vS6eLlvlfx9y0067OHHDDYiEE:LlT7fF7FS6eLlx+YKnDMiEE
                                                                                                                                                                                                                          MD5:56A552501866AE8E40A5CDC76C076368
                                                                                                                                                                                                                          SHA1:87A329BE3F25564B8A8FB91930214ECB69FA3B09
                                                                                                                                                                                                                          SHA-256:2F876A431411AAAD6CE749AC375B4DE3428655F7521232CE3947F3FBC06FE37E
                                                                                                                                                                                                                          SHA-512:78D59912C36646DE4B94E8407903B60870A8DC8A4381506EDDCF0092E2743F57D90D937BF517D09B1EFC7443C2E3702ED3302A802C876750346518B1E8E9F76F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........=...dI*...@L,...@K.......0.+....bYl....aJ.R...v.....x.(.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\spinup-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 18 x 11
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):206
                                                                                                                                                                                                                          Entropy (8bit):5.66844877196686
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cfg/lo18E9vgppgjRa1N0XRWFxaaamS6L8g8ipRonHd4F/bCnMfJ/QU29FDTCdI0:LlaIkaLUAcRmS6Gi/sd41mnM5QZCK0
                                                                                                                                                                                                                          MD5:3C7C62A03B95E92AC7A9F26674C8C239
                                                                                                                                                                                                                          SHA1:D514DE54EB0D72774F99B5F2E5D99608D25E68EC
                                                                                                                                                                                                                          SHA-256:5D1F1A92A63E2FEAC12349F5D59F9DBA10B094727ACA55EC92F442DEE533715C
                                                                                                                                                                                                                          SHA-512:7050047BFE74ED7502A4B9452510CB506EAAECFBC3DEFEA98198E1638C39F4FC9E15E88D56EBE8A0FB6C059BA56F87CFDB81EB0A6FB5D38DA51EB8A934FD343A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................................................................!.......,..........K.'.di..'.,...!........7.Bb8...CG.h*.P.B):,...u.H!..8.I%..:.II..<.......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\tbutton-h.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):691
                                                                                                                                                                                                                          Entropy (8bit):6.729853583253432
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:+ING5bf0wq4D+fUxNaGhvAHQ86O6O6O6O6O6O6O6O6O6O6O6O6O6O6O6O6O6O6OU:BNG5TRgcjphYHQ+MyHCkCC9+ALx2
                                                                                                                                                                                                                          MD5:36A87B8B20D8C115233ACBA5B6B2F6A5
                                                                                                                                                                                                                          SHA1:3D92ACE4F9D42A2FF6FC607C9435DB9DD4996589
                                                                                                                                                                                                                          SHA-256:FB6659C1DB0D6B3090D54F79654EE3F8A2980E2061692DC65211092FC24768DE
                                                                                                                                                                                                                          SHA-512:7640A02CF85855F5711555779457396AE107874D59BB5B0381253D4E93758B8B648E84B0556A6E08620EA24A038A950C43FEC06FEB82D5EC76FC57B8E5AD8A19
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....;.................................................................................................................................................................................................................................................................................................................................................................................................!.......,......................h......f^....8.g[]ZZ\..ZX.Y6.eW.UVV.SSRTQQ/.dKPOLKKLNL...&.cI.IJ.IHE.FG#.bADCD.BBAA??@...a<=;==>;.=<.::..`959..5574....}.!....2d...CF..........+Ph..cG.... q...$J......BMD..!.....>.........l.A..H/T..ai....L. ....."Hx.Ak...z8p........e. A...."..@.......[(Q .;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\tbutton-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):58
                                                                                                                                                                                                                          Entropy (8bit):4.63707161731493
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ckjb1dL9MuEtW:drJM1tW
                                                                                                                                                                                                                          MD5:3FCA28F69823C80EE5A8F6FB3307DBA5
                                                                                                                                                                                                                          SHA1:4FFD823060373394A58D116018837B199A9BF3EE
                                                                                                                                                                                                                          SHA-256:A520960A8C4DD330F5328C08FE9170539C0AC1BC6040C7B3A55799BBB65833B7
                                                                                                                                                                                                                          SHA-512:A57ADED2C8C4B254BBF0202AD0E7D5343DBA6846539B0466E88AFDB66E2830C91DD07D04C11C9BA68ED43ACD31BFF23D297D3EC7AD568C3B7CA3F5EC0C00F677
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,.......................{W..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\tbutton-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 19
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):450
                                                                                                                                                                                                                          Entropy (8bit):6.198815953533308
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:DgBfrIZbH9Y/Nf/OD/CdKMVcKcEJ1p4imT:irSbH9Y/N3saMQxzpQ
                                                                                                                                                                                                                          MD5:8871EDD562980A1F3867D8B1327999A9
                                                                                                                                                                                                                          SHA1:B6F97E091EC9CE94CE399A629C6DAF30EBBC7574
                                                                                                                                                                                                                          SHA-256:B97103C4D0671B656B20CA3D8F72BD0130C616CAFED8328E3DC73422982BDCB7
                                                                                                                                                                                                                          SHA-512:A5724C06D7AE4FE9F3AAEBB0429F51CD21B5DC65946793D4E64F48EE577DDD7DF4A9F67B2C72CF29D534C8B10499095147E0002BB771001A8EC8DB8A9EA737AD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....(...........................................................................................................................................................!.....?.,............_.@,....1.l:...@A.Z....e8......r..F..H....8......q<&n.}.. D....{....."D.........#D.............$D...........................%D..................... . .. !! . 'D.. #.......!.....#...P.0..."L...b.C...>D..@...3j.".G#I...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\tree-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):357
                                                                                                                                                                                                                          Entropy (8bit):6.684446374104256
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:GW5tMqs1wM62M0EEDFlqf5Z+i9XvOUOPaNRGSap/jf5Cf+zoGgvIM8FVO+t+puJT:GW5Cx6M61B9XvVkaNRGHsDGAuFQ+tHpt
                                                                                                                                                                                                                          MD5:EBF719EEE2111586DE1B0402C0D203F5
                                                                                                                                                                                                                          SHA1:1570EA3BAF57A32B6A8DFE1CF152FA318AAC40EF
                                                                                                                                                                                                                          SHA-256:CF1FE1C18D9E13966FE05554BAEBCE0EC93526D450A6390F1A08F6B2DAA78C6E
                                                                                                                                                                                                                          SHA-512:D3D5FCEB8CD5ED5DE362D0EF943676914D69B126D7002A71AEC8839C2C83117D7FC271769F20C4322EA67F79E3C6E2B3C62652BFC7A5F8F42A2A816383C54068
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....>.................................................................................................................................................................................................!.....?.,...........@.p(...#.'k:?..lJ..t..v.......*./..i..l..|...........{ ....3.....1...../.....-.....+.....*.....(.....&.....$.....".........D..A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\tree-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 9 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):227
                                                                                                                                                                                                                          Entropy (8bit):6.141893282960165
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:hcfot+SHUliLEaWS6sNpOtv3KxsFEfmXE:s6+RyOtv2kE2E
                                                                                                                                                                                                                          MD5:3B2A314D747763BEA410CFE4FFBD9ED2
                                                                                                                                                                                                                          SHA1:22FA5A4A128DEE3155921FEF04F059F09D3439E3
                                                                                                                                                                                                                          SHA-256:C333E8C81C810A54CB3F71CDCB55C9AC2038D62959DA48FC0DB986B08772D114
                                                                                                                                                                                                                          SHA-512:DA246E7C728567382260514D5A39047461D3D5D895004737EF8B6480003108D925D43E2FDA4E1E7152988B1C39C8F8B784F378598E39E0070C0796B3F13307E5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...................................................................................................!.......,..........` .".....E.F...a..0....bH.......h:...t..R...vK.$..p7.(......X@.p."B...u;.!..-..~...}.....$..!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\vprogress-b.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 19 x 24
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):427
                                                                                                                                                                                                                          Entropy (8bit):7.083663150147808
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:e1mGbxElyy9wC16TWYAqUqrwAP9zhSap/aqE/ZMGYGByW/lZFzvbadswr9ZrfHon:eslyy9L1SVMowATHS//3/lZFzDe9Bon
                                                                                                                                                                                                                          MD5:C007D0BEEB5A24038C878EFB9C4BCE97
                                                                                                                                                                                                                          SHA1:CB9A38CA77770556C0343CB78FDBDA703C950A49
                                                                                                                                                                                                                          SHA-256:F118E7E5D185D7B8203873A666B155C544F813B2B006E0337B0EF4957DA8C665
                                                                                                                                                                                                                          SHA-512:01DE788B26D408A3A6B13DA46BFA43BA0652EA192C502542CBF841BEF550D80977EBFBB61C1A4B35353C00AD4347E8784645FF5C1B43309E4F881CAE204EDDC0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....7.ex.`..`..a..a..b..b..c..b..c..c..d..c..d..d..d..d..d..e..e..d..e..f..e..f..f..g..g..f..g..g..g..h..g..h..h..i..h..i..i..i..i..i..j..j..j..j..k..k..k..k..l..l..o................................!.....?.,..............@,..6!.6..^...D..:..`(s.T)T.4..>.N&. .N..j.j.n.3:.^.x.oM{s~v..q|t.wy.r}u.......z.............................2...............m.................D................................C^`.1.FM.-J.(,.$..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\vsb-g.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 10 x 18
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):146
                                                                                                                                                                                                                          Entropy (8bit):6.120667323069899
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CkYIGbT2QLTPXQoSqp/HhsmlHU3df4IDJcWrMle:1Y1T2QLDXpSqp/SSHU3dfn7ke
                                                                                                                                                                                                                          MD5:C5E3A6CD9077DD5254262927CC05105B
                                                                                                                                                                                                                          SHA1:F27A19091D2C16FF4E44508C86319213B8EDED26
                                                                                                                                                                                                                          SHA-256:B0A368435539205177A3F381D6FA465167AC2C57017F383DFF4612EEF466FA6C
                                                                                                                                                                                                                          SHA-512:5326407C5B195EB85D87513815504A12C4866A84A9B6116EAAFCE0D13695747A58F6AB1FF7DB89C8E1349DB16B3CD9E4CC048992C4967FC4109DDB234F356A4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......................................................!.......,..........?..t$..,..V.e...."9...x.V-..cy...N..&.al..j...0M.vS.....2..j..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\vsb-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 16 x 22
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):220
                                                                                                                                                                                                                          Entropy (8bit):6.279893718445291
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:dnF1T2QLDXN6JTO9zOzOzOzOzOzOzOzOzOzOzOzOzBTOQa0fMLEWMYHIbloDRkn:5jWJTO9zOzOzOzOzOzOzOzOzOzOzOzOD
                                                                                                                                                                                                                          MD5:804EFB2ACBBC93F8C0E348D2FA2784F5
                                                                                                                                                                                                                          SHA1:9EEBC42FB421F9856FD813F75661962F5FC120B6
                                                                                                                                                                                                                          SHA-256:5CFCCAFF95EC6EA82572A1A27ED68C2CADB17B4AFE6EE6D47F0E62E2758DD912
                                                                                                                                                                                                                          SHA-512:8CB277220D6B815FDAA652B423D2084059263B945E6E3B03BE5330A45432B65EF3728A26F1902B3B7C7A3D3F26FAF63CFF403CAF489AF61C701234D3B116BC46
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.......................................................................................................,..........a`..dY.O....9..(.r..1..,.6...x.f.[n.;..../)d.}...h.j.W'u+.B.]s..}..nr.{f.........xvto......."&.#.!.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\vsb-t.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 8
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):80
                                                                                                                                                                                                                          Entropy (8bit):4.600320278904661
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:C09StYaaLwShLboCAkPtssE:V9STS2Cq3
                                                                                                                                                                                                                          MD5:B262F94C42F4EBC8289C87DDE4C5E3AE
                                                                                                                                                                                                                          SHA1:841406A867760E350E3CEEC47CE4BA99D0B5903E
                                                                                                                                                                                                                          SHA-256:EDD407527305C53FAA295A3AE39695BEA96EC43873A29E6C1C3B039D3F0A1AFF
                                                                                                                                                                                                                          SHA-512:7D2F614836C4B192484DB8F5FEBF794952BB713FBADF69B3A88A95330C38D762A071A17C2F5EFE57C6F061D7E67EB2167800B243BE2DE27691223EBC48B7FE13
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................!.......,................I..3.=l._.qX....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\vslider-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 15 x 11
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):208
                                                                                                                                                                                                                          Entropy (8bit):6.447142962938145
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CQkE120ZcfGYCPworEq+tg9Rav000000nyYLhgRwONi6OVXqjwhKohIbwBy:Dkc3ifGYCPtrEfgR3YqWt6yxzoYy
                                                                                                                                                                                                                          MD5:8C01B2FB6AAB559351EF0FFEE60D759B
                                                                                                                                                                                                                          SHA1:D87DB415B45208CE420F376F8580D64C8C1AC217
                                                                                                                                                                                                                          SHA-256:8284E9705C99F3AFFF8E6AD3A677B3CC22B11475CFE057BAFE5318AEC03BF38A
                                                                                                                                                                                                                          SHA-512:A6569B4D657ABC3245D1B296CBC1D51FE52A7AD2BA7040DE58CD3EE2DF723EE726F3CBC5B679749684BBC5794117FD9A36EDC7B80B0D1EE6371AFB5CE1803401
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a...............................................................................................!.......,..........M.7.dI._*.U.....$.P.......p...$..r......tJ.....v.M8....A.#.....n.V..<.N.L%Y*..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\plastik\plastik\vslider-t.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 17 x 7
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67
                                                                                                                                                                                                                          Entropy (8bit):4.830078087276674
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Cr9MqyFTDllnrI3w/df6LssL:88hDTI3a6LssL
                                                                                                                                                                                                                          MD5:70C031E267DEBC65929C3DAEC7C36825
                                                                                                                                                                                                                          SHA1:737B506046ED1E4D76F13598AEE7D78E742BF22E
                                                                                                                                                                                                                          SHA-256:D80F2826C69FD459DAEAF2344DBB3651FADA4128480E1D79D71CF4BDC3E2DC95
                                                                                                                                                                                                                          SHA-512:3F36A45D34651BCC4E4FD4AF0CE503240040183258B5406ED1DD89F0AA38495E20EC5DA52C2A27329A144615822BA232DC23DCD3D6EBB1FBA5D55D1DF413127D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.................!.......,..............q..L|oN.,vz....B..;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\LICENSE.ORIG

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2226
                                                                                                                                                                                                                          Entropy (8bit):5.082734811397625
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:exRWpcbTvyJ3aoxxgHn6432sdICasG8yKxPgfjOXT3aZP0LYN:tcfkzxgx32l8dBXT3aZP8U
                                                                                                                                                                                                                          MD5:5BE61D12059CE717C86684EC9E4F187A
                                                                                                                                                                                                                          SHA1:9A776720F96E456D00AA95B10D8ADD8C8F51C988
                                                                                                                                                                                                                          SHA-256:A32E2DC79B7B9092E4380528F50A193B6F9B4DC425194345034D74FE8178755E
                                                                                                                                                                                                                          SHA-512:F16C2777189DF4E02B1A45B982A3A2A379C5E0288DE065DA8E383448246FEB30A2EBB63CABFB9E3E0DBCAFDEDAAD9BCAD2F1CB1BFF456DFCB30773429D615D4F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:This software is copyrighted by the Regents of the University of California, Sun Microsystems, Inc., Scriptics.Corporation, and other parties. The following terms apply to all files associated with the software unless explicitly.disclaimed in individual files...The authors hereby grant permission to use, copy, modify, distribute, and license this software and its documentation.for any purpose, provided that existing copyright notices are retained in all copies and that this notice is included.verbatim in any distributions. No written agreement, license, or royalty fee is required for any of the authorized uses..Modifications to this software may be copyrighted by their authors and need not follow the licensing terms described.here, provided that the new terms are clearly indicated on the first page of each file where they apply...IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR.CONSEQUENTIAL DAMAGES ARISING OUT OF THE US

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\pkgIndex.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):396
                                                                                                                                                                                                                          Entropy (8bit):4.352252959901269
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:CE8MJ0BUiT6EgNMlQUskd9MQ92XmirQ+pBUiTk63GEgNMlQUZ6F9MQ9hXmirQ+pG:yBUCnXVirQ+pBUohnZPirQ+pBUNu+
                                                                                                                                                                                                                          MD5:9FDB0BDBF51718F83171C87CE2F4435A
                                                                                                                                                                                                                          SHA1:650791597390DF47473DD34DF315DCC53E383478
                                                                                                                                                                                                                          SHA-256:017D18E18ACCA713D2B1BC9680A69B9DB215A6054FEAF6229B524247A8E182D6
                                                                                                                                                                                                                          SHA-512:85B90E338242948EBA78E102FF7C89A78668A0176C98107220BEE6983E006C0F9FD5B787259A236824D2832D594C99387020D79905668548A9C4D26F6AD399D5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:if {[file isdirectory [file join $dir radiance]]} {. if {![catch {package require Ttk}]} {. package ifneeded ttk::theme::radiance 0.1 \. [list source [file join $dir radiance8.5.tcl]]. } elseif {![catch {package require tile}]} {. package ifneeded tile::theme::radiance 0.1 \. [list source [file join $dir radiance8.4.tcl]]. } else {..return. }.}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance.tcl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12159
                                                                                                                                                                                                                          Entropy (8bit):4.197234487845369
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:+GbCywwa+3WssCxzjVS1CSCkgIxaEOe7JXuiFF3cqiIVJ:+M3vsCxzjoXgIIEOUQiTO4
                                                                                                                                                                                                                          MD5:1AFAD42E4E6C0D5E2D8A16216B1C4EA6
                                                                                                                                                                                                                          SHA1:CC758F81819BBE88868EBFACAFE69662A95A5228
                                                                                                                                                                                                                          SHA-256:577F44B13B4BD19E68785EE5D4CCEE08B5104769EB033ADECFA0E59C8D31F523
                                                                                                                                                                                                                          SHA-512:7293DA6203EDA3E8E159307F65301C2223BCEF160663FB5B461060EAE8B94159943CF683F2849B1B658B8AB5665AEE900C4DEA6133E799AD59D7E914E494084A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# This software is copyrighted by the Regents of the University of.# California, Sun Microsystems, Inc., Scriptics Corporation, and other.# parties..# Original version available under BSD-like license as in LICENSE.ORIG..# Modified by RedFantom.# Copyright (C) 2018 RedFantom.# Modified version available under GNU GPLv3 only..namespace eval ttk::theme::radiance {.. package provide ttk::theme::radiance 0.1.. proc LoadImages {imgdir {patterns {*.gif}}} {. foreach pattern $patterns {. foreach file [glob -directory $imgdir $pattern] {. set img [file tail [file rootname $file]]. if {![info exists images($img)]} {. set images($img) [image create photo -file $file]. }. }. }. return [array get images]. }.. variable I. array set I [LoadImages \. [file join [file dirname [info script]] radiance] *.gif]. . variable colors.. array set colors {.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowdown-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):357
                                                                                                                                                                                                                          Entropy (8bit):6.388656299365389
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:N2i5V1EJM1gTP7ftjwDafgkpzDgVS40PLg0S+AG7ch/ipQU6E:RV1E/zoyzDgVSaQ7i/5zE
                                                                                                                                                                                                                          MD5:553EDD9D40E74257DB6EFABBD35FE5B5
                                                                                                                                                                                                                          SHA1:CBB9B17DA83AFEB9365F0B20EB484F57674EE5B2
                                                                                                                                                                                                                          SHA-256:D3A10BEEC2FDA8893750239CDCEA78B547A774957132695FBE039A19007FEED4
                                                                                                                                                                                                                          SHA-512:AA27F12BB00A6950DC5298960F7F3E88A7D63961AB3DE9B9874F27EA59516D158A06C72B12AB9CCE0EDA62197A49620AF6AA113F849307CAC13E5DDAF83BDE2E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.........................................................xxwtts............................................................{{z...oon.......||z...................................................,...........@.g41.....$<....T.!.....".z.&Ff3!p.h....X....`x.....$Q... .yu].(...(.].v]"..."^.^.-.-......^ ..]r..$.h.hk+...&.i`b.........,..)...mGF.+..A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowdown-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):361
                                                                                                                                                                                                                          Entropy (8bit):6.917581408022023
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NBKo6x5F5zEH2vncM+z54wGZPaXagjwF/mPmcjhqsInjKVyf:7KxFU2vncMcGZCKYw9dslI
                                                                                                                                                                                                                          MD5:EF7A1ADFC0EB205761560D208124A1F0
                                                                                                                                                                                                                          SHA1:3105A8E2E6658C4EAA440EE07D3BBDE42B0635F2
                                                                                                                                                                                                                          SHA-256:20787BCA657198939A087D61AE039D520A2C06239AC6196853916E9A73D2374F
                                                                                                                                                                                                                          SHA-512:47552D0B5C9A60ECCC3A9B0BDFC6216D289516D39EF24AEFC05ECCC5DC407661E08AC6E11C25B47132D0752ED2389EA961EF247D36A7E349E664C659C7F47B86
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a....................................................................................................................................................................................................,...........@T.!`.....%.e,..Tj..d.G..:......*.v....Hi...Z}.0......0..-8({w_.+.4.+#i.x_..,3.:_.`.&+&.`{..j0.<7`u...j il.%.178.kbd..2.9....')...(..oGF.%.(A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowdown-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):358
                                                                                                                                                                                                                          Entropy (8bit):6.5203979113648876
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NBqwABREbbshGvxpcBtTn1YxIEokqWkL+4eR0FbhR98B8r4LA/:7LSmbbFvx2tTn1YedkqWhabLeBMp
                                                                                                                                                                                                                          MD5:B4BE827ED87B0F53B4D628A3D9CAA074
                                                                                                                                                                                                                          SHA1:39BD450C214C81BF6E1713563B51D483546408B0
                                                                                                                                                                                                                          SHA-256:AE414E04F3AB589B8120036DD4313FBE88D9079241ABC4491869DB6DAAA8B871
                                                                                                                                                                                                                          SHA-512:807BE05B47BEAEEC0254CFFD2D74381436086EA7B9E0E196DC7E8A80A1D28CAB857C14445E5C6025DC5A184F14CADCE6A2E336D84CED244271A0E2EAD9678AAF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a....................................................zzy...nnm...........................zyxwwu.................................ssr...........................zzx.......................................,...........@.e.8.....#L L..TJr..C...z...h.....n..`..KKph.........(.0yu]/....2/].v].....^.^..........^...]r...1h.h1..+.,..i`b#..".....-.")..#mGF..#.A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowdown-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):358
                                                                                                                                                                                                                          Entropy (8bit):6.492929711628572
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NBoeMA/dC6SElC9V+vynO9irtVLYZPymKLh7i47VGfzIHGM6+BABT:7oeMAlFSElCuvyOY4ZKmKV7i2jHb6rBT
                                                                                                                                                                                                                          MD5:3C19022A96ED72BE3F3E976FDBC0E86E
                                                                                                                                                                                                                          SHA1:E26C643F45A658415131CB773181D46234AEF208
                                                                                                                                                                                                                          SHA-256:A8B2E48B56FCBBDA36804F5FB39CBBC3547963D920A4F2D7171457249C2EB8A8
                                                                                                                                                                                                                          SHA-512:7B94588CA6D0C06AFD15087A59E29D96F2D50370A378A7E5C3B537750E4DCED7AE4529CD8897AEF5001A7ECB2F9689DA7BBE90DBF2CDA9B8EADE3ED5569A7A88
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a...............................nmkjig......................................................................ttq........{ywzyvusqrqn..................................................................,............F.#`....."..X..T.j.,....Q...G.Q.|.......^5x2``.j..A$.....zvB$(...($B.wB/&.&/_._.'"'.....#_.).B#t.-.i%i.-..+!..iac..........-.....euG...A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowleft-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):354
                                                                                                                                                                                                                          Entropy (8bit):6.4260217676365174
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NECBi291EJMl37ftnfcd3XLOBtvZi+gNCWNfk8vdUrsu9FSqs:Ll1Ec3GHLOBtBi+cnFU19Frs
                                                                                                                                                                                                                          MD5:678B2F9C085B9900ECE976B6CBFF56AB
                                                                                                                                                                                                                          SHA1:2839BDD65ECCA4570EA0E5373A55C13D5B90DE23
                                                                                                                                                                                                                          SHA-256:C0358094CBF4C3F73667597C7F0E0A38C6CC72D1C5EB758FD3128EFFF420BB44
                                                                                                                                                                                                                          SHA-512:3DEC9AC8F7D230496E6C3E0BBBC80EE210C016A0761BB3879EAA6A9E96AD26C48D00A5F65BB14BAB7F8B6B27EAC24CAAEFAEBFE6AB755ED9CB8C0712591A5FA6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.................................................................xxwtts........................................................{{z...oon......||z................................................,..............dA.....$L....T.1...@J3.z!(.c)p..C7.!.2......... x...Fz]#."..].y]!.*...........{}.... qsuw.&.q.j.l-...(.q`b............+. .nGF.-..A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowleft-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):569
                                                                                                                                                                                                                          Entropy (8bit):5.457698922551712
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:QK1RlZFlLsHsBtlWbElkYeTKddPl+OGh8:Q6X1LsHal3uJTKdBlv9
                                                                                                                                                                                                                          MD5:FA85CA7A2EB58E771CCFA6F476E5F171
                                                                                                                                                                                                                          SHA1:58AC2C219308E3751753C15F6DB15FC9D6946BD3
                                                                                                                                                                                                                          SHA-256:5303BA9A7ED299605BAC532E9948278E5156FF8C3C396C806E6437CA72517C7C
                                                                                                                                                                                                                          SHA-512:6CB1B406387479943718DBD2019C13AEE2B078FC4A5A9AC008DC1F6D9C1B69702FD1B35ECAD96C8611B63A8848E9B92B4911580FA3AB82892F06E696761CE063
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a................................................................................................................................................................................................................................................................................................................................................................................................,............-#........4.9......=$89...&/.-...?>3..A............52A.+.....7..%."...<.);...:10...-..6(.....,*....!.. ..-.....-....'.8>?...(.1.H.....p1.......:d....-...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowleft-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):355
                                                                                                                                                                                                                          Entropy (8bit):6.4738481905780985
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NBqwAOWREbb3cLC/8x7yTn1PMxIEuTDKR2A6oiygQmHAKbE:7L/WmbbZ/8x7yTn1UeD46oi5QwXo
                                                                                                                                                                                                                          MD5:74FEABEC69E49F4C1599B2F08E1F8F1E
                                                                                                                                                                                                                          SHA1:F05CCECD83C5BA8F04EF0A42819C5116DC5AD66A
                                                                                                                                                                                                                          SHA-256:74B82B5B45D1EC548BDE4FF233426D47119A921C8449E7A5061AE3460F930D10
                                                                                                                                                                                                                          SHA-512:DE082175C160DFEBC3746AEFCF3B35FBD8603AAB02B951D8FA0581F0BB005DC4A0AF1269E439E2B3F715D1734A1ECD832303A0717EBE45B1E38608364EC62E86
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a..................................................zzynnm.....................wwu.......................................zyyssr........................................................................,............WE.@.....#T$H..T*j}..Di..z...(.....L..J.,.........y@..Fz].....].y]1.&.../../....{}.....qsuw.-0q/j/0..*.+..q`b!.. -....,. (..!nGF..!.A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowleft-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):356
                                                                                                                                                                                                                          Entropy (8bit):6.500212481574859
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NBoeMA/3dy4bS3oVlM1rtVLoUYxyk1daQI1d8jYJsLyBay2S3ouGZC5g9n:7oeMAfd5lMGBxy4RI/day2S3ouGuan
                                                                                                                                                                                                                          MD5:E83913445DC59929363D075E522ABB18
                                                                                                                                                                                                                          SHA1:943BE3D2FF77E3CF1CEBC9BEAD4CDC743730D2F5
                                                                                                                                                                                                                          SHA-256:69C9168D87DA2CBD1C498602E0ACD7BB621926227FD4C9E76CCBC340777872D5
                                                                                                                                                                                                                          SHA-512:0C2BA0D8DA345D829711F0D721977F9BA5A72B7BA8D04A871C4D1BB4EE95B873A9E05F7D82204B7E7E115E9C8C26BE385F2EDFD7F363B47B32BB59D2486C6FEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a..................................rqonmkjig......................zxv.......................{yv..............................usq.....................................................................,..............$p.....#..V..TZb.4"...J..........oK.....oZ......'}x.._.F{B.....B.zB#.(...........|~....'i.tvx.,...k..,. *&..iac .........,.."."eyG...A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowright-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):354
                                                                                                                                                                                                                          Entropy (8bit):6.440964296928689
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NECBi291EJMl37ftnfcd3XLOBtvZi+gNCWNfkmPfSGHB03YdHqs:Ll1Ec3GHLOBtBi+c/B03Vs
                                                                                                                                                                                                                          MD5:33C95AED5B3CD351579969AB0420A592
                                                                                                                                                                                                                          SHA1:3FA3E585239C450D0EEA09ECD1671DCB2AFA58D4
                                                                                                                                                                                                                          SHA-256:CD25BBC7A91A6B7627469E8D7F3F69958C89E687F8264BD2C0FD25BCD7C8DF4F
                                                                                                                                                                                                                          SHA-512:7BCA5F27E9E7F57CC64579445AC108671C23B5BE583A70924A79F74CE45B35FE30C5FCD39EDA6712D2E4F6DF16165ACEAB066FD58B7FBEDD3669E15B6CF5A5FF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.................................................................xxwtts........................................................{{z...oon......||z................................................,..............dA.....$L....T.1...@J3.z!(.c)p..o7.!.2..C.r...5.%0x/Fy^,.".#].xz..*.!...].....z|~.... ^rtv.&.^ijl-...(.j.`b............+. .nGF.-..A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowright-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):364
                                                                                                                                                                                                                          Entropy (8bit):6.977990392547309
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NBK19x5JQx2vwh+YOC+Qr9Ww6XIrICKkqbJJSFjMnpDMmpUgj34qpizKnvibkQEn:7K1lJQx2vwhPhM4jwIMt/Ug8qAzwiArn
                                                                                                                                                                                                                          MD5:7E3E510409FEDAE2C32D2D5826EE4542
                                                                                                                                                                                                                          SHA1:0219E5D0100782F773CCBEC448DB1AAE0BE42F41
                                                                                                                                                                                                                          SHA-256:2DDC7DF66AEAB5D169CC955E3328C2FA5767887E86E20671BB7FDBB25306894E
                                                                                                                                                                                                                          SHA-512:3AD2D77DD161E57916975705EFA828185EB38F4D4A4D37150DF4D2B330D21B7EC8AA6BC713C83F7638BD7392BE15E082933EA9411F7ACAE7757D18BE71612F4D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a...................................................................................................................................................................................................,...........@..!h....&.m0..T.#.n....C....oG3.~.p..M.8...;;.]-B#...X.` F|`...)9_.{}.21.!..._..*8&i.}+..;....l3%>ly...`#i`..(.6;<.wbd..74=. ..-/4.....pGF.(..A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowright-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):354
                                                                                                                                                                                                                          Entropy (8bit):6.548880709817578
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NBqwAOWREbb3cLC/8x7yTn1PMxIEuCogQIDKR2WQ84LsxP4Kf+FUE:7L/WmbbZ/8x7yTn1UeGBf84La3CP
                                                                                                                                                                                                                          MD5:5DD23CFA4ACD10B8ED366607E46DD9A6
                                                                                                                                                                                                                          SHA1:B2580484D91F3D9988243C3487D760DCC4F476C7
                                                                                                                                                                                                                          SHA-256:2AA8FCDFD2064E4F21D7CF1E4FB2232CF5316ACB26DCE02A3B4BEEAD0950AC96
                                                                                                                                                                                                                          SHA-512:C17D8609CEEC1C77D7D2CB6A399A9E56039E10C2B4B236676C0EB12227EE9AB77524E5466E1481C2F34A041B89C2439D88EB25A357B992C5CE007FF924811C66
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a..................................................zzynnm.....................wwu.......................................zyyssr........................................................................,............WE.@.....#T$H..T*j}..Di..z...(.....o..J.,.K]a...5..ix)Fy^.....].xz..&.1/..].....z|~.....^rtv.-0hj/0..*.+...`b!.. -....,. (..!nGF..!.A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowright-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):355
                                                                                                                                                                                                                          Entropy (8bit):6.522890305585235
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NBoeMA/Zy4bS3oVlMCUqrtVLoUYxyUdLUxbqcSw2aUEIgZYom61dI4pkAW6Zbn:7oeMAx5lMXqIBxyKIjSYwv0Wib
                                                                                                                                                                                                                          MD5:37F00B1CF03F3DA6C9CB5DA0325028E5
                                                                                                                                                                                                                          SHA1:4A69517E21BD355BB46F774637926200BAA1AAE5
                                                                                                                                                                                                                          SHA-256:B99ECDD90DA13ECC2C47A74C2144A89EEA13CDB8DCFE8FA012F17529807F92EA
                                                                                                                                                                                                                          SHA-512:4B1F5129032D4D90F445D6645D6D048F20B53C43FF8A0298C9F92FDFC6650AC16953CA895164E8FBEF8B296FF44AC3619964C92156267B3E4E60EF8C135FAB4A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a..................................nmkjig......................zxv.......................{yv..............................usqrqn.....................................................................,...........@..#h....."..V..TJb.2....J..&H......W......0.Y.,..f.8.._.F{_.....B.z|..'("...B.....|~.....&_tvx.,.ik..,..*%..vb...........,..!.!eyG...A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowup-a.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):355
                                                                                                                                                                                                                          Entropy (8bit):6.440134761422451
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:N2i5V1EJM1gTP7ftjwDafgkpzeVOM222Ktzmch/cZ6G:RV1E/zoyzeVOh22di/cZh
                                                                                                                                                                                                                          MD5:9D5D604C630255214551B4193ADEA48E
                                                                                                                                                                                                                          SHA1:6AA23AB22FADE7961D0C7AECFC98457B3104EB5B
                                                                                                                                                                                                                          SHA-256:261FF068C0F1338F9CABBA896218DB8C055963B5F0E881B9BE9B3EE9DEEE0B4C
                                                                                                                                                                                                                          SHA-512:0D8C724B612E115A03018B152F78A2C7E95D5877EDB0165808F8C02806F02C04A9506B3E4B3358EB5B12758BF54437DBA0E056EBC5F77A048F7EAF66427FE09D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.........................................................xxwtts............................................................{{z...oon.......||z...................................................,...........@.g41.....$<....T.!.....".z.&Ff3!p.h....X....0<...M1..-.-.^}v^"...".~].(...(.].w .*...{}...irt.$..^k+...&.i`b.........,..)...mGF.+..A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowup-d.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):363
                                                                                                                                                                                                                          Entropy (8bit):6.981160887929191
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NBK17bBAqZOS8XrFSD65SwVI/K+5mftxJ3GaSiLFKRXSX+ZZVZewfjMbg:7K17bCS8twqISntx8iw5bZZVgwLyg
                                                                                                                                                                                                                          MD5:60C2E9E78DB0949D43E7AB515B0F1158
                                                                                                                                                                                                                          SHA1:0BE83B8999CF78714205817163B7A89E177EBBE8
                                                                                                                                                                                                                          SHA-256:33411AAC7A76C936BB326D23F835E314BC93E92B569D6F5C4CEA3FB0CE309E61
                                                                                                                                                                                                                          SHA-512:5C8D4D0AEAD1CC06F007BF87126649DC6D0572008B7A0B3E9E1EBE3A750D76493A927E8A3459566F7DE94C45105197ADC7C414002BF4DE0B1E4178C878FDAF32
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a.................................................................................................................................................................................................,.............h"h.....&.q2..T...h..g.:....N.2.z....Pu../..>......P..y_..,%(`.x`2%..&.._1.6..,9_.y7.....}..._."...)v...kj..$.3:;.kbd..4/<....'*/..)..oGF.$.)A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowup-n.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):356
                                                                                                                                                                                                                          Entropy (8bit):6.51597361095197
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NBqwABREbbshGvxpcBtTn1YxIEomqWkL+4jA4RjPMqrp7F4FNU/MYfYPr4JSWO:7LSmbbFvx2tTn1Yed7Wt41P/p7F48gDj
                                                                                                                                                                                                                          MD5:BE840756AE7F9737D34C3B3F0E0FA0AA
                                                                                                                                                                                                                          SHA1:249538F7AD17342AD2C9989C31739F384C94B2D4
                                                                                                                                                                                                                          SHA-256:7147B4AB8B03CC70E8E6108A592FC57FB1BA9F4198F07C04DF2661C6A7874C0C
                                                                                                                                                                                                                          SHA-512:A2E672FA9BF4D738C5B78D5C6171E3C01DEB402B8876B9EBA59A24B1B51F84B0B19E38B7771CF69CC5A8A271175475F56C860658F6A276CDD0C0F845276A7ACC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a....................................................zzy...nnm...........................zyxwwu.................................ssr...........................zzx.......................................,...........@.e.8.....#L L..TJr..C...z...h.....n..`....%84....m1......^}v^......~]/....2/].w.(...({}...irt..1.^1..+.,..i`b#..".....-.")..#mGF..#.A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\arrowup-p.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 15 x 15
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):358
                                                                                                                                                                                                                          Entropy (8bit):6.49932773971643
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:NBoeMA/dC6SElC9V+vynO9irtVLYZPymKLh7i4OGyth2+NRyL6/:7oeMAlFSElCuvyOY4ZKmKV7iprv2X6/
                                                                                                                                                                                                                          MD5:B53B03F059F760BE28A7C6C52B09B8E4
                                                                                                                                                                                                                          SHA1:7B9D47B3E26A19C4439125712F95B882EE2F6D9B
                                                                                                                                                                                                                          SHA-256:E47705C3DF704CC606DAE21D881666B71FE158CCE35126CC5C83109AE596C3CF
                                                                                                                                                                                                                          SHA-512:838DC78F649F315E946A0FE5447C822A11A31040AE346D584637B618A3B4F06F6121CC19B520AD77F14AE8DEA203FD8C891CC20C675D032C0320B4B8C214C061
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87a...............................nmkjig......................................................................ttq........{ywzyvusqrqn..................................................................,............F.#`....."..X..T.j.,....Q...G.Q.|........o)=....t&.IK.yB.'"'._.x_/&.&/..B$(...($B.y......}...#jtv.-.._.-..+!..tb...........-.....ewG....A.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\button-s.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 29 x 29
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1441
                                                                                                                                                                                                                          Entropy (8bit):6.434112575669431
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mA/1m+4yKWfCR9LTN7B6K4s+Z+wijMRHIzDSL+4lR:xm+RebdBHm9IzC3R
                                                                                                                                                                                                                          MD5:7F24A9763F067EEC1D8EDF3581F5ECC3
                                                                                                                                                                                                                          SHA1:735039A7ECA728A875ED980DA3FA54DFE0E1F434
                                                                                                                                                                                                                          SHA-256:A4C5F4FD5B9641565F2A5D54FCAC3288149EAA185351C56D8B94763AF7F32CAD
                                                                                                                                                                                                                          SHA-512:2033D011EB2AD23F46492296E9C84C3C7E6464B8B5F8ADFA231FD578FCE722B8C540267F30447EB461207A24410773393A2FA72EABC5D66B851BDA3CECD8E7D6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.......~R..S.T.Z.U.[.\.a.b.c.d.e.j.q.r.n.z.v.w..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..Created with GIMP.!.....y.,...............S.F....*\..F.=...i.A....3j....7.U<......'..\.r...b...!B.3f....O.:y.A.'B.(:.8!...P.;.F.D......Cf.V._....i..)N..C&L.1a...#F...r.......j.|......].l.....]...{.../[.l...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\button-sa.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 29 x 29
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1022
                                                                                                                                                                                                                          Entropy (8bit):7.69130606936045
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:N55SJpSUAQnTxLGAxBm+owj/uBYqseDFlJq67QRdDlYl6B5S:HkDSUAQnAAxBOtZHLKul4A
                                                                                                                                                                                                                          MD5:CAD6708E8DCAA0C2AB42779CECEC1395
                                                                                                                                                                                                                          SHA1:4E6F9789F4982834FFC9FFD98258F3C291C7DD07
                                                                                                                                                                                                                          SHA-256:1DA25D78E1EAEE040BD1C0A12BA6B90ABB5E732399D3A6DD24A05F39A8104E2C
                                                                                                                                                                                                                          SHA-512:8C75ABAAA5A4C93CBC6A2DA4C9E423C58DD7766E4757FD00C47C76531F585F29228F066F653893E5D4663A14697D10C0D8B8039E8615A6A5AAE4EC382EC177A1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....|..ze.|a.|g.}b.}h.~c.~h..i..e..k..l..m..n..o..p..q.t.u.w.w.x.x.y.|.}.f..g.g.h...h.i.o...j.p.k.q.l.r.{.m.v.|.r.}.r..s..t.t..u.u...v...|..w....x....~..y........{.......................................................................................................................................................!..Created with GIMP.!.......,............{{xsmh.....msz.{vkF..........Biv.j..Uln.....lV!.kxrB.ZK.MM.....K.MY.Frm.RJ.K.....P.mg.dJJG....H...Ga.ge.d.GHG..HHD..J.Gd.e.aGD...B... ...A.._..]....#...1.$.EA?.[.\.A...=(...QL.+@|..&..8t..S...@.$..2...8j(]Zc...5p..1eh..:..!..Os..b5...8..X.....'b..F.'V.8.1C.\.)R.u.....N..=.....pMH.Lb...N.,fR....&H..=Z.[.5.h.c.H..%F.. b...E..q../...pq.....=.V~....ng 1.... .M.V........P....A.x.B.....9d.?.C}.....e....q .....x........@.....}.f@ ..=wB...W...I....h!~ @wC.\..@..`.w..m"...........U...0$i$.HY\\.....XT....9.Wl.e%.*@0..x.A..68@..h...h..@.\...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI79882\ttkthemes\themes\radiance\radiance\check-dc.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 14
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):645
                                                                                                                                                                                                                          Entropy (8bit):6.784878260015659
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:T5MlW7OmeC005z0vH8rkSmQiixJtMoFELAEw4a+qzQ6AD6eBjrSy:NxE0568rkSmQiixJtCLLSAZ+y
                                                                                                                                                                                                                          MD5:A8B5D93C3EB7CD247357CCE05C5E03D1
                                                                                                                                                                                                                          SHA1:D561DA7AB8B74BAFD2F5AC10CBF5EBB54AB8B1B1
                                                                                                                                                                                                                          SHA-256:13957193B4412EAEC39CBF71B29BAD522DC0A4B7158CBBDD1785E9C73D064016
                                                                                                                                                                                                                          SHA-512:58B5AFC86156FB197B721A9A6402B508F5D459CA1360483DFD4DBF830D54B8D5FF5E94D215FAC5D930711EB1FFD789E47F70B159F1F477DEF9307FCFBE61E4D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.....i.........................................................................................................................................................................................................................................................................................................................................................................................!..Created with GIMP.!.......,...........3........N`M.(df..egfc(."..^XYZZV.VYXa..B._TSRNP.TTW!.+_.]OQGICCHJP...h_.[C$D966?E......U&..4,,:..R...T'...12...*R...K=.....)AL...0..E>u.J@3".Y. 5^.8.....@...Q...#F...b..._"..f...<...0...&.....sg..\.|...;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\hotmailpulse.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\u08NgsGNym.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):37697788
                                                                                                                                                                                                                          Entropy (8bit):7.996170542989497
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:786432:MUpb3HUTLJf0f1QtIJ2j6+s7LWB75zupmS3ILJ6eW5qW80h8o2ClVB:ZHUTd8diIJ2qHWB75ipmSGocW7Z
                                                                                                                                                                                                                          MD5:6EB94393FE46226E4839EAEE0A785900
                                                                                                                                                                                                                          SHA1:329DA6AC977F3B7F00AF091CE2615F6CF8F3724D
                                                                                                                                                                                                                          SHA-256:FF2395B6CC04FECE09061FFE12581DE5996FC950FB36FAC60A791EB1DB7A2953
                                                                                                                                                                                                                          SHA-512:D0D29A6B10A8D615CA63B96481B2CCBEB0CAF4DB03695A2A5B9DAC3B3780E7AAFE08F015FE6D7BD84F2A3EB976B25DA803F185DAF66930735E67B4106C048E7C
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Q...?...?...?.Z.<...?.Z.:...?.Z.;...?......?...:.9.?...;...?...<...?.Z.>...?...>...?.+.;...?.+.=...?.Rich..?.........................PE..d......e.........."....%.....x.................@....................................].?...`.....................................................x....`..4.... ..."...........p..\...0..................................@............... ............................text............................... ..`.rdata...+.......,..................@..@.data...83..........................@....pdata..."... ...$..................@..@_RDATA..\....P......................@..@.rsrc...4....`......................@..@.reloc..\....p......................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\ico.ico

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\u08NgsGNym.exe
                                                                                                                                                                                                                          File Type:MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67646
                                                                                                                                                                                                                          Entropy (8bit):2.825291344340777
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:1gA+mY0bVCkk+0g1/////GRDFlNr9c6qgKE:1gA+mYMn0I/////GRRr9c6qgKE
                                                                                                                                                                                                                          MD5:ADE9072D099ADE487E33EA24F77F0FC1
                                                                                                                                                                                                                          SHA1:035BB117D7B69140C073432952E1A61ABC35E237
                                                                                                                                                                                                                          SHA-256:033EFC936977D687260A2FDA49243D4B28C7D02779DB1EF30C8DCDBE17CEB0D0
                                                                                                                                                                                                                          SHA-512:C02CF42A79F37086DF301DEF5C8AFFDDDBF0315873772359F69151D5150F69B3443362547BB4D9689CA5112F460C61746C2DE57746E01672DF070113027C8ABA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:............ .(.......(............. ..............................................................................................................................................................................................................................................\E!._JK.^Il.^J..^K..^J..^J._J.^K.^J..^K..^K..^J..^K._J.^J.^J..^K..^J..^Il._JK.\E!.....................................................................................................................................................................................................................................................................................................................................................................................................................[G..^HT.^J..^K._K._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.^K.^J..^HT.[G...........................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\img\ico.ico

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\u08NgsGNym.exe
                                                                                                                                                                                                                          File Type:MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67646
                                                                                                                                                                                                                          Entropy (8bit):2.825291344340777
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:1gA+mY0bVCkk+0g1/////GRDFlNr9c6qgKE:1gA+mYMn0I/////GRRr9c6qgKE
                                                                                                                                                                                                                          MD5:ADE9072D099ADE487E33EA24F77F0FC1
                                                                                                                                                                                                                          SHA1:035BB117D7B69140C073432952E1A61ABC35E237
                                                                                                                                                                                                                          SHA-256:033EFC936977D687260A2FDA49243D4B28C7D02779DB1EF30C8DCDBE17CEB0D0
                                                                                                                                                                                                                          SHA-512:C02CF42A79F37086DF301DEF5C8AFFDDDBF0315873772359F69151D5150F69B3443362547BB4D9689CA5112F460C61746C2DE57746E01672DF070113027C8ABA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:............ .(.......(............. ..............................................................................................................................................................................................................................................\E!._JK.^Il.^J..^K..^J..^J._J.^K.^J..^K..^K..^J..^K._J.^J.^J..^K..^J..^Il._JK.\E!.....................................................................................................................................................................................................................................................................................................................................................................................................................[G..^HT.^J..^K._K._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.._K.^K.^J..^HT.[G...........................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\img\telegram.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\u08NgsGNym.exe
                                                                                                                                                                                                                          File Type:PNG image data, 94 x 94, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17381
                                                                                                                                                                                                                          Entropy (8bit):7.97606650007025
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:5zdJJfRXwLucvjQZxzYEdr7bmKXZKOPXymCgqVo8:JpfGtcMEZ7bmOwOamDqG8
                                                                                                                                                                                                                          MD5:4BA0B763BB463C8CB333F8AEFA60E972
                                                                                                                                                                                                                          SHA1:325E887CE257D8665574E392D3BF81254B2C18A2
                                                                                                                                                                                                                          SHA-256:13FFE05137752B6B9DB9EB4D87C6AFCEA3DCE4B77F80C0028D2AA64F39B76352
                                                                                                                                                                                                                          SHA-512:244BD43DBE51988C80BD72E5356BF971B274EB6BC2BABA18A6A80A8FA46AA089ACE60EB9B3D18494917AA70A5EFA0998C457DF373F66E2728B96073000474655
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR...^...^.......n....pHYs............... .IDATx...tTW...$.y..7.....h..J9..6.q.c.L09.(!..rN..&.. $..@9.X..JY..{...U.<o.jOO.t.>k}..[.......T-3..............Z...Db...M5..^b.T`..-V.[....$v..,e..+...Z....D.".;.&V*..T$.!.]S.y..}...Y....`.........%...V.l[..fV.=.%....B..&b.D..F"...@..D.%...5dxMM.........a.(...&2....Y#....`...A*2.P...:..I.hP.....^b.......n..v...G..E..w..M.)".?....*&Bd/E.]...o.............z..........FA,.Sd..p..x2..,....a9}d.....b.Z....?X.:"...K.w.A9...2.DV.....i...../.....#ZC........]..<.G.....t.Z.y?.5i..g... .3...-"+......=. ..>..k!.V..D.?<...X.(H..M.Y1.....8...s..SC4-!qA.(....g74.xf.(....Kp.&l.$.V.....*...ym..r`...JN..F}^..?.!^=..w'.....?y5...%..+...z.h..(GE.P...t.R..4`.$..... ....A.].h}.H...5].....B...}.....t.vC.4kT.].A..]. an..3......5.vJ.4..I.WK4...Q.an=a]#.{.P.i....&^...u".(......A.a...]...(.wv).2.U..^..k..1.J.R..)D...;...:@Z.~R..%.....$..$l.$lP.k:..J`..X '.m..j!|..|.H.....Z.'.0........I.PA.QEXWKBp..}S!n.....Z....h.a5*..i

                                                                                                                                                                                                                          Static File Info

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Entropy (8bit):7.998926159392167
                                                                                                                                                                                                                          TrID:
                                                                                                                                                                                                                          • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                          • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                          File name:u08NgsGNym.exe
                                                                                                                                                                                                                          File size:36'780'891 bytes
                                                                                                                                                                                                                          MD5:5d1c90bbe14678ab16a7495e576422b9
                                                                                                                                                                                                                          SHA1:7544c71c22d7507a4576f6c00c802abb0b0bffbe
                                                                                                                                                                                                                          SHA256:23e0d0f06f84e215822d36bc160a0afd6a7e55263ca788e69a69eecb5b48f5b4
                                                                                                                                                                                                                          SHA512:7ef56c5c3e4b51a6135e1688e7837b30ff74fc7772bfad423db2c2b79792f0e4be489e7784e63a59906b2888bfcee695a61fcb8cbdc1b85f9d24f69dc0e956c8
                                                                                                                                                                                                                          SSDEEP:786432:5l+VoN5EwtsuGjbEd4QEuz76hYOKbfNx5Odrs4JF:3suIjQnOKbMSYF
                                                                                                                                                                                                                          TLSH:56873321F0AAC456E272217E86D4C3446D6A3E4FDA37425E73DFB94C6B33D9E9880364
                                                                                                                                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W...6...6...6....V..6....T.'6....U..6..)MZ..6..)M...6..)M...6..)M...6...N$..6...N4..6...6...7..'M...6..'M...6..'MX..6..'M...6.

                                                                                                                                                                                                                          File Icon

                                                                                                                                                                                                                          Icon Hash:17716970e8b96917

                                                                                                                                                                                                                          Static PE Info

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Entrypoint:0x421d50
                                                                                                                                                                                                                          Entrypoint Section:.text
                                                                                                                                                                                                                          Digitally signed:false
                                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                                          Subsystem:windows gui
                                                                                                                                                                                                                          Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                                          DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                          Time Stamp:0x651BC7F7 [Tue Oct 3 07:51:19 2023 UTC]
                                                                                                                                                                                                                          TLS Callbacks:
                                                                                                                                                                                                                          CLR (.Net) Version:
                                                                                                                                                                                                                          OS Version Major:5
                                                                                                                                                                                                                          OS Version Minor:1
                                                                                                                                                                                                                          File Version Major:5
                                                                                                                                                                                                                          File Version Minor:1
                                                                                                                                                                                                                          Subsystem Version Major:5
                                                                                                                                                                                                                          Subsystem Version Minor:1
                                                                                                                                                                                                                          Import Hash:75e9596d74d063246ba6f3ac7c5369a0

                                                                                                                                                                                                                          Entrypoint Preview

                                                                                                                                                                                                                          Instruction
                                                                                                                                                                                                                          call 00007F2C34E2167Bh
                                                                                                                                                                                                                          jmp 00007F2C34E2102Dh
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          push 00424F20h
                                                                                                                                                                                                                          push dword ptr fs:[00000000h]
                                                                                                                                                                                                                          mov eax, dword ptr [esp+10h]
                                                                                                                                                                                                                          mov dword ptr [esp+10h], ebp
                                                                                                                                                                                                                          lea ebp, dword ptr [esp+10h]
                                                                                                                                                                                                                          sub esp, eax
                                                                                                                                                                                                                          push ebx
                                                                                                                                                                                                                          push esi
                                                                                                                                                                                                                          push edi
                                                                                                                                                                                                                          mov eax, dword ptr [0044277Ch]
                                                                                                                                                                                                                          xor dword ptr [ebp-04h], eax
                                                                                                                                                                                                                          xor eax, ebp
                                                                                                                                                                                                                          push eax
                                                                                                                                                                                                                          mov dword ptr [ebp-18h], esp
                                                                                                                                                                                                                          push dword ptr [ebp-08h]
                                                                                                                                                                                                                          mov eax, dword ptr [ebp-04h]
                                                                                                                                                                                                                          mov dword ptr [ebp-04h], FFFFFFFEh
                                                                                                                                                                                                                          mov dword ptr [ebp-08h], eax
                                                                                                                                                                                                                          lea eax, dword ptr [ebp-10h]
                                                                                                                                                                                                                          mov dword ptr fs:[00000000h], eax
                                                                                                                                                                                                                          ret
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          mov ecx, dword ptr [ebp-10h]
                                                                                                                                                                                                                          mov dword ptr fs:[00000000h], ecx
                                                                                                                                                                                                                          pop ecx
                                                                                                                                                                                                                          pop edi
                                                                                                                                                                                                                          pop edi
                                                                                                                                                                                                                          pop esi
                                                                                                                                                                                                                          pop ebx
                                                                                                                                                                                                                          mov esp, ebp
                                                                                                                                                                                                                          pop ebp
                                                                                                                                                                                                                          push ecx
                                                                                                                                                                                                                          ret
                                                                                                                                                                                                                          push ebp
                                                                                                                                                                                                                          mov ebp, esp
                                                                                                                                                                                                                          sub esp, 0Ch
                                                                                                                                                                                                                          lea ecx, dword ptr [ebp-0Ch]
                                                                                                                                                                                                                          call 00007F2C34E13751h
                                                                                                                                                                                                                          push 0043F388h
                                                                                                                                                                                                                          lea eax, dword ptr [ebp-0Ch]
                                                                                                                                                                                                                          push eax
                                                                                                                                                                                                                          call 00007F2C34E23BA5h
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          jmp 00007F2C34E25A78h
                                                                                                                                                                                                                          push ebp
                                                                                                                                                                                                                          mov ebp, esp
                                                                                                                                                                                                                          and dword ptr [00466078h], 00000000h
                                                                                                                                                                                                                          sub esp, 24h
                                                                                                                                                                                                                          or dword ptr [004427B0h], 01h
                                                                                                                                                                                                                          push 0000000Ah
                                                                                                                                                                                                                          call dword ptr [004361D0h]
                                                                                                                                                                                                                          test eax, eax
                                                                                                                                                                                                                          je 00007F2C34E21362h
                                                                                                                                                                                                                          and dword ptr [ebp-10h], 00000000h
                                                                                                                                                                                                                          xor eax, eax
                                                                                                                                                                                                                          push ebx
                                                                                                                                                                                                                          push esi
                                                                                                                                                                                                                          push edi
                                                                                                                                                                                                                          xor ecx, ecx
                                                                                                                                                                                                                          lea edi, dword ptr [ebp-24h]

                                                                                                                                                                                                                          Rich Headers

                                                                                                                                                                                                                          Programming Language:
                                                                                                                                                                                                                          • [ C ] VS2008 SP1 build 30729
                                                                                                                                                                                                                          • [IMP] VS2008 SP1 build 30729

                                                                                                                                                                                                                          Data Directories

                                                                                                                                                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x405c00x34.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x405f40x50.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x680000x1518c.rsrc
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x7e0000x255c.reloc
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x3e3b00x54.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x388b00x40.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x360000x278.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x3fa9c0x120.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                          Sections

                                                                                                                                                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                          .text0x10000x345cc0x34600b7a8b04ab2248443b05e8133fb3a9064False0.5887343377088305data6.708390817791953IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .rdata0x360000xb4100xb600a418919d63b67e937555eec95d3b6bcbFalse0.45409083104395603Applesoft BASIC program data, first line number 45.215945456388312IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .data0x420000x247580x1200d8d5c95192b51ddad1857caa38e7daa9False0.4049479166666667data4.078919796039023IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                          .didat0x670000x1a40x200ee74a17c4eeb586c9811481b77498b43False0.4609375data3.5194570553957747IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                          .rsrc0x680000x1518c0x1520002867482cbc70a0c19d934a95c4608c5False0.18986917529585798data4.050192125685336IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .reloc0x7e0000x255c0x2600699c6b2b1b2acad2d0f219d9328713afFalse0.783203125data6.6660836278877325IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                          Resources

                                                                                                                                                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                          PNG0x685240xb45PNG image data, 93 x 302, 8-bit/color RGB, non-interlacedEnglishUnited States1.0027729636048528
                                                                                                                                                                                                                          PNG0x6906c0x15a9PNG image data, 186 x 604, 8-bit/color RGB, non-interlacedEnglishUnited States0.9363390441839495
                                                                                                                                                                                                                          RT_ICON0x6a6180x10828Device independent bitmap graphic, 128 x 256 x 32, image size 675840.06488820537087425
                                                                                                                                                                                                                          RT_DIALOG0x7ae400x286dataEnglishUnited States0.5092879256965944
                                                                                                                                                                                                                          RT_DIALOG0x7b0c80x13adataEnglishUnited States0.60828025477707
                                                                                                                                                                                                                          RT_DIALOG0x7b2040xecdataEnglishUnited States0.6991525423728814
                                                                                                                                                                                                                          RT_DIALOG0x7b2f00x12edataEnglishUnited States0.5927152317880795
                                                                                                                                                                                                                          RT_DIALOG0x7b4200x338dataEnglishUnited States0.45145631067961167
                                                                                                                                                                                                                          RT_DIALOG0x7b7580x252dataEnglishUnited States0.5757575757575758
                                                                                                                                                                                                                          RT_STRING0x7b9ac0x1e2dataEnglishUnited States0.3900414937759336
                                                                                                                                                                                                                          RT_STRING0x7bb900x1ccdataEnglishUnited States0.4282608695652174
                                                                                                                                                                                                                          RT_STRING0x7bd5c0x1b8dataEnglishUnited States0.45681818181818185
                                                                                                                                                                                                                          RT_STRING0x7bf140x146dataEnglishUnited States0.5153374233128835
                                                                                                                                                                                                                          RT_STRING0x7c05c0x46cdataEnglishUnited States0.3454063604240283
                                                                                                                                                                                                                          RT_STRING0x7c4c80x166dataEnglishUnited States0.49162011173184356
                                                                                                                                                                                                                          RT_STRING0x7c6300x152dataEnglishUnited States0.5059171597633136
                                                                                                                                                                                                                          RT_STRING0x7c7840x10adataEnglishUnited States0.49624060150375937
                                                                                                                                                                                                                          RT_STRING0x7c8900xbcdataEnglishUnited States0.6329787234042553
                                                                                                                                                                                                                          RT_STRING0x7c94c0xd6dataEnglishUnited States0.5747663551401869
                                                                                                                                                                                                                          RT_GROUP_ICON0x7ca240x14data1.15
                                                                                                                                                                                                                          RT_MANIFEST0x7ca380x753XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3957333333333333

                                                                                                                                                                                                                          Imports

                                                                                                                                                                                                                          DLLImport
                                                                                                                                                                                                                          KERNEL32.dllGetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetTimeFormatW, GetDateFormatW, LocalFree, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapReAlloc, HeapAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage
                                                                                                                                                                                                                          OLEAUT32.dllSysAllocString, SysFreeString, VariantClear
                                                                                                                                                                                                                          gdiplus.dllGdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

                                                                                                                                                                                                                          Possible Origin

                                                                                                                                                                                                                          Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                          EnglishUnited States

                                                                                                                                                                                                                          Network Behavior

                                                                                                                                                                                                                          Network Port Distribution

                                                                                                                                                                                                                          TCP Packets

                                                                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                          Dec 9, 2024 09:57:46.425925016 CET49799443192.168.2.1034.224.200.202
                                                                                                                                                                                                                          Dec 9, 2024 09:57:46.425980091 CET4434979934.224.200.202192.168.2.10
                                                                                                                                                                                                                          Dec 9, 2024 09:57:46.426069021 CET49799443192.168.2.1034.224.200.202
                                                                                                                                                                                                                          Dec 9, 2024 09:57:47.744106054 CET49799443192.168.2.1034.224.200.202
                                                                                                                                                                                                                          Dec 9, 2024 09:57:47.744144917 CET4434979934.224.200.202192.168.2.10
                                                                                                                                                                                                                          Dec 9, 2024 09:57:49.479439974 CET4434979934.224.200.202192.168.2.10
                                                                                                                                                                                                                          Dec 9, 2024 09:57:49.480726957 CET49799443192.168.2.1034.224.200.202
                                                                                                                                                                                                                          Dec 9, 2024 09:57:49.480742931 CET4434979934.224.200.202192.168.2.10
                                                                                                                                                                                                                          Dec 9, 2024 09:57:49.481812000 CET4434979934.224.200.202192.168.2.10
                                                                                                                                                                                                                          Dec 9, 2024 09:57:49.481909037 CET49799443192.168.2.1034.224.200.202
                                                                                                                                                                                                                          Dec 9, 2024 09:57:49.484481096 CET49799443192.168.2.1034.224.200.202
                                                                                                                                                                                                                          Dec 9, 2024 09:57:49.484662056 CET4434979934.224.200.202192.168.2.10
                                                                                                                                                                                                                          Dec 9, 2024 09:57:49.484745026 CET49799443192.168.2.1034.224.200.202
                                                                                                                                                                                                                          Dec 9, 2024 09:57:49.484920979 CET49799443192.168.2.1034.224.200.202

                                                                                                                                                                                                                          UDP Packets

                                                                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                          Dec 9, 2024 09:57:46.281981945 CET6041953192.168.2.101.1.1.1
                                                                                                                                                                                                                          Dec 9, 2024 09:57:46.422163963 CET53604191.1.1.1192.168.2.10

                                                                                                                                                                                                                          DNS Queries

                                                                                                                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                          Dec 9, 2024 09:57:46.281981945 CET192.168.2.101.1.1.10x2968Standard query (0)httpbin.orgA (IP address)IN (0x0001)false

                                                                                                                                                                                                                          DNS Answers

                                                                                                                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                          Dec 9, 2024 09:57:46.422163963 CET1.1.1.1192.168.2.100x2968No error (0)httpbin.org34.224.200.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Dec 9, 2024 09:57:46.422163963 CET1.1.1.1192.168.2.100x2968No error (0)httpbin.org44.196.3.45A (IP address)IN (0x0001)false

                                                                                                                                                                                                                          Statistics

                                                                                                                                                                                                                          CPU Usage

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          Memory Usage

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          High Level Behavior Distribution

                                                                                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                                                                                          Behavior

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          System Behavior

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:0
                                                                                                                                                                                                                          Start time:03:57:04
                                                                                                                                                                                                                          Start date:09/12/2024
                                                                                                                                                                                                                          Path:C:\Users\user\Desktop\u08NgsGNym.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Users\user\Desktop\u08NgsGNym.exe"
                                                                                                                                                                                                                          Imagebase:0x5b0000
                                                                                                                                                                                                                          File size:36'780'891 bytes
                                                                                                                                                                                                                          MD5 hash:5D1C90BBE14678AB16A7495E576422B9
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:2
                                                                                                                                                                                                                          Start time:03:57:07
                                                                                                                                                                                                                          Start date:09/12/2024
                                                                                                                                                                                                                          Path:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Users\user\AppData\Local\Temp\hotmailpulse.exe"
                                                                                                                                                                                                                          Imagebase:0x7ff72f940000
                                                                                                                                                                                                                          File size:37'697'788 bytes
                                                                                                                                                                                                                          MD5 hash:6EB94393FE46226E4839EAEE0A785900
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:4
                                                                                                                                                                                                                          Start time:03:57:39
                                                                                                                                                                                                                          Start date:09/12/2024
                                                                                                                                                                                                                          Path:C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Users\user\AppData\Local\Temp\hotmailpulse.exe"
                                                                                                                                                                                                                          Imagebase:0x7ff72f940000
                                                                                                                                                                                                                          File size:37'697'788 bytes
                                                                                                                                                                                                                          MD5 hash:6EB94393FE46226E4839EAEE0A785900
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          Disassembly

                                                                                                                                                                                                                          Reset < >

                                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                                            Execution Coverage:10.7%
                                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                            Signature Coverage:12.4%
                                                                                                                                                                                                                            Total number of Nodes:1828
                                                                                                                                                                                                                            Total number of Limit Nodes:41
                                                                                                                                                                                                                            execution_graph 24414 5cf05c 24420 5cf07f 24414->24420 24417 5cf717 24522 5d10f9 24417->24522 24419 5cf732 24430 5cea83 _wcslen _wcsrchr 24420->24430 24470 5cfafc 24420->24470 24421 5ced57 SetWindowTextW 24421->24430 24426 5cee02 RegOpenKeyExW 24426->24430 24427 5cee44 RegCloseKey 24427->24430 24429 5cf73c 24529 5d13f9 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent 24429->24529 24430->24417 24430->24421 24430->24426 24430->24427 24430->24429 24431 5ceb4b SetFileAttributesW 24430->24431 24442 5cef75 SendMessageW 24430->24442 24447 5cd41c 24430->24447 24491 5cd5dd 24430->24491 24497 5cc5dd GetCurrentDirectoryW 24430->24497 24498 5bdd18 24430->24498 24506 5bc3de 11 API calls 24430->24506 24507 5bc367 FindClose 24430->24507 24508 5cd76e 74 API calls 3 library calls 24430->24508 24509 5d66ae 24430->24509 24434 5cec05 GetFileAttributesW 24431->24434 24446 5ceb65 __cftof _wcslen 24431->24446 24434->24430 24438 5cec17 DeleteFileW 24434->24438 24435 5cf741 24438->24430 24440 5cec28 24438->24440 24439 5cef35 GetDlgItem SetWindowTextW SendMessageW 24439->24430 24503 5b4c00 24440->24503 24442->24430 24444 5cec5d MoveFileW 24444->24430 24445 5cec75 MoveFileExW 24444->24445 24445->24430 24446->24430 24446->24434 24502 5bd8ac 51 API calls 2 library calls 24446->24502 24449 5cd42e 24447->24449 24448 5cd4e8 24450 5d10f9 CatchGuardHandler 5 API calls 24448->24450 24449->24448 24452 5cd45e RegOpenKeyExW 24449->24452 24451 5cd4f6 24450->24451 24451->24439 24452->24448 24454 5cd47a 24452->24454 24453 5cd4de RegCloseKey 24453->24448 24454->24453 24455 5cd500 24454->24455 24456 5cd4ba 24454->24456 24530 5d13f9 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent 24455->24530 24456->24453 24458 5cd505 24531 5b1366 24458->24531 24461 5cd574 24464 5d10f9 CatchGuardHandler 5 API calls 24461->24464 24462 5cd5b5 SetDlgItemTextW 24462->24461 24463 5cd562 24463->24461 24466 5cd56f 24463->24466 24467 5cd583 GetDlgItemTextW 24463->24467 24465 5cd5d4 24464->24465 24465->24439 24466->24461 24469 5cd57a EndDialog 24466->24469 24541 5c1421 80 API calls _wcslen 24467->24541 24469->24461 24474 5cfb06 __cftof _wcslen 24470->24474 24471 5cfd7e 24472 5d10f9 CatchGuardHandler 5 API calls 24471->24472 24473 5cfd8f 24472->24473 24473->24430 24474->24471 24588 5bbccb 24474->24588 24477 5cfc73 ShellExecuteExW 24477->24471 24482 5cfc86 24477->24482 24479 5cfc6b 24479->24477 24480 5cfcb8 24592 5d004d 6 API calls 24480->24592 24481 5cfd0e CloseHandle 24483 5cfd1c 24481->24483 24482->24480 24482->24481 24484 5cfcae ShowWindow 24482->24484 24483->24471 24487 5cfd75 ShowWindow 24483->24487 24484->24480 24486 5cfcd0 24486->24481 24488 5cfce3 GetExitCodeProcess 24486->24488 24487->24471 24488->24481 24489 5cfcf6 24488->24489 24489->24481 24492 5cd5e7 24491->24492 24495 5cd6df 24492->24495 24496 5cd6bc ExpandEnvironmentStringsW 24492->24496 24493 5d10f9 CatchGuardHandler 5 API calls 24494 5cd6fc 24493->24494 24494->24430 24495->24493 24496->24495 24497->24430 24499 5bdd22 24498->24499 24500 5d10f9 CatchGuardHandler 5 API calls 24499->24500 24501 5bdda6 24500->24501 24501->24430 24502->24446 24611 5b4bd3 24503->24611 24506->24430 24507->24430 24508->24430 24510 5dbb34 24509->24510 24511 5dbb4c 24510->24511 24512 5dbb41 24510->24512 24514 5dbb54 24511->24514 24520 5dbb5d _unexpected 24511->24520 24690 5dbc8e 24512->24690 24515 5dbafa _free 20 API calls 24514->24515 24518 5dbb49 24515->24518 24516 5dbb87 HeapReAlloc 24516->24518 24516->24520 24517 5dbb62 24697 5dbc7b 20 API calls __dosmaperr 24517->24697 24518->24430 24520->24516 24520->24517 24698 5da2ec 7 API calls 2 library calls 24520->24698 24523 5d1101 24522->24523 24524 5d1102 IsProcessorFeaturePresent 24522->24524 24523->24419 24526 5d1314 24524->24526 24701 5d12d7 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 24526->24701 24528 5d13f7 24528->24419 24529->24435 24530->24458 24532 5b13c8 24531->24532 24533 5b136f 24531->24533 24566 5c021d GetWindowLongW SetWindowLongW 24532->24566 24535 5b13d5 24533->24535 24542 5c0244 24533->24542 24535->24461 24535->24462 24535->24463 24538 5b13a4 GetDlgItem 24538->24535 24539 5b13b4 24538->24539 24539->24535 24540 5b13ba SetWindowTextW 24539->24540 24540->24535 24541->24466 24543 5b4c00 _swprintf 51 API calls 24542->24543 24544 5c0289 24543->24544 24567 5c3f47 WideCharToMultiByte 24544->24567 24546 5c0314 24573 5bf6bc 24546->24573 24549 5c0450 GetSystemMetrics GetWindow 24550 5c0516 24549->24550 24565 5c0474 24549->24565 24552 5d10f9 CatchGuardHandler 5 API calls 24550->24552 24551 5c0421 24578 5bf74f 24551->24578 24556 5b1391 24552->24556 24554 5c03e8 GetWindowLongW 24562 5c0415 GetWindowRect 24554->24562 24555 5c0380 24555->24551 24555->24554 24556->24535 24556->24538 24559 5c02a0 _strlen 24559->24546 24563 5c02f3 SetDlgItemTextW 24559->24563 24569 5bf8ec 24559->24569 24560 5c0441 SetWindowTextW 24560->24549 24561 5c0487 GetWindowRect 24564 5c04fc GetWindow 24561->24564 24562->24551 24563->24559 24564->24550 24564->24565 24565->24550 24565->24561 24566->24535 24568 5c3f74 24567->24568 24568->24559 24570 5bf8fb 24569->24570 24572 5bf910 24569->24572 24587 5d8a01 26 API calls 3 library calls 24570->24587 24572->24559 24574 5bf74f 52 API calls 24573->24574 24577 5bf6f2 24574->24577 24575 5d10f9 CatchGuardHandler 5 API calls 24576 5bf74b GetWindowRect GetClientRect 24575->24576 24576->24549 24576->24555 24577->24575 24579 5b4c00 _swprintf 51 API calls 24578->24579 24580 5bf784 24579->24580 24581 5c3f47 WideCharToMultiByte 24580->24581 24582 5bf799 24581->24582 24583 5bf8ec 26 API calls 24582->24583 24584 5bf7a8 24583->24584 24585 5d10f9 CatchGuardHandler 5 API calls 24584->24585 24586 5bf7b4 24585->24586 24586->24549 24586->24560 24587->24572 24593 5bbcdd 24588->24593 24591 5bd563 8 API calls CatchGuardHandler 24591->24479 24592->24486 24603 5d1590 24593->24603 24596 5bbd2c 24598 5d10f9 CatchGuardHandler 5 API calls 24596->24598 24597 5bbd07 24605 5bda1e 24597->24605 24600 5bbcd4 24598->24600 24600->24477 24600->24591 24602 5bbd1d GetFileAttributesW 24602->24596 24604 5bbcea GetFileAttributesW 24603->24604 24604->24596 24604->24597 24606 5bda28 _wcslen 24605->24606 24609 5bdaf7 GetCurrentDirectoryW 24606->24609 24610 5bda6f _wcslen 24606->24610 24607 5d10f9 CatchGuardHandler 5 API calls 24608 5bbd19 24607->24608 24608->24596 24608->24602 24609->24610 24610->24607 24612 5b4bea __vswprintf_c_l 24611->24612 24615 5d8772 24612->24615 24618 5d6835 24615->24618 24619 5d685d 24618->24619 24622 5d6875 24618->24622 24635 5dbc7b 20 API calls __dosmaperr 24619->24635 24621 5d687d 24637 5d6dd4 24621->24637 24622->24619 24622->24621 24623 5d6862 24636 5d6649 26 API calls ___std_exception_copy 24623->24636 24628 5d10f9 CatchGuardHandler 5 API calls 24630 5b4bf4 GetFileAttributesW 24628->24630 24629 5d6905 24646 5d7184 51 API calls 4 library calls 24629->24646 24630->24440 24630->24444 24633 5d686d 24633->24628 24634 5d6910 24647 5d6e57 20 API calls _free 24634->24647 24635->24623 24636->24633 24638 5d688d 24637->24638 24639 5d6df1 24637->24639 24645 5d6d9f 20 API calls 2 library calls 24638->24645 24639->24638 24648 5db9a5 GetLastError 24639->24648 24641 5d6e12 24668 5dbf86 38 API calls __cftof 24641->24668 24643 5d6e2b 24669 5dbfb3 38 API calls __cftof 24643->24669 24645->24629 24646->24634 24647->24633 24649 5db9bb 24648->24649 24650 5db9c1 24648->24650 24670 5dd4ab 11 API calls 2 library calls 24649->24670 24653 5dba10 SetLastError 24650->24653 24671 5dd786 24650->24671 24653->24641 24654 5db9db 24678 5dbafa 24654->24678 24657 5db9f0 24657->24654 24659 5db9f7 24657->24659 24685 5db810 20 API calls _unexpected 24659->24685 24660 5db9e1 24662 5dba1c SetLastError 24660->24662 24686 5db584 38 API calls _abort 24662->24686 24663 5dba02 24665 5dbafa _free 20 API calls 24663->24665 24667 5dba09 24665->24667 24667->24653 24667->24662 24668->24643 24669->24638 24670->24650 24672 5dd793 _unexpected 24671->24672 24673 5dd7d3 24672->24673 24674 5dd7be RtlAllocateHeap 24672->24674 24687 5da2ec 7 API calls 2 library calls 24672->24687 24688 5dbc7b 20 API calls __dosmaperr 24673->24688 24674->24672 24675 5db9d3 24674->24675 24675->24654 24684 5dd501 11 API calls 2 library calls 24675->24684 24679 5dbb05 RtlFreeHeap 24678->24679 24680 5dbb2e __dosmaperr 24678->24680 24679->24680 24681 5dbb1a 24679->24681 24680->24660 24689 5dbc7b 20 API calls __dosmaperr 24681->24689 24683 5dbb20 GetLastError 24683->24680 24684->24657 24685->24663 24687->24672 24688->24675 24689->24683 24691 5dbccc 24690->24691 24692 5dbc9c _unexpected 24690->24692 24700 5dbc7b 20 API calls __dosmaperr 24691->24700 24692->24691 24693 5dbcb7 RtlAllocateHeap 24692->24693 24699 5da2ec 7 API calls 2 library calls 24692->24699 24693->24692 24695 5dbcca 24693->24695 24695->24518 24697->24518 24698->24520 24699->24692 24700->24695 24701->24528 26755 5e1850 51 API calls 25400 5d0a46 25401 5d09f4 25400->25401 25403 5d0d3a 25401->25403 25429 5d0a98 25403->25429 25405 5d0d4a 25406 5d0da7 25405->25406 25414 5d0dcb 25405->25414 25407 5d0cd8 DloadReleaseSectionWriteAccess 6 API calls 25406->25407 25408 5d0db2 RaiseException 25407->25408 25424 5d0fa0 25408->25424 25409 5d0e43 LoadLibraryExA 25410 5d0ea4 25409->25410 25411 5d0e56 GetLastError 25409->25411 25412 5d0eaf FreeLibrary 25410->25412 25413 5d0eb6 25410->25413 25415 5d0e7f 25411->25415 25416 5d0e69 25411->25416 25412->25413 25417 5d0f14 GetProcAddress 25413->25417 25423 5d0f72 25413->25423 25414->25409 25414->25410 25414->25413 25414->25423 25419 5d0cd8 DloadReleaseSectionWriteAccess 6 API calls 25415->25419 25416->25410 25416->25415 25418 5d0f24 GetLastError 25417->25418 25417->25423 25420 5d0f37 25418->25420 25422 5d0e8a RaiseException 25419->25422 25420->25423 25425 5d0cd8 DloadReleaseSectionWriteAccess 6 API calls 25420->25425 25422->25424 25438 5d0cd8 25423->25438 25424->25401 25426 5d0f58 RaiseException 25425->25426 25427 5d0a98 ___delayLoadHelper2@8 6 API calls 25426->25427 25428 5d0f6f 25427->25428 25428->25423 25430 5d0aca 25429->25430 25431 5d0aa4 25429->25431 25430->25405 25446 5d0b41 25431->25446 25433 5d0aa9 25434 5d0ac5 25433->25434 25449 5d0c6a 25433->25449 25454 5d0acb GetModuleHandleW GetProcAddress GetProcAddress 25434->25454 25437 5d0d13 25437->25405 25439 5d0d0c 25438->25439 25440 5d0cea 25438->25440 25439->25424 25441 5d0b41 DloadReleaseSectionWriteAccess 3 API calls 25440->25441 25442 5d0cef 25441->25442 25443 5d0d07 25442->25443 25444 5d0c6a DloadProtectSection 3 API calls 25442->25444 25457 5d0d0e GetModuleHandleW GetProcAddress GetProcAddress DloadReleaseSectionWriteAccess 25443->25457 25444->25443 25455 5d0acb GetModuleHandleW GetProcAddress GetProcAddress 25446->25455 25448 5d0b46 25448->25433 25450 5d0c7f DloadProtectSection 25449->25450 25451 5d0cba VirtualProtect 25450->25451 25452 5d0c85 25450->25452 25456 5d0b80 VirtualQuery GetSystemInfo 25450->25456 25451->25452 25452->25434 25454->25437 25455->25448 25456->25451 25457->25439 26758 5d239f 9 API calls 2 library calls 25459 5dd240 25460 5dd24b 25459->25460 25461 5dd55a 11 API calls 25460->25461 25462 5dd274 25460->25462 25463 5dd270 25460->25463 25461->25460 25465 5dd2a0 DeleteCriticalSection 25462->25465 25465->25463 25466 5d067c 14 API calls ___delayLoadHelper2@8 26761 5d8870 QueryPerformanceFrequency QueryPerformanceCounter 25476 5b1075 25481 5c11a5 25476->25481 25478 5b107a 25485 5d1932 29 API calls 25478->25485 25480 5b1084 25482 5c11b1 __EH_prolog3 25481->25482 25486 5b4a2c 41 API calls 25482->25486 25484 5c11ca 25484->25478 25485->25480 25486->25484 26829 5e3665 21 API calls 2 library calls 26831 5d2610 RaiseException Concurrency::cancel_current_task _com_error::_com_error 26767 5dd808 27 API calls 3 library calls 26768 5cc000 28 API calls 26769 5b4c20 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 26836 5b2620 95 API calls CatchGuardHandler 26837 5dca20 21 API calls 2 library calls 26771 5b1025 29 API calls 24704 5cf6de 24722 5cea83 _wcslen _wcsrchr 24704->24722 24705 5cd5dd 6 API calls 24705->24722 24706 5cf717 24707 5d10f9 CatchGuardHandler 5 API calls 24706->24707 24708 5cf732 24707->24708 24709 5ced57 SetWindowTextW 24709->24722 24711 5bdd18 5 API calls 24711->24722 24713 5d66ae 22 API calls 24713->24722 24714 5cee02 RegOpenKeyExW 24714->24722 24715 5cee44 RegCloseKey 24715->24722 24717 5cf73c 24740 5d13f9 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent 24717->24740 24718 5ceb4b SetFileAttributesW 24721 5cec05 GetFileAttributesW 24718->24721 24734 5ceb65 __cftof _wcslen 24718->24734 24721->24722 24726 5cec17 DeleteFileW 24721->24726 24722->24705 24722->24706 24722->24709 24722->24711 24722->24713 24722->24714 24722->24715 24722->24717 24722->24718 24725 5cd41c 100 API calls 24722->24725 24730 5cef75 SendMessageW 24722->24730 24735 5cc5dd GetCurrentDirectoryW 24722->24735 24737 5bc3de 11 API calls 24722->24737 24738 5bc367 FindClose 24722->24738 24739 5cd76e 74 API calls 3 library calls 24722->24739 24723 5cf741 24727 5cef35 GetDlgItem SetWindowTextW SendMessageW 24725->24727 24726->24722 24728 5cec28 24726->24728 24727->24722 24729 5b4c00 _swprintf 51 API calls 24728->24729 24731 5cec48 GetFileAttributesW 24729->24731 24730->24722 24731->24728 24732 5cec5d MoveFileW 24731->24732 24732->24722 24733 5cec75 MoveFileExW 24732->24733 24733->24722 24734->24721 24734->24722 24736 5bd8ac 51 API calls 2 library calls 24734->24736 24735->24722 24736->24734 24737->24722 24738->24722 24739->24722 24740->24723 26838 5c82d0 135 API calls __InternalCxxFrameHandler 26776 5cd8c0 98 API calls 26842 5dcaf0 71 API calls _free 26777 5d1cf3 20 API calls 26843 5e2ef0 IsProcessorFeaturePresent 26779 5b24e0 26 API calls std::bad_exception::bad_exception 25492 5cdae0 25493 5cdaf2 25492->25493 25494 5b1366 66 API calls 25493->25494 25495 5cdb45 25494->25495 25496 5cdb5c 25495->25496 25497 5ce250 25495->25497 25577 5cdb76 25495->25577 25502 5cdb6d 25496->25502 25503 5cdbd0 25496->25503 25496->25577 25757 5cf9ee 25497->25757 25499 5d10f9 CatchGuardHandler 5 API calls 25501 5ce555 25499->25501 25507 5cdbad 25502->25507 25508 5cdb71 25502->25508 25506 5cdc63 GetDlgItemTextW 25503->25506 25512 5cdbe6 25503->25512 25504 5ce279 25510 5ce282 SendDlgItemMessageW 25504->25510 25511 5ce293 GetDlgItem SendMessageW 25504->25511 25505 5ce26b SendMessageW 25505->25504 25506->25507 25509 5cdca0 25506->25509 25515 5cdc94 EndDialog 25507->25515 25507->25577 25513 5c0597 51 API calls 25508->25513 25508->25577 25516 5cdcb5 GetDlgItem 25509->25516 25665 5cdca9 25509->25665 25510->25511 25776 5cc5dd GetCurrentDirectoryW 25511->25776 25517 5c0597 51 API calls 25512->25517 25518 5cdb90 25513->25518 25515->25577 25520 5cdcec SetFocus 25516->25520 25521 5cdcc9 SendMessageW SendMessageW 25516->25521 25522 5cdc03 SetDlgItemTextW 25517->25522 25798 5b1273 6 API calls CatchGuardHandler 25518->25798 25519 5ce2c3 GetDlgItem 25524 5ce2e6 SetWindowTextW 25519->25524 25525 5ce2e0 25519->25525 25526 5cdcfc 25520->25526 25537 5cdd08 25520->25537 25521->25520 25527 5cdc0e 25522->25527 25777 5ccb49 GetClassNameW 25524->25777 25525->25524 25528 5c0597 51 API calls 25526->25528 25531 5cdc1b GetMessageW 25527->25531 25527->25577 25532 5cdd06 25528->25532 25529 5ce196 25533 5c0597 51 API calls 25529->25533 25536 5cdc32 IsDialogMessageW 25531->25536 25531->25577 25667 5cf7fc 25532->25667 25539 5ce1a6 SetDlgItemTextW 25533->25539 25536->25527 25541 5cdc41 TranslateMessage DispatchMessageW 25536->25541 25544 5c0597 51 API calls 25537->25544 25538 5ce531 SetDlgItemTextW 25538->25577 25543 5ce1ba 25539->25543 25541->25527 25546 5c0597 51 API calls 25543->25546 25548 5cdd3f 25544->25548 25586 5ce1dd _wcslen 25546->25586 25547 5ce331 25552 5ce361 25547->25552 25557 5c0597 51 API calls 25547->25557 25553 5b4c00 _swprintf 51 API calls 25548->25553 25549 5cdd77 25550 5cdd96 25549->25550 25555 5bbccb 8 API calls 25549->25555 25687 5bbaf1 25550->25687 25551 5cea07 123 API calls 25551->25547 25562 5cea07 123 API calls 25552->25562 25571 5ce419 25552->25571 25553->25532 25559 5cdd8c 25555->25559 25561 5ce344 SetDlgItemTextW 25557->25561 25558 5ce4c0 25564 5ce4c9 EnableWindow 25558->25564 25565 5ce4d2 25558->25565 25559->25550 25563 5cdd90 25559->25563 25568 5c0597 51 API calls 25561->25568 25569 5ce37c 25562->25569 25799 5ccebf 9 API calls CatchGuardHandler 25563->25799 25564->25565 25573 5ce4ef 25565->25573 25808 5b1323 GetDlgItem EnableWindow 25565->25808 25566 5cddaf GetLastError 25567 5cddba 25566->25567 25698 5ccbb6 SetCurrentDirectoryW 25567->25698 25574 5ce358 SetDlgItemTextW 25568->25574 25570 5ce3b3 25569->25570 25578 5ce38e 25569->25578 25579 5ce40c 25570->25579 25614 5cea07 123 API calls 25570->25614 25571->25558 25598 5ce4a1 25571->25598 25609 5c0597 51 API calls 25571->25609 25581 5ce516 25573->25581 25592 5ce50e SendMessageW 25573->25592 25574->25552 25576 5c0597 51 API calls 25576->25577 25577->25499 25806 5cbe55 31 API calls CatchGuardHandler 25578->25806 25583 5cea07 123 API calls 25579->25583 25581->25577 25589 5c0597 51 API calls 25581->25589 25582 5cddce 25587 5cdde5 25582->25587 25588 5cddd7 GetLastError 25582->25588 25583->25571 25585 5ce4e5 25809 5b1323 GetDlgItem EnableWindow 25585->25809 25591 5c0597 51 API calls 25586->25591 25610 5ce22e 25586->25610 25593 5cddf5 GetTickCount 25587->25593 25594 5cde6b 25587->25594 25643 5cde5c 25587->25643 25588->25587 25595 5cdb97 25589->25595 25596 5ce211 25591->25596 25592->25581 25604 5b4c00 _swprintf 51 API calls 25593->25604 25599 5ce03c 25594->25599 25601 5cde84 GetModuleFileNameW 25594->25601 25602 5ce032 25594->25602 25595->25538 25595->25577 25606 5b4c00 _swprintf 51 API calls 25596->25606 25597 5ce097 25709 5b1341 GetDlgItem ShowWindow 25597->25709 25807 5cbe55 31 API calls CatchGuardHandler 25598->25807 25613 5c0597 51 API calls 25599->25613 25800 5c12bc 80 API calls 25601->25800 25602->25507 25602->25599 25608 5cde12 25604->25608 25605 5ce3a7 25605->25570 25606->25610 25607 5ce0a7 25710 5b1341 GetDlgItem ShowWindow 25607->25710 25699 5bb01e 25608->25699 25609->25571 25610->25576 25612 5ce4bd 25612->25558 25617 5ce046 25613->25617 25618 5ce3e1 25614->25618 25616 5cdeac 25620 5b4c00 _swprintf 51 API calls 25616->25620 25621 5b4c00 _swprintf 51 API calls 25617->25621 25618->25579 25622 5ce3ea DialogBoxParamW 25618->25622 25619 5ce0b1 25623 5c0597 51 API calls 25619->25623 25624 5cdece CreateFileMappingW 25620->25624 25626 5ce064 25621->25626 25622->25507 25622->25579 25627 5ce0bb SetDlgItemTextW 25623->25627 25629 5cdf2c GetCommandLineW 25624->25629 25659 5cdfa3 __InternalCxxFrameHandler 25624->25659 25638 5c0597 51 API calls 25626->25638 25711 5b1341 GetDlgItem ShowWindow 25627->25711 25632 5cdf3d 25629->25632 25630 5cdfae ShellExecuteExW 25658 5cdfc9 25630->25658 25801 5cd705 SHGetMalloc 25632->25801 25633 5cde4a 25636 5baf2f 78 API calls 25633->25636 25634 5cde3f GetLastError 25634->25633 25635 5ce0cd SetDlgItemTextW GetDlgItem 25639 5ce0ea GetWindowLongW SetWindowLongW 25635->25639 25640 5ce102 25635->25640 25636->25643 25642 5ce07e 25638->25642 25639->25640 25712 5cea07 25640->25712 25641 5cdf59 25802 5cd705 SHGetMalloc 25641->25802 25643->25594 25643->25597 25647 5cdf65 25803 5cd705 SHGetMalloc 25647->25803 25648 5ce00c 25648->25602 25655 5ce022 UnmapViewOfFile CloseHandle 25648->25655 25649 5cea07 123 API calls 25652 5ce11e 25649->25652 25651 5cdf71 25804 5c136b 80 API calls 25651->25804 25745 5cfdf7 25652->25745 25655->25602 25657 5cdf82 MapViewOfFile 25657->25659 25658->25648 25660 5cdff8 Sleep 25658->25660 25659->25630 25660->25648 25660->25658 25665->25507 25665->25529 25810 5cd864 PeekMessageW 25667->25810 25670 5cf86e SendMessageW SendMessageW 25671 5cf8cd SendMessageW SendMessageW SendMessageW 25670->25671 25672 5cf8ae 25670->25672 25674 5cf924 SendMessageW 25671->25674 25675 5cf901 SendMessageW 25671->25675 25672->25671 25673 5cf836 25676 5cf841 ShowWindow SendMessageW SendMessageW 25673->25676 25677 5d10f9 CatchGuardHandler 5 API calls 25674->25677 25675->25674 25676->25670 25678 5cdd62 25677->25678 25678->25549 25679 5cff24 25678->25679 25682 5cff36 25679->25682 25680 5cffc1 25681 5d10f9 CatchGuardHandler 5 API calls 25680->25681 25683 5cffd0 25681->25683 25682->25680 25684 5cff71 RegCreateKeyExW 25682->25684 25683->25549 25684->25680 25685 5cff98 _wcslen 25684->25685 25686 5cff9e RegSetValueExW RegCloseKey 25685->25686 25686->25680 25692 5bbafb 25687->25692 25688 5d10f9 CatchGuardHandler 5 API calls 25689 5bbbf0 25688->25689 25689->25566 25689->25567 25690 5bbba8 25691 5bbee1 13 API calls 25690->25691 25693 5bbbd0 25690->25693 25691->25693 25692->25690 25692->25693 25694 5bbbf9 25692->25694 25815 5bbee1 25692->25815 25693->25688 25830 5d13f9 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent 25694->25830 25697 5bbbfe 25698->25582 25700 5bb028 25699->25700 25701 5bb096 CreateFileW 25700->25701 25702 5bb08d 25700->25702 25701->25702 25703 5bb0dd 25702->25703 25704 5bda1e 6 API calls 25702->25704 25707 5d10f9 CatchGuardHandler 5 API calls 25703->25707 25705 5bb0c2 25704->25705 25705->25703 25706 5bb0c6 CreateFileW 25705->25706 25706->25703 25708 5bb111 25707->25708 25708->25633 25708->25634 25709->25607 25710->25619 25711->25635 25713 5cea19 25712->25713 25714 5cf717 25713->25714 25715 5cd5dd 6 API calls 25713->25715 25716 5d10f9 CatchGuardHandler 5 API calls 25714->25716 25729 5cea7c _wcslen _wcsrchr 25715->25729 25717 5ce110 25716->25717 25717->25649 25718 5cd5dd 6 API calls 25718->25729 25719 5ced57 SetWindowTextW 25719->25729 25721 5bdd18 5 API calls 25721->25729 25723 5d66ae 22 API calls 25723->25729 25724 5cee02 RegOpenKeyExW 25724->25729 25725 5cee44 RegCloseKey 25725->25729 25727 5cf73c 25846 5d13f9 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent 25727->25846 25728 5ceb4b SetFileAttributesW 25732 5cec05 GetFileAttributesW 25728->25732 25744 5ceb65 __cftof _wcslen 25728->25744 25729->25714 25729->25718 25729->25719 25729->25721 25729->25723 25729->25724 25729->25725 25729->25727 25729->25728 25735 5cd41c 100 API calls 25729->25735 25740 5cef75 SendMessageW 25729->25740 25841 5cc5dd GetCurrentDirectoryW 25729->25841 25843 5bc3de 11 API calls 25729->25843 25844 5bc367 FindClose 25729->25844 25845 5cd76e 74 API calls 3 library calls 25729->25845 25732->25729 25736 5cec17 DeleteFileW 25732->25736 25733 5cf741 25737 5cef35 GetDlgItem SetWindowTextW SendMessageW 25735->25737 25736->25729 25738 5cec28 25736->25738 25737->25729 25739 5b4c00 _swprintf 51 API calls 25738->25739 25741 5cec48 GetFileAttributesW 25739->25741 25740->25729 25741->25738 25742 5cec5d MoveFileW 25741->25742 25742->25729 25743 5cec75 MoveFileExW 25742->25743 25743->25729 25744->25729 25744->25732 25842 5bd8ac 51 API calls 2 library calls 25744->25842 25746 5cfe13 25745->25746 25847 5c26df 25746->25847 25748 5cfe59 25851 5b8ddf 25748->25851 25750 5cfeb7 25861 5b8ff5 25750->25861 25758 5cf9f8 25757->25758 25759 5cc556 4 API calls 25758->25759 25760 5cfa13 25759->25760 25761 5cfa1b GetWindow 25760->25761 25762 5cfae1 25760->25762 25761->25762 25766 5cfa34 25761->25766 25763 5d10f9 CatchGuardHandler 5 API calls 25762->25763 25764 5ce256 25763->25764 25764->25504 25764->25505 25765 5cfa41 GetClassNameW 25765->25766 25766->25762 25766->25765 25767 5cfac9 GetWindow 25766->25767 25768 5cfa65 GetWindowLongW 25766->25768 25767->25762 25767->25766 25768->25767 25769 5cfa75 SendMessageW 25768->25769 25769->25767 25770 5cfa8b GetObjectW 25769->25770 26452 5cc595 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 25770->26452 25772 5cfaa2 26453 5cc574 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 25772->26453 26454 5cc79c 13 API calls CatchGuardHandler 25772->26454 25775 5cfab3 SendMessageW DeleteObject 25775->25767 25776->25519 25778 5ccb99 25777->25778 25779 5ccb74 25777->25779 25780 5d10f9 CatchGuardHandler 5 API calls 25778->25780 25779->25778 25781 5ccb8b FindWindowExW 25779->25781 25782 5ccbb2 25780->25782 25781->25778 25783 5cd243 25782->25783 25784 5cd255 25783->25784 25785 5b147c 43 API calls 25784->25785 25786 5cd2af 25785->25786 26455 5b20eb 25786->26455 25789 5cd2c5 25792 5b16b8 84 API calls 25789->25792 25790 5cd2d1 26462 5b1b0e 25790->26462 25793 5cd2cd 25792->25793 25794 5d10f9 CatchGuardHandler 5 API calls 25793->25794 25795 5cd357 25794->25795 25795->25547 25795->25551 25796 5b16b8 84 API calls 25796->25793 25797 5cd2ed __InternalCxxFrameHandler ___std_exception_copy 25797->25796 25798->25595 25799->25550 25800->25616 25801->25641 25802->25647 25803->25651 25804->25657 25806->25605 25807->25612 25808->25585 25809->25573 25811 5cd87f GetMessageW 25810->25811 25812 5cd8b8 GetDlgItem 25810->25812 25813 5cd8a4 TranslateMessage DispatchMessageW 25811->25813 25814 5cd895 IsDialogMessageW 25811->25814 25812->25670 25812->25673 25813->25812 25814->25812 25814->25813 25816 5bbeee 25815->25816 25817 5bbf1c 25816->25817 25818 5bbf0f CreateDirectoryW 25816->25818 25819 5bbccb 8 API calls 25817->25819 25818->25817 25820 5bbf4f 25818->25820 25821 5bbf22 25819->25821 25822 5bbf5e 25820->25822 25831 5bc2e5 25820->25831 25823 5bbf62 GetLastError 25821->25823 25824 5bda1e 6 API calls 25821->25824 25827 5d10f9 CatchGuardHandler 5 API calls 25822->25827 25823->25822 25826 5bbf38 25824->25826 25826->25823 25828 5bbf3c CreateDirectoryW 25826->25828 25829 5bbf85 25827->25829 25828->25820 25828->25823 25829->25692 25830->25697 25832 5d1590 25831->25832 25833 5bc2f2 SetFileAttributesW 25832->25833 25834 5bc33f 25833->25834 25835 5bc314 25833->25835 25837 5d10f9 CatchGuardHandler 5 API calls 25834->25837 25836 5bda1e 6 API calls 25835->25836 25838 5bc326 25836->25838 25839 5bc34d 25837->25839 25838->25834 25840 5bc32a SetFileAttributesW 25838->25840 25839->25822 25840->25834 25841->25729 25842->25744 25843->25729 25844->25729 25845->25729 25846->25733 25848 5c26ec _wcslen 25847->25848 25880 5b1925 25848->25880 25850 5c2704 25850->25748 25852 5b8deb __EH_prolog3 25851->25852 25893 5bee0f 25852->25893 25854 5b8e0e 25855 5d121c 27 API calls 25854->25855 25856 5b8e52 __cftof 25855->25856 25857 5d121c 27 API calls 25856->25857 25858 5b8e7a 25857->25858 25899 5c6b0d 25858->25899 25860 5b8eac 25860->25750 25862 5b8fff 25861->25862 25863 5b9080 25862->25863 25929 5bc37a 25862->25929 25866 5b90e5 25863->25866 25906 5b96b9 25863->25906 25865 5b9127 25868 5d10f9 CatchGuardHandler 5 API calls 25865->25868 25866->25865 25935 5b1407 72 API calls CatchGuardHandler 25866->25935 25869 5b914e 25868->25869 25871 5b8ebb 25869->25871 26443 5bab26 8 API calls __cftof 25871->26443 25873 5b8ee6 25875 5b8ef7 Concurrency::cancel_current_task 25873->25875 26444 5c4396 25873->26444 25876 5b2179 26 API calls 25875->25876 25877 5b8f1e 25876->25877 26450 5beea4 84 API calls Concurrency::cancel_current_task 25877->26450 25882 5b1937 25880->25882 25888 5b198f 25880->25888 25881 5b1960 25883 5d66ae 22 API calls 25881->25883 25882->25881 25890 5b7bad 74 API calls 2 library calls 25882->25890 25886 5b1980 25883->25886 25885 5b1956 25891 5b7c32 73 API calls 25885->25891 25886->25888 25892 5b7c32 73 API calls 25886->25892 25888->25850 25890->25885 25891->25881 25892->25888 25894 5bee1b __EH_prolog3 25893->25894 25895 5d121c 27 API calls 25894->25895 25896 5bee59 25895->25896 25897 5d121c 27 API calls 25896->25897 25898 5bee7d 25897->25898 25898->25854 25900 5c6b19 __EH_prolog3 25899->25900 25901 5d121c 27 API calls 25900->25901 25902 5c6b33 25901->25902 25903 5c6b4a 25902->25903 25905 5c2f22 78 API calls 25902->25905 25903->25860 25905->25903 25907 5b96d4 25906->25907 25936 5b147c 25907->25936 25909 5b96fb 25910 5b970c 25909->25910 26099 5bb982 25909->26099 25914 5b9743 25910->25914 25946 5b1b63 25910->25946 25913 5b973f 25913->25914 25965 5b20a1 140 API calls __EH_prolog3 25913->25965 26091 5b16b8 25914->26091 25920 5b97e4 25966 5b988e 79 API calls 25920->25966 25922 5b976b 25922->25920 25928 5bc37a 12 API calls 25922->25928 25923 5b97fe 25924 5b9842 25923->25924 25967 5c3cf2 25923->25967 25924->25914 25970 5b441e 25924->25970 25982 5b9906 25924->25982 25928->25922 25930 5bc38f 25929->25930 25931 5bc3bd 25930->25931 26430 5bc4a8 25930->26430 25931->25862 25934 5bc3a4 FindClose 25934->25931 25935->25865 25937 5b1488 __EH_prolog3 25936->25937 25938 5bee0f 27 API calls 25937->25938 25939 5b14b7 25938->25939 25940 5b152b 25939->25940 25941 5d121c 27 API calls 25939->25941 26111 5bcc45 25940->26111 25943 5b1518 25941->25943 25943->25940 26103 5b668f 25943->26103 25945 5b15b3 __cftof 25945->25909 25947 5b1b6f __EH_prolog3 25946->25947 25959 5b1bbc 25947->25959 25961 5b1cef 25947->25961 26133 5b145d 25947->26133 25950 5b1d21 26136 5b1407 72 API calls CatchGuardHandler 25950->26136 25952 5b441e 114 API calls 25956 5b1d6c 25952->25956 25953 5b1d2e 25953->25952 25953->25961 25954 5b1db4 25958 5b1de7 25954->25958 25954->25961 26137 5b1407 72 API calls CatchGuardHandler 25954->26137 25956->25954 25957 5b441e 114 API calls 25956->25957 25957->25956 25958->25961 25964 5bb8c0 77 API calls 25958->25964 25959->25950 25959->25953 25959->25961 25960 5b441e 114 API calls 25962 5b1e38 25960->25962 25961->25913 25962->25960 25962->25961 25963 5bb8c0 77 API calls 25963->25959 25964->25962 25965->25922 25966->25923 26151 5d029f 25967->26151 25971 5b442a 25970->25971 25972 5b442e 25970->25972 25971->25924 25981 5bb8c0 77 API calls 25972->25981 25973 5b4440 25974 5b445b 25973->25974 25975 5b4469 25973->25975 25976 5b449b 25974->25976 26161 5b3ab7 102 API calls 3 library calls 25974->26161 26162 5b2fcb 114 API calls 3 library calls 25975->26162 25976->25924 25979 5b4467 25979->25976 26163 5b25f4 72 API calls 25979->26163 25981->25973 25983 5b9918 25982->25983 25987 5b997a 25983->25987 25995 5b9da2 Concurrency::cancel_current_task 25983->25995 26249 5cab94 115 API calls CatchGuardHandler 25983->26249 25985 5ba820 25988 5ba86c 25985->25988 25989 5ba825 25985->25989 25986 5d10f9 CatchGuardHandler 5 API calls 25990 5ba862 25986->25990 25987->25985 25993 5b999b 25987->25993 25987->25995 25988->25995 26290 5cab94 115 API calls CatchGuardHandler 25988->26290 25989->25995 26289 5b8c06 164 API calls 25989->26289 25990->25924 25993->25995 26164 5b6936 25993->26164 25995->25986 25996 5b9a71 26170 5bd63a 25996->26170 25998 5b9bba 25998->25995 26004 5b9ce2 25998->26004 26252 5b9582 38 API calls 25998->26252 26000 5b9aa4 26000->25998 26250 5bbf89 57 API calls 4 library calls 26000->26250 26006 5bc37a 12 API calls 26004->26006 26013 5b9d40 26004->26013 26005 5b9c24 26251 5d9ea8 26 API calls ___std_exception_copy 26005->26251 26006->26013 26008 5ba0ac 26261 5bf014 95 API calls 26008->26261 26011 5b9dd1 26032 5b9e33 26011->26032 26253 5b4916 27 API calls 2 library calls 26011->26253 26174 5b8f84 26013->26174 26016 5ba004 26017 5ba0c3 26016->26017 26022 5ba033 26016->26022 26019 5ba118 26017->26019 26038 5ba0ce 26017->26038 26026 5ba09b 26019->26026 26262 5b93ac 117 API calls CatchGuardHandler 26019->26262 26020 5ba174 26023 5ba7d9 26020->26023 26046 5ba1e2 26020->26046 26263 5bb288 26020->26263 26021 5ba116 26027 5baf2f 78 API calls 26021->26027 26022->26020 26022->26026 26028 5bbccb 8 API calls 26022->26028 26024 5baf2f 78 API calls 26023->26024 26024->25995 26026->26020 26026->26021 26027->25995 26029 5ba068 26028->26029 26029->26026 26260 5bac09 95 API calls 26029->26260 26032->25995 26033 5b9f71 26032->26033 26040 5b9f78 Concurrency::cancel_current_task 26032->26040 26254 5b8db7 41 API calls 26032->26254 26255 5bf014 95 API calls 26032->26255 26256 5b240a 72 API calls CatchGuardHandler 26032->26256 26257 5b953f 96 API calls 26032->26257 26258 5b240a 72 API calls CatchGuardHandler 26033->26258 26036 5ba231 26042 5bc94d 27 API calls 26036->26042 26038->26021 26180 5b9155 26038->26180 26040->26016 26259 5bbd61 50 API calls 3 library calls 26040->26259 26059 5ba247 26042->26059 26044 5ba1d0 26267 5b7e45 75 API calls 26044->26267 26218 5bc94d 26046->26218 26047 5ba37c 26050 5ba43c 26047->26050 26053 5ba394 26047->26053 26048 5ba511 26051 5ba523 26048->26051 26052 5ba537 26048->26052 26072 5ba3b5 26048->26072 26049 5ba31d 26049->26047 26049->26048 26058 5bd63a 5 API calls 26050->26058 26274 5bab81 26051->26274 26222 5c53f0 26052->26222 26055 5ba3db 26053->26055 26061 5ba3a3 26053->26061 26055->26072 26270 5b88a9 110 API calls 26055->26270 26057 5ba550 26234 5c5099 26057->26234 26065 5ba466 26058->26065 26059->26049 26060 5ba2f4 26059->26060 26067 5bb1e6 77 API calls 26059->26067 26060->26049 26268 5bb427 80 API calls 26060->26268 26269 5b240a 72 API calls CatchGuardHandler 26061->26269 26271 5b9582 38 API calls 26065->26271 26067->26060 26069 5ba502 26069->25924 26071 5ba47e 26071->26072 26073 5ba4ab 26071->26073 26074 5ba494 26071->26074 26072->26069 26078 5ba5c5 26072->26078 26285 5bc905 5 API calls CatchGuardHandler 26072->26285 26273 5ba8b9 101 API calls CatchGuardHandler 26073->26273 26272 5b85fc 84 API calls 26074->26272 26082 5ba656 26078->26082 26286 5b240a 72 API calls CatchGuardHandler 26078->26286 26079 5ba764 26079->26023 26080 5bc2e5 8 API calls 26079->26080 26083 5ba7bf 26080->26083 26081 5ba712 26244 5bb7e2 26081->26244 26082->26023 26082->26079 26082->26081 26243 5bb949 SetEndOfFile 26082->26243 26083->26023 26287 5b240a 72 API calls CatchGuardHandler 26083->26287 26086 5ba759 26087 5bafd0 75 API calls 26086->26087 26087->26079 26089 5ba7cf 26288 5b7d49 74 API calls CatchGuardHandler 26089->26288 26092 5b16ca 26091->26092 26094 5b16dc Concurrency::cancel_current_task 26091->26094 26092->26094 26424 5b1729 26092->26424 26095 5b2179 26 API calls 26094->26095 26096 5b170b 26095->26096 26427 5beea4 84 API calls Concurrency::cancel_current_task 26096->26427 26100 5bb999 26099->26100 26101 5bb9a3 26100->26101 26429 5b7c87 76 API calls 26100->26429 26101->25910 26104 5b669b __EH_prolog3 26103->26104 26119 5bd467 GetCurrentProcess GetProcessAffinityMask 26104->26119 26106 5b66a5 26107 5c11a5 41 API calls 26106->26107 26108 5b66fc 26107->26108 26120 5b68b3 GetCurrentProcess GetProcessAffinityMask 26108->26120 26110 5b6719 26110->25940 26112 5bcc65 __cftof 26111->26112 26121 5bcb21 26112->26121 26117 5d10f9 CatchGuardHandler 5 API calls 26118 5bcc95 26117->26118 26118->25945 26119->26106 26120->26110 26128 5bcb02 26121->26128 26123 5bcb96 26124 5b2179 26123->26124 26125 5b2193 26124->26125 26126 5b2184 26124->26126 26125->26117 26132 5b13db 26 API calls Concurrency::cancel_current_task 26126->26132 26129 5bcb10 26128->26129 26130 5bcb0b 26128->26130 26129->26123 26131 5b2179 26 API calls 26130->26131 26131->26129 26132->26125 26138 5b18b2 26133->26138 26136->25961 26137->25958 26139 5b18c4 26138->26139 26145 5b1476 26138->26145 26140 5b18ed 26139->26140 26148 5b7bad 74 API calls 2 library calls 26139->26148 26142 5d66ae 22 API calls 26140->26142 26146 5b190a 26142->26146 26143 5b18e3 26149 5b7c32 73 API calls 26143->26149 26145->25963 26146->26145 26150 5b7c32 73 API calls 26146->26150 26148->26143 26149->26140 26150->26145 26152 5d02ac 26151->26152 26153 5c0597 51 API calls 26152->26153 26154 5d02da 26153->26154 26155 5b4c00 _swprintf 51 API calls 26154->26155 26156 5d02ec 26155->26156 26157 5cf7fc 21 API calls 26156->26157 26158 5d02fd 26157->26158 26159 5d10f9 CatchGuardHandler 5 API calls 26158->26159 26160 5c3d08 26159->26160 26160->25924 26161->25979 26162->25979 26163->25976 26165 5b6946 26164->26165 26291 5b6852 26165->26291 26167 5b69b1 26167->25996 26169 5b6979 26169->26167 26296 5bd122 6 API calls 3 library calls 26169->26296 26173 5bd644 26170->26173 26171 5d10f9 CatchGuardHandler 5 API calls 26172 5bd7d8 26171->26172 26172->26000 26173->26171 26175 5b8f99 26174->26175 26176 5b8fd1 26175->26176 26307 5b7e25 72 API calls 26175->26307 26176->25995 26176->26008 26176->26011 26178 5b8fc9 26308 5b1407 72 API calls CatchGuardHandler 26178->26308 26181 5b915f 26180->26181 26182 5b9343 26181->26182 26184 5bbee1 13 API calls 26181->26184 26183 5d10f9 CatchGuardHandler 5 API calls 26182->26183 26186 5b9355 26183->26186 26185 5b91aa 26184->26185 26187 5bbccb 8 API calls 26185->26187 26206 5b92e7 26185->26206 26186->26021 26188 5b91b8 26187->26188 26189 5b9203 26188->26189 26190 5bbcdd 8 API calls 26188->26190 26191 5bbaf1 14 API calls 26189->26191 26195 5b91cb 26190->26195 26192 5b9216 26191->26192 26194 5bbee1 13 API calls 26192->26194 26198 5b9233 26194->26198 26196 5b9365 26195->26196 26327 5bac09 95 API calls 26195->26327 26199 5bc2e5 8 API calls 26196->26199 26196->26206 26200 5b935e 26198->26200 26198->26206 26328 5b1407 72 API calls CatchGuardHandler 26198->26328 26199->26206 26200->26196 26217 5b92df 26200->26217 26203 5b9392 26331 5b7d49 74 API calls CatchGuardHandler 26203->26331 26205 5b9254 26207 5bbccb 8 API calls 26205->26207 26206->26182 26309 5bc142 26206->26309 26208 5b926e 26207->26208 26209 5b9286 26208->26209 26211 5bbcdd 8 API calls 26208->26211 26210 5b92af 26209->26210 26329 5bbd61 50 API calls 3 library calls 26209->26329 26212 5bbaf1 14 API calls 26210->26212 26215 5b9278 26211->26215 26214 5b92c2 26212->26214 26216 5bbee1 13 API calls 26214->26216 26215->26196 26215->26209 26216->26217 26217->26206 26330 5b240a 72 API calls CatchGuardHandler 26217->26330 26219 5bc95b 26218->26219 26221 5bc965 26218->26221 26220 5d121c 27 API calls 26219->26220 26220->26221 26221->26036 26223 5c5405 26222->26223 26225 5c540f ___std_exception_copy 26222->26225 26332 5b7c32 73 API calls 26223->26332 26226 5c5495 26225->26226 26227 5c553f 26225->26227 26230 5c54b9 __cftof 26225->26230 26333 5c5323 130 API calls 3 library calls 26226->26333 26334 5d47d0 RaiseException 26227->26334 26230->26057 26232 5c556b 26233 5c559d 26232->26233 26335 5c517f 130 API calls 26232->26335 26233->26057 26235 5c50cb 26234->26235 26237 5c50a2 26234->26237 26242 5c50bf 26235->26242 26352 5c7576 135 API calls 2 library calls 26235->26352 26238 5c50c1 26237->26238 26239 5c50b7 26237->26239 26237->26242 26351 5c8250 130 API calls 26238->26351 26336 5c8c7e 26239->26336 26242->26072 26243->26081 26245 5bb7f3 26244->26245 26248 5bb802 26244->26248 26246 5bb7f9 FlushFileBuffers 26245->26246 26245->26248 26246->26248 26247 5bb87f SetFileTime 26247->26086 26248->26247 26249->25987 26250->26005 26251->25998 26252->26004 26253->26032 26254->26032 26255->26032 26256->26032 26257->26032 26258->26040 26259->26016 26260->26026 26261->26040 26262->26026 26264 5bb291 GetFileType 26263->26264 26265 5ba1ba 26263->26265 26264->26265 26265->26046 26266 5b240a 72 API calls CatchGuardHandler 26265->26266 26266->26044 26267->26046 26268->26049 26269->26072 26270->26072 26271->26071 26272->26072 26273->26072 26275 5bab8d __EH_prolog3 26274->26275 26420 5b8fdb 26275->26420 26278 5b145d 76 API calls 26279 5bab9b 26278->26279 26280 5bf0d7 130 API calls 26279->26280 26284 5babae 26280->26284 26281 5babf6 26281->26072 26283 5bf0d7 130 API calls 26283->26284 26284->26281 26284->26283 26423 5bf2c3 95 API calls __InternalCxxFrameHandler 26284->26423 26285->26078 26286->26082 26287->26089 26288->26023 26289->25995 26290->25995 26297 5b6731 26291->26297 26293 5b6873 26293->26169 26295 5b6731 6 API calls 26295->26293 26296->26169 26298 5b673b 26297->26298 26299 5bd63a 5 API calls 26298->26299 26305 5b6765 26299->26305 26300 5b6833 26301 5d10f9 CatchGuardHandler 5 API calls 26300->26301 26302 5b6845 26301->26302 26302->26293 26302->26295 26303 5bd63a 5 API calls 26303->26305 26305->26300 26305->26303 26306 5bd122 6 API calls 3 library calls 26305->26306 26306->26305 26307->26178 26308->26176 26310 5bc14c 26309->26310 26311 5bbcdd 8 API calls 26310->26311 26312 5bc1c2 26311->26312 26313 5bc1d7 CreateFileW 26312->26313 26315 5bc2e5 8 API calls 26312->26315 26316 5bc1fd 26313->26316 26322 5bc23f 26313->26322 26315->26313 26317 5bda1e 6 API calls 26316->26317 26318 5bc20d 26317->26318 26319 5bc2ca 26318->26319 26320 5bc215 CreateFileW 26318->26320 26324 5d10f9 CatchGuardHandler 5 API calls 26319->26324 26320->26319 26320->26322 26321 5bc27a SetFileTime CloseHandle 26321->26319 26323 5bc2c0 26321->26323 26322->26321 26325 5bc2e5 8 API calls 26323->26325 26326 5bc2dc 26324->26326 26325->26319 26326->26182 26327->26189 26328->26205 26329->26210 26330->26203 26331->26206 26332->26225 26333->26230 26334->26232 26335->26232 26353 5c5617 26336->26353 26339 5c90ae 26379 5c725b 96 API calls __InternalCxxFrameHandler 26339->26379 26341 5c90be __InternalCxxFrameHandler 26342 5d10f9 CatchGuardHandler 5 API calls 26341->26342 26343 5c9108 26342->26343 26343->26242 26344 5c8c9d __InternalCxxFrameHandler 26344->26339 26357 5bf0d7 26344->26357 26368 5c306d 26344->26368 26374 5c5e86 130 API calls 26344->26374 26375 5c9111 130 API calls 26344->26375 26376 5c32af 79 API calls 26344->26376 26377 5c5991 96 API calls __InternalCxxFrameHandler 26344->26377 26378 5c976f 135 API calls __InternalCxxFrameHandler 26344->26378 26351->26242 26352->26242 26355 5c5623 __EH_prolog3 __cftof ___std_exception_copy 26353->26355 26354 5c5709 26354->26344 26355->26354 26380 5b7c32 73 API calls 26355->26380 26366 5bf0ed __InternalCxxFrameHandler 26357->26366 26358 5bf25d 26359 5bf291 26358->26359 26381 5bf08e 26358->26381 26361 5bf2b2 26359->26361 26387 5b6c92 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 26359->26387 26388 5c2ee4 26361->26388 26365 5bf254 26365->26344 26366->26358 26366->26365 26385 5bca4c 89 API calls __EH_prolog3 26366->26385 26386 5cab94 115 API calls CatchGuardHandler 26366->26386 26369 5c307e 26368->26369 26370 5c3079 26368->26370 26372 5c308e 26369->26372 26412 5c32af 79 API calls 26369->26412 26404 5c3105 26370->26404 26372->26344 26374->26344 26375->26344 26376->26344 26377->26344 26378->26344 26379->26341 26380->26355 26382 5bf096 26381->26382 26383 5bf0d3 26381->26383 26382->26383 26394 5c3ca6 26382->26394 26383->26359 26385->26366 26386->26366 26387->26361 26389 5c2eeb 26388->26389 26390 5c2f06 26389->26390 26402 5b7ba8 RaiseException Concurrency::cancel_current_task 26389->26402 26392 5c2f17 SetThreadExecutionState 26390->26392 26403 5b7ba8 RaiseException Concurrency::cancel_current_task 26390->26403 26392->26365 26397 5d017f 26394->26397 26398 5c22ef 26397->26398 26399 5d0196 SendDlgItemMessageW 26398->26399 26400 5cd864 PeekMessageW GetMessageW IsDialogMessageW TranslateMessage DispatchMessageW 26399->26400 26401 5c3cc6 26400->26401 26401->26383 26402->26390 26403->26392 26405 5c317e 26404->26405 26409 5c3110 26404->26409 26405->26369 26406 5c3115 CreateThread 26406->26409 26416 5c3240 26406->26416 26407 5c316d SetThreadPriority 26407->26409 26409->26405 26409->26406 26409->26407 26413 5b7bad 74 API calls 2 library calls 26409->26413 26414 5b7d49 74 API calls CatchGuardHandler 26409->26414 26415 5b7ba8 RaiseException Concurrency::cancel_current_task 26409->26415 26412->26372 26413->26409 26414->26409 26415->26409 26419 5c324e 82 API calls 26416->26419 26418 5c3249 26419->26418 26421 5bd076 6 API calls 26420->26421 26422 5b8fe0 26421->26422 26422->26278 26423->26284 26428 5b2155 26 API calls Concurrency::cancel_current_task 26424->26428 26426 5b1737 26428->26426 26429->26101 26431 5bc4b2 26430->26431 26432 5bc548 FindNextFileW 26431->26432 26433 5bc4e5 FindFirstFileW 26431->26433 26435 5bc553 GetLastError 26432->26435 26436 5bc52d 26432->26436 26434 5bc4f2 26433->26434 26433->26436 26437 5bda1e 6 API calls 26434->26437 26435->26436 26441 5d10f9 CatchGuardHandler 5 API calls 26436->26441 26438 5bc505 26437->26438 26439 5bc509 FindFirstFileW 26438->26439 26440 5bc522 GetLastError 26438->26440 26439->26436 26439->26440 26440->26436 26442 5bc39f 26441->26442 26442->25931 26442->25934 26443->25873 26445 5c43a0 26444->26445 26446 5c43b9 26445->26446 26449 5c43cd 26445->26449 26451 5c2fc9 84 API calls 26446->26451 26448 5c43c0 Concurrency::cancel_current_task 26448->26449 26451->26448 26452->25772 26453->25772 26454->25775 26456 5bb982 76 API calls 26455->26456 26457 5b20f7 26456->26457 26458 5b1b63 114 API calls 26457->26458 26461 5b2114 26457->26461 26459 5b2104 26458->26459 26459->26461 26466 5b1407 72 API calls CatchGuardHandler 26459->26466 26461->25789 26461->25790 26463 5b1b1a 26462->26463 26464 5b1b1e 26462->26464 26463->25797 26467 5b1a55 26464->26467 26466->26461 26468 5b1a67 26467->26468 26469 5b1aa4 26467->26469 26470 5b441e 114 API calls 26468->26470 26475 5b48bd 26469->26475 26471 5b1a87 26470->26471 26471->26463 26479 5b48c6 26475->26479 26476 5b441e 114 API calls 26476->26479 26477 5b1ac5 26477->26471 26480 5b1fb0 26477->26480 26478 5c2ee4 2 API calls 26478->26479 26479->26476 26479->26477 26479->26478 26481 5b1fbc __EH_prolog3 26480->26481 26492 5b44ab 26481->26492 26484 5b18b2 76 API calls 26485 5b1ff0 26484->26485 26524 5b199b 76 API calls 26485->26524 26487 5b2060 26487->26471 26488 5b2008 26490 5b2014 _wcslen 26488->26490 26525 5c3d10 MultiByteToWideChar 26488->26525 26526 5b199b 76 API calls 26490->26526 26493 5b44c6 26492->26493 26494 5b4510 26493->26494 26495 5b44f4 26493->26495 26497 5b476a 26494->26497 26500 5b453c 26494->26500 26527 5b1407 72 API calls CatchGuardHandler 26495->26527 26533 5b1407 72 API calls CatchGuardHandler 26497->26533 26499 5b44ff 26501 5d10f9 CatchGuardHandler 5 API calls 26499->26501 26500->26499 26503 5c53f0 130 API calls 26500->26503 26502 5b1fdf 26501->26502 26502->26484 26502->26487 26508 5b4589 26503->26508 26504 5b45bb 26506 5b4646 26504->26506 26523 5b45b2 26504->26523 26530 5bf014 95 API calls 26504->26530 26505 5b45b7 26505->26504 26529 5b25da 76 API calls 26505->26529 26507 5bc94d 27 API calls 26506->26507 26511 5b4659 26507->26511 26508->26504 26508->26505 26509 5b45a7 26508->26509 26528 5b1407 72 API calls CatchGuardHandler 26509->26528 26515 5b46f2 26511->26515 26516 5b46e2 26511->26516 26513 5c4396 84 API calls 26513->26499 26518 5c5099 135 API calls 26515->26518 26517 5bab81 135 API calls 26516->26517 26519 5b46f0 26517->26519 26518->26519 26531 5bc905 5 API calls CatchGuardHandler 26519->26531 26521 5b472a 26521->26523 26532 5b240a 72 API calls CatchGuardHandler 26521->26532 26523->26513 26524->26488 26525->26490 26526->26487 26527->26499 26528->26523 26529->26504 26530->26506 26531->26521 26532->26523 26533->26499 26780 5b1890 84 API calls Concurrency::cancel_current_task 26782 5b1095 44 API calls 26847 5de680 GetProcessHeap 26699 5bd4bd 26700 5bd4cf __cftof 26699->26700 26703 5c31c2 26700->26703 26706 5c3184 GetCurrentProcess GetProcessAffinityMask 26703->26706 26707 5bd526 26706->26707 26848 5daaba 55 API calls _free 26710 5dbab0 26718 5dd3ff 26710->26718 26714 5dbacc 26715 5dbad9 26714->26715 26726 5dbae0 11 API calls 26714->26726 26717 5dbac4 26719 5dd2e8 _unexpected 5 API calls 26718->26719 26720 5dd426 26719->26720 26721 5dd42f 26720->26721 26722 5dd43e TlsAlloc 26720->26722 26723 5d10f9 CatchGuardHandler 5 API calls 26721->26723 26722->26721 26724 5dbaba 26723->26724 26724->26717 26725 5dba29 20 API calls 2 library calls 26724->26725 26725->26714 26726->26717 26727 5b10b5 26728 5b668f 43 API calls 26727->26728 26729 5b10ba 26728->26729 26732 5d1932 29 API calls 26729->26732 26731 5b10c4 26732->26731 26786 5d00b3 DialogBoxParamW 26738 5d10a8 26739 5d10b2 26738->26739 26740 5d0d3a ___delayLoadHelper2@8 14 API calls 26739->26740 26741 5d10bf 26740->26741 26745 5de6a1 31 API calls CatchGuardHandler 26789 5cb4a0 ShowWindow SetWindowTextW GlobalAlloc WideCharToMultiByte 26792 5cf950 70 API calls 26793 5db150 7 API calls ___scrt_uninitialize_crt 26794 5d1d50 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter ___security_init_cookie 26795 5dcd50 21 API calls 26797 5c3d49 7 API calls CatchGuardHandler 26853 5c9740 130 API calls 26855 5cea83 133 API calls 5 library calls 26856 5b6b70 41 API calls __EH_prolog3 26802 5ce560 89 API calls 2 library calls 26857 5cd361 76 API calls 26858 5d531b 38 API calls 4 library calls 26543 5d030b 26544 5d0318 26543->26544 26545 5c0597 51 API calls 26544->26545 26546 5d0333 26545->26546 26547 5b4c00 _swprintf 51 API calls 26546->26547 26548 5d0346 SetDlgItemTextW 26547->26548 26549 5cd864 5 API calls 26548->26549 26550 5d0363 26549->26550 26551 5d10f9 CatchGuardHandler 5 API calls 26550->26551 26552 5d0378 26551->26552 26806 5d1d07 29 API calls _abort 26809 5d0900 14 API calls ___delayLoadHelper2@8 26861 5d1b00 46 API calls __RTC_Initialize 26812 5de530 GetCommandLineA GetCommandLineW 26735 5d092f 26736 5d0d3a ___delayLoadHelper2@8 14 API calls 26735->26736 26737 5d093c 26736->26737 26865 5d4f20 6 API calls 4 library calls 26867 5cc3d0 GdipCloneImage GdipAlloc 26868 5cb3d0 6 API calls CatchGuardHandler 24746 5d1bd2 24747 5d1bde ___scrt_is_nonwritable_in_current_image 24746->24747 24778 5d176c 24747->24778 24749 5d1be5 24750 5d1d38 24749->24750 24753 5d1c0f 24749->24753 24857 5d1fca 4 API calls 2 library calls 24750->24857 24752 5d1d3f 24850 5da7aa 24752->24850 24762 5d1c4e ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 24753->24762 24789 5db34d 24753->24789 24760 5d1c2e 24768 5d1caf 24762->24768 24853 5da29c 38 API calls 2 library calls 24762->24853 24764 5d1cb5 24798 5db29e 51 API calls 24764->24798 24767 5d1cbd 24799 5d037c 24767->24799 24797 5d20e5 GetStartupInfoW __cftof 24768->24797 24772 5d1cd1 24772->24752 24773 5d1cd5 24772->24773 24774 5d1cde 24773->24774 24855 5da74d 28 API calls _abort 24773->24855 24856 5d18dd 12 API calls ___scrt_uninitialize_crt 24774->24856 24777 5d1ce6 24777->24760 24779 5d1775 24778->24779 24859 5d1de6 IsProcessorFeaturePresent 24779->24859 24781 5d1781 24860 5d507e 24781->24860 24783 5d1786 24784 5d178a 24783->24784 24868 5db1d7 24783->24868 24784->24749 24787 5d17a1 24787->24749 24790 5db364 24789->24790 24791 5d10f9 CatchGuardHandler 5 API calls 24790->24791 24792 5d1c28 24791->24792 24792->24760 24793 5db2f1 24792->24793 24794 5db320 24793->24794 24795 5d10f9 CatchGuardHandler 5 API calls 24794->24795 24796 5db349 24795->24796 24796->24762 24797->24764 24798->24767 24980 5c290a 24799->24980 24803 5d03aa 25036 5cccd9 24803->25036 24805 5d03b3 __cftof 24806 5d03c6 GetCommandLineW 24805->24806 24807 5d03d9 24806->24807 24808 5d046a GetModuleFileNameW SetEnvironmentVariableW GetLocalTime 24806->24808 25040 5ce872 24807->25040 24810 5b4c00 _swprintf 51 API calls 24808->24810 24812 5d04e6 SetEnvironmentVariableW GetModuleHandleW LoadIconW 24810->24812 25055 5cd9dd LoadBitmapW 24812->25055 24814 5d0464 25047 5cffdd 24814->25047 24815 5d03e7 OpenFileMappingW 24818 5d03ff MapViewOfFile 24815->24818 24819 5d045b CloseHandle 24815->24819 24821 5d0454 UnmapViewOfFile 24818->24821 24822 5d0410 __InternalCxxFrameHandler 24818->24822 24819->24808 24821->24819 24825 5cffdd 7 API calls 24822->24825 24827 5d042c 24825->24827 25085 5c136b 80 API calls 24827->25085 24828 5cafe6 27 API calls 24830 5d0546 DialogBoxParamW 24828->24830 24834 5d0580 24830->24834 24831 5d0440 25086 5c1421 80 API calls _wcslen 24831->25086 24833 5d044b 24833->24821 24835 5d0599 24834->24835 24836 5d0592 Sleep 24834->24836 24838 5d05a7 24835->24838 25087 5ccf89 7 API calls 3 library calls 24835->25087 24836->24835 24839 5d05c6 DeleteObject 24838->24839 24840 5d05db DeleteObject 24839->24840 24841 5d05e2 24839->24841 24840->24841 24842 5d0625 24841->24842 24843 5d0613 24841->24843 25082 5ccd3f 24842->25082 25088 5d004d 6 API calls 24843->25088 24846 5d0619 CloseHandle 24846->24842 24847 5d065f 24848 5d10f9 CatchGuardHandler 5 API calls 24847->24848 24849 5d0673 24848->24849 24854 5d211b GetModuleHandleW 24849->24854 25342 5da527 24850->25342 24853->24768 24854->24772 24855->24774 24856->24777 24857->24752 24859->24781 24872 5d6127 24860->24872 24863 5d5087 24863->24783 24865 5d508f 24866 5d509a 24865->24866 24886 5d6163 DeleteCriticalSection 24865->24886 24866->24783 24913 5de6aa 24868->24913 24871 5d509d 7 API calls 2 library calls 24871->24784 24874 5d6130 24872->24874 24875 5d6159 24874->24875 24876 5d5083 24874->24876 24887 5d636c 24874->24887 24892 5d6163 DeleteCriticalSection 24875->24892 24876->24863 24878 5d51ac 24876->24878 24906 5d627d 24878->24906 24882 5d51cf 24883 5d51dc 24882->24883 24912 5d51df 6 API calls ___vcrt_FlsFree 24882->24912 24883->24865 24885 5d51c1 24885->24865 24886->24863 24893 5d6192 24887->24893 24890 5d63a4 InitializeCriticalSectionAndSpinCount 24891 5d638f 24890->24891 24891->24874 24892->24876 24894 5d61b3 24893->24894 24895 5d61af 24893->24895 24894->24895 24896 5d621b GetProcAddress 24894->24896 24899 5d620c 24894->24899 24901 5d6232 LoadLibraryExW 24894->24901 24895->24890 24895->24891 24896->24895 24898 5d6229 24896->24898 24898->24895 24899->24896 24900 5d6214 FreeLibrary 24899->24900 24900->24896 24902 5d6249 GetLastError 24901->24902 24903 5d6279 24901->24903 24902->24903 24904 5d6254 ___vcrt_FlsFree 24902->24904 24903->24894 24904->24903 24905 5d626a LoadLibraryExW 24904->24905 24905->24894 24907 5d6192 ___vcrt_FlsFree 5 API calls 24906->24907 24908 5d6297 24907->24908 24909 5d62b0 TlsAlloc 24908->24909 24910 5d51b6 24908->24910 24910->24885 24911 5d632e 6 API calls ___vcrt_FlsFree 24910->24911 24911->24882 24912->24885 24914 5de6c7 24913->24914 24917 5de6c3 24913->24917 24914->24917 24919 5dccf0 24914->24919 24915 5d10f9 CatchGuardHandler 5 API calls 24916 5d1793 24915->24916 24916->24787 24916->24871 24917->24915 24920 5dccfc ___scrt_is_nonwritable_in_current_image 24919->24920 24931 5dd281 EnterCriticalSection 24920->24931 24922 5dcd03 24932 5deb78 24922->24932 24924 5dcd12 24930 5dcd21 24924->24930 24945 5dcb79 29 API calls 24924->24945 24927 5dcd32 _abort 24927->24914 24928 5dcd1c 24946 5dcc2f GetStdHandle GetFileType 24928->24946 24947 5dcd3d LeaveCriticalSection _abort 24930->24947 24931->24922 24933 5deb84 ___scrt_is_nonwritable_in_current_image 24932->24933 24934 5deba8 24933->24934 24935 5deb91 24933->24935 24948 5dd281 EnterCriticalSection 24934->24948 24956 5dbc7b 20 API calls __dosmaperr 24935->24956 24938 5deb96 24957 5d6649 26 API calls ___std_exception_copy 24938->24957 24940 5deba0 _abort 24940->24924 24941 5debe0 24958 5dec07 LeaveCriticalSection _abort 24941->24958 24943 5debb4 24943->24941 24949 5deac9 24943->24949 24945->24928 24946->24930 24947->24927 24948->24943 24950 5dd786 _unexpected 20 API calls 24949->24950 24955 5deadb 24950->24955 24951 5deae8 24952 5dbafa _free 20 API calls 24951->24952 24953 5deb3a 24952->24953 24953->24943 24955->24951 24959 5dd55a 24955->24959 24956->24938 24957->24940 24958->24940 24966 5dd2e8 24959->24966 24962 5dd59f InitializeCriticalSectionAndSpinCount 24963 5dd58a 24962->24963 24964 5d10f9 CatchGuardHandler 5 API calls 24963->24964 24965 5dd5b6 24964->24965 24965->24955 24967 5dd318 24966->24967 24971 5dd314 24966->24971 24967->24962 24967->24963 24968 5dd338 24968->24967 24970 5dd344 GetProcAddress 24968->24970 24972 5dd354 _unexpected 24970->24972 24971->24967 24971->24968 24973 5dd384 24971->24973 24972->24967 24974 5dd3a5 LoadLibraryExW 24973->24974 24978 5dd39a 24973->24978 24975 5dd3da 24974->24975 24976 5dd3c2 GetLastError 24974->24976 24975->24978 24979 5dd3f1 FreeLibrary 24975->24979 24976->24975 24977 5dd3cd LoadLibraryExW 24976->24977 24977->24975 24978->24971 24979->24978 24981 5d1590 24980->24981 24982 5c2914 GetModuleHandleW 24981->24982 24983 5c2999 24982->24983 24984 5c2943 GetProcAddress 24982->24984 24985 5c2cda 24983->24985 25103 5d9e7e 42 API calls __vsnwprintf_l 24983->25103 24986 5c296d GetProcAddress 24984->24986 24987 5c2955 24984->24987 24989 5c2cdc GetModuleFileNameW 24985->24989 24986->24983 24988 5c297f 24986->24988 24987->24986 24988->24983 25005 5c2cfa 24989->25005 24991 5c2c06 24991->24989 24992 5c2c13 GetModuleFileNameW CreateFileW 24991->24992 24993 5c2ccc CloseHandle 24992->24993 24994 5c2c47 SetFilePointer 24992->24994 24993->24989 24994->24993 24995 5c2c55 ReadFile 24994->24995 24995->24993 24996 5c2c73 24995->24996 24997 5c2ede 24996->24997 25002 5c2c85 24996->25002 25110 5d13f9 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent 24997->25110 25000 5c2ee3 25002->24993 25004 5c28ab 7 API calls 25002->25004 25003 5c2d5c GetFileAttributesW 25003->25005 25006 5c2d74 25003->25006 25004->25002 25005->25003 25005->25006 25089 5bd076 25005->25089 25094 5c28ab 25005->25094 25007 5c2d7f 25006->25007 25008 5c2db4 25006->25008 25013 5c2d98 GetFileAttributesW 25007->25013 25014 5c2db0 25007->25014 25009 5c2dbc 25008->25009 25010 5c2ec3 25008->25010 25015 5bd076 6 API calls 25009->25015 25011 5d10f9 CatchGuardHandler 5 API calls 25010->25011 25012 5c2ed5 25011->25012 25035 5cc5dd GetCurrentDirectoryW 25012->25035 25013->25007 25013->25014 25014->25008 25016 5c2dce 25015->25016 25017 5c2e3b 25016->25017 25018 5c2dd5 25016->25018 25019 5b4c00 _swprintf 51 API calls 25017->25019 25020 5c28ab 7 API calls 25018->25020 25021 5c2e63 AllocConsole 25019->25021 25022 5c2ddf 25020->25022 25023 5c2ebb ExitProcess 25021->25023 25024 5c2e70 GetCurrentProcessId AttachConsole 25021->25024 25025 5c28ab 7 API calls 25022->25025 25108 5d6433 25024->25108 25027 5c2de9 25025->25027 25104 5c0597 25027->25104 25029 5c2e91 GetStdHandle WriteConsoleW Sleep FreeConsole 25029->25023 25031 5b4c00 _swprintf 51 API calls 25032 5c2e17 25031->25032 25033 5c0597 51 API calls 25032->25033 25034 5c2e26 25033->25034 25034->25023 25035->24803 25037 5c28ab 7 API calls 25036->25037 25038 5ccced OleInitialize 25037->25038 25039 5ccd10 GdiplusStartup SHGetMalloc 25038->25039 25039->24805 25046 5ce87c 25040->25046 25041 5ce9a0 25042 5d10f9 CatchGuardHandler 5 API calls 25041->25042 25043 5ce9b1 25042->25043 25043->24814 25043->24815 25044 5c4159 CharUpperW 25044->25046 25046->25041 25046->25044 25133 5c1421 80 API calls _wcslen 25046->25133 25048 5d1590 25047->25048 25049 5cffea SetEnvironmentVariableW 25048->25049 25051 5d0016 25049->25051 25050 5d003e 25052 5d10f9 CatchGuardHandler 5 API calls 25050->25052 25051->25050 25054 5d0032 SetEnvironmentVariableW 25051->25054 25053 5d0049 25052->25053 25053->24808 25054->25050 25056 5cd9fe 25055->25056 25057 5cda0b GetObjectW 25055->25057 25139 5cc652 FindResourceW 25056->25139 25062 5cda1a 25057->25062 25134 5cc556 25062->25134 25063 5cda70 25074 5bf93e 25063->25074 25064 5cda4c 25153 5cc595 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 25064->25153 25065 5cc652 12 API calls 25067 5cda3d 25065->25067 25067->25064 25069 5cda43 DeleteObject 25067->25069 25068 5cda54 25154 5cc574 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 25068->25154 25069->25064 25071 5cda5d 25155 5cc79c 13 API calls CatchGuardHandler 25071->25155 25073 5cda64 DeleteObject 25073->25063 25166 5bf963 25074->25166 25079 5cafe6 25325 5d121c 25079->25325 25081 5cb005 25081->24828 25083 5ccd78 GdiplusShutdown CoUninitialize 25082->25083 25083->24847 25085->24831 25086->24833 25087->24838 25088->24846 25090 5bd09c GetVersionExW 25089->25090 25091 5bd0c9 25089->25091 25090->25091 25092 5d10f9 CatchGuardHandler 5 API calls 25091->25092 25093 5bd0f2 25092->25093 25093->25005 25095 5d1590 25094->25095 25096 5c28b8 GetSystemDirectoryW 25095->25096 25097 5c28de 25096->25097 25098 5c28fa 25096->25098 25100 5bdd18 5 API calls 25097->25100 25099 5d10f9 CatchGuardHandler 5 API calls 25098->25099 25101 5c2906 25099->25101 25102 5c28ed LoadLibraryW 25100->25102 25101->25005 25102->25098 25103->24991 25105 5c05a7 25104->25105 25111 5c05c8 25105->25111 25109 5d643b 25108->25109 25109->25029 25109->25109 25110->25000 25114 5bf892 25111->25114 25121 5bf7b8 25114->25121 25117 5bf8d3 25119 5d10f9 CatchGuardHandler 5 API calls 25117->25119 25118 5bf8ec 26 API calls 25118->25117 25120 5bf8e8 25119->25120 25120->25031 25122 5bf7e1 25121->25122 25123 5bf85d _strncpy 25121->25123 25124 5c3f47 WideCharToMultiByte 25122->25124 25127 5bf801 25122->25127 25125 5d10f9 CatchGuardHandler 5 API calls 25123->25125 25124->25127 25126 5bf88b 25125->25126 25126->25117 25126->25118 25130 5bf832 25127->25130 25131 5c0531 50 API calls __vsnprintf 25127->25131 25132 5d8a01 26 API calls 3 library calls 25130->25132 25131->25130 25132->25123 25133->25046 25156 5cc574 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 25134->25156 25136 5cc55d 25137 5cc569 25136->25137 25157 5cc595 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 25136->25157 25137->25063 25137->25064 25137->25065 25140 5cc763 25139->25140 25141 5cc675 SizeofResource 25139->25141 25140->25057 25140->25062 25141->25140 25142 5cc68c LoadResource 25141->25142 25142->25140 25143 5cc6a1 LockResource 25142->25143 25143->25140 25144 5cc6b2 GlobalAlloc 25143->25144 25144->25140 25145 5cc6cd GlobalLock 25144->25145 25146 5cc75c GlobalFree 25145->25146 25147 5cc6dc __InternalCxxFrameHandler 25145->25147 25146->25140 25148 5cc755 GlobalUnlock 25147->25148 25158 5cc5b6 GdipAlloc 25147->25158 25148->25146 25151 5cc72a GdipCreateHBITMAPFromBitmap 25152 5cc740 25151->25152 25152->25148 25153->25068 25154->25071 25155->25073 25156->25136 25157->25137 25159 5cc5c8 25158->25159 25160 5cc5d5 25158->25160 25162 5cc34d 25159->25162 25160->25148 25160->25151 25160->25152 25163 5cc36e GdipCreateBitmapFromStreamICM 25162->25163 25164 5cc375 GdipCreateBitmapFromStream 25162->25164 25165 5cc37a 25163->25165 25164->25165 25165->25160 25167 5bf975 25166->25167 25168 5bf9cb GetModuleFileNameW 25167->25168 25169 5bf9f8 25167->25169 25170 5bf9df 25168->25170 25220 5bb2b0 25169->25220 25170->25169 25172 5bfa47 25233 5d8bc0 25172->25233 25176 5bfa5a 25180 5d8bc0 26 API calls 25176->25180 25177 5bfa1b 25177->25172 25181 5c01bd 76 API calls 25177->25181 25193 5bfc4f 25177->25193 25178 5d10f9 CatchGuardHandler 5 API calls 25179 5bf94a 25178->25179 25218 5c01fa GetModuleHandleW FindResourceW 25179->25218 25189 5bfa6c ___vcrt_FlsFree 25180->25189 25181->25177 25182 5bfb92 25182->25193 25256 5bb7b0 25182->25256 25185 5bb610 80 API calls 25185->25189 25186 5bfba9 ___std_exception_copy 25186->25193 25261 5bb610 25186->25261 25188 5bb7b0 79 API calls 25188->25189 25189->25182 25189->25185 25189->25188 25189->25193 25247 5bb8c0 25189->25247 25190 5bfbcf ___std_exception_copy 25192 5bfbda _wcslen ___std_exception_copy ___vcrt_FlsFree 25190->25192 25190->25193 25273 5c3d10 MultiByteToWideChar 25190->25273 25192->25193 25195 5bffed 25192->25195 25196 5bfd76 25192->25196 25211 5c3f47 WideCharToMultiByte 25192->25211 25213 5c01b7 25192->25213 25274 5c0531 50 API calls __vsnprintf 25192->25274 25275 5d8a01 26 API calls 3 library calls 25192->25275 25266 5baf2f 25193->25266 25195->25196 25276 5db52e 26 API calls ___std_exception_copy 25195->25276 25205 5c0126 25196->25205 25279 5db52e 26 API calls ___std_exception_copy 25196->25279 25198 5c015c 25202 5d8bc0 26 API calls 25198->25202 25200 5c010e 25281 5c01d8 76 API calls 25200->25281 25201 5c01bd 76 API calls 25201->25205 25206 5c0175 25202->25206 25203 5c00b6 25280 5d9ea8 26 API calls ___std_exception_copy 25203->25280 25205->25198 25205->25201 25207 5d8bc0 26 API calls 25206->25207 25207->25193 25209 5c000c 25277 5d9ea8 26 API calls ___std_exception_copy 25209->25277 25210 5c0064 25278 5c01d8 76 API calls 25210->25278 25211->25192 25282 5d13f9 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent 25213->25282 25215 5c01bc 25219 5bf951 25218->25219 25219->25079 25221 5bb2ba 25220->25221 25222 5bb334 CreateFileW 25221->25222 25223 5bb34f GetLastError 25222->25223 25227 5bb39b 25222->25227 25224 5bda1e 6 API calls 25223->25224 25225 5bb36c 25224->25225 25226 5bb370 CreateFileW GetLastError 25225->25226 25225->25227 25226->25227 25229 5bb395 25226->25229 25228 5bb3df 25227->25228 25230 5bb3c5 SetFileTime 25227->25230 25231 5d10f9 CatchGuardHandler 5 API calls 25228->25231 25229->25227 25230->25228 25232 5bb41e 25231->25232 25232->25177 25234 5d8bf9 25233->25234 25235 5d8bfd 25234->25235 25246 5d8c25 25234->25246 25283 5dbc7b 20 API calls __dosmaperr 25235->25283 25237 5d8f49 25240 5d10f9 CatchGuardHandler 5 API calls 25237->25240 25238 5d8c02 25284 5d6649 26 API calls ___std_exception_copy 25238->25284 25241 5d8f56 25240->25241 25241->25176 25242 5d8c0d 25243 5d10f9 CatchGuardHandler 5 API calls 25242->25243 25245 5d8c19 25243->25245 25245->25176 25246->25237 25285 5d8ae0 5 API calls CatchGuardHandler 25246->25285 25248 5bb8d2 25247->25248 25249 5bb8e5 25247->25249 25250 5bb8f0 25248->25250 25286 5b7cd8 75 API calls 25248->25286 25249->25250 25252 5bb8f8 SetFilePointer 25249->25252 25250->25189 25252->25250 25253 5bb914 GetLastError 25252->25253 25253->25250 25254 5bb91e 25253->25254 25254->25250 25287 5b7cd8 75 API calls 25254->25287 25288 5bb45f 25256->25288 25259 5bb7db 25259->25186 25262 5bb61c 25261->25262 25264 5bb623 25261->25264 25262->25190 25264->25262 25265 5bb151 GetStdHandle ReadFile GetLastError GetLastError GetFileType 25264->25265 25302 5b7c95 75 API calls 25264->25302 25265->25264 25267 5baf5d 25266->25267 25268 5baf6e 25266->25268 25267->25268 25269 5baf69 25267->25269 25270 5baf70 25267->25270 25268->25178 25303 5bb11a 25269->25303 25308 5bafd0 25270->25308 25273->25192 25274->25192 25275->25192 25276->25209 25277->25210 25278->25196 25279->25203 25280->25200 25281->25205 25282->25215 25283->25238 25284->25242 25285->25246 25286->25249 25287->25250 25293 5bb469 25288->25293 25289 5d10f9 CatchGuardHandler 5 API calls 25291 5bb50b 25289->25291 25290 5bb5dd SetFilePointer 25292 5bb5fa GetLastError 25290->25292 25295 5bb48d 25290->25295 25291->25259 25297 5b7cd8 75 API calls 25291->25297 25292->25295 25293->25290 25294 5bb5b6 25293->25294 25293->25295 25298 5bb1e6 25293->25298 25294->25290 25295->25289 25297->25259 25299 5bb1ff 25298->25299 25301 5bb8c0 77 API calls 25299->25301 25300 5bb231 25300->25294 25301->25300 25302->25264 25304 5bb14d 25303->25304 25305 5bb123 25303->25305 25304->25268 25305->25304 25314 5bbc65 25305->25314 25309 5baffa 25308->25309 25310 5bafdc 25308->25310 25311 5bb019 25309->25311 25324 5b7b49 74 API calls 25309->25324 25310->25309 25312 5bafe8 CloseHandle 25310->25312 25311->25268 25312->25309 25315 5d1590 25314->25315 25316 5bbc72 DeleteFileW 25315->25316 25317 5bbcb9 25316->25317 25318 5bbc91 25316->25318 25320 5d10f9 CatchGuardHandler 5 API calls 25317->25320 25319 5bda1e 6 API calls 25318->25319 25321 5bbca3 25319->25321 25322 5bb14b 25320->25322 25321->25317 25323 5bbca7 DeleteFileW 25321->25323 25322->25268 25323->25317 25324->25311 25327 5d1221 ___std_exception_copy 25325->25327 25326 5d123b 25326->25081 25327->25326 25329 5d123d 25327->25329 25340 5da2ec 7 API calls 2 library calls 25327->25340 25330 5b4adb Concurrency::cancel_current_task 25329->25330 25332 5d1247 25329->25332 25338 5d47d0 RaiseException 25330->25338 25341 5d47d0 RaiseException 25332->25341 25333 5b4af7 25335 5b4b0d 25333->25335 25339 5b13db 26 API calls Concurrency::cancel_current_task 25333->25339 25335->25081 25336 5d1de0 25338->25333 25339->25335 25340->25327 25341->25336 25343 5da533 _unexpected 25342->25343 25344 5da54c 25343->25344 25345 5da53a 25343->25345 25366 5dd281 EnterCriticalSection 25344->25366 25378 5da681 GetModuleHandleW 25345->25378 25348 5da53f 25348->25344 25379 5da6c5 GetModuleHandleExW 25348->25379 25352 5da553 25363 5da5c8 25352->25363 25365 5da5f1 25352->25365 25387 5db040 20 API calls _abort 25352->25387 25354 5da60e 25370 5da640 25354->25370 25355 5da63a 25388 5e49b0 5 API calls CatchGuardHandler 25355->25388 25356 5da5e0 25361 5db2f1 _abort 5 API calls 25356->25361 25360 5db2f1 _abort 5 API calls 25360->25356 25361->25365 25363->25356 25363->25360 25367 5da631 25365->25367 25366->25352 25389 5dd2d1 LeaveCriticalSection 25367->25389 25369 5da60a 25369->25354 25369->25355 25390 5dd6c6 25370->25390 25373 5da66e 25376 5da6c5 _abort 8 API calls 25373->25376 25374 5da64e GetPEB 25374->25373 25375 5da65e GetCurrentProcess TerminateProcess 25374->25375 25375->25373 25377 5da676 ExitProcess 25376->25377 25378->25348 25380 5da6ef GetProcAddress 25379->25380 25381 5da712 25379->25381 25385 5da704 25380->25385 25382 5da718 FreeLibrary 25381->25382 25383 5da721 25381->25383 25382->25383 25384 5d10f9 CatchGuardHandler 5 API calls 25383->25384 25386 5da54b 25384->25386 25385->25381 25386->25344 25387->25363 25389->25369 25391 5dd6eb 25390->25391 25392 5dd6e1 25390->25392 25393 5dd2e8 _unexpected 5 API calls 25391->25393 25394 5d10f9 CatchGuardHandler 5 API calls 25392->25394 25393->25392 25395 5da64a 25394->25395 25395->25373 25395->25374 26871 5da7c0 52 API calls 3 library calls 26872 5d1bc0 27 API calls 26817 5e55c0 VariantClear 26819 5c11eb FreeLibrary 26820 5d29e0 51 API calls 2 library calls 26878 5baf90 78 API calls Concurrency::cancel_current_task 26879 5cc390 GdipDisposeImage GdipFree 26821 5e4590 CloseHandle 26881 5cea83 123 API calls 5 library calls 26882 5cd384 GetDlgItem EnableWindow ShowWindow SendMessageW 26556 5de180 26557 5de189 26556->26557 26558 5de192 26556->26558 26560 5de077 26557->26560 26561 5db9a5 _unexpected 38 API calls 26560->26561 26562 5de084 26561->26562 26580 5de19e 26562->26580 26564 5de08c 26589 5dde0b 26564->26589 26567 5de0a3 26567->26558 26568 5dbc8e __vsnwprintf_l 21 API calls 26569 5de0b4 26568->26569 26570 5de0e6 26569->26570 26596 5de240 26569->26596 26573 5dbafa _free 20 API calls 26570->26573 26573->26567 26574 5de0e1 26606 5dbc7b 20 API calls __dosmaperr 26574->26606 26576 5de12a 26576->26570 26607 5ddce1 26 API calls 26576->26607 26577 5de0fe 26577->26576 26578 5dbafa _free 20 API calls 26577->26578 26578->26576 26581 5de1aa ___scrt_is_nonwritable_in_current_image 26580->26581 26582 5db9a5 _unexpected 38 API calls 26581->26582 26583 5de1b4 26582->26583 26587 5de238 _abort 26583->26587 26588 5dbafa _free 20 API calls 26583->26588 26608 5db584 38 API calls _abort 26583->26608 26609 5dd281 EnterCriticalSection 26583->26609 26610 5de22f LeaveCriticalSection _abort 26583->26610 26587->26564 26588->26583 26590 5d6dd4 __cftof 38 API calls 26589->26590 26591 5dde1d 26590->26591 26592 5dde2c GetOEMCP 26591->26592 26593 5dde3e 26591->26593 26594 5dde55 26592->26594 26593->26594 26595 5dde43 GetACP 26593->26595 26594->26567 26594->26568 26595->26594 26597 5dde0b 40 API calls 26596->26597 26598 5de25f 26597->26598 26601 5de2b0 IsValidCodePage 26598->26601 26603 5de266 26598->26603 26605 5de2d5 __cftof 26598->26605 26599 5d10f9 CatchGuardHandler 5 API calls 26600 5de0d9 26599->26600 26600->26574 26600->26577 26602 5de2c2 GetCPInfo 26601->26602 26601->26603 26602->26603 26602->26605 26603->26599 26611 5ddee3 GetCPInfo 26605->26611 26606->26570 26607->26570 26609->26583 26610->26583 26612 5ddf1d 26611->26612 26620 5ddfc7 26611->26620 26621 5defd8 26612->26621 26614 5d10f9 CatchGuardHandler 5 API calls 26616 5de073 26614->26616 26616->26603 26619 5dd1c8 __vsnwprintf_l 43 API calls 26619->26620 26620->26614 26622 5d6dd4 __cftof 38 API calls 26621->26622 26623 5deff8 MultiByteToWideChar 26622->26623 26625 5df0ce 26623->26625 26626 5df036 26623->26626 26627 5d10f9 CatchGuardHandler 5 API calls 26625->26627 26628 5dbc8e __vsnwprintf_l 21 API calls 26626->26628 26631 5df057 __cftof __vsnwprintf_l 26626->26631 26629 5ddf7e 26627->26629 26628->26631 26635 5dd1c8 26629->26635 26630 5df0c8 26640 5dd213 20 API calls _free 26630->26640 26631->26630 26633 5df09c MultiByteToWideChar 26631->26633 26633->26630 26634 5df0b8 GetStringTypeW 26633->26634 26634->26630 26636 5d6dd4 __cftof 38 API calls 26635->26636 26637 5dd1db 26636->26637 26641 5dcfab 26637->26641 26640->26625 26642 5dcfc6 __vsnwprintf_l 26641->26642 26643 5dcfec MultiByteToWideChar 26642->26643 26644 5dd016 26643->26644 26655 5dd1a0 26643->26655 26647 5dbc8e __vsnwprintf_l 21 API calls 26644->26647 26650 5dd037 __vsnwprintf_l 26644->26650 26645 5d10f9 CatchGuardHandler 5 API calls 26646 5dd1b3 26645->26646 26646->26619 26647->26650 26648 5dd0ec 26677 5dd213 20 API calls _free 26648->26677 26649 5dd080 MultiByteToWideChar 26649->26648 26651 5dd099 26649->26651 26650->26648 26650->26649 26668 5dd5bc 26651->26668 26655->26645 26656 5dd0fb 26660 5dbc8e __vsnwprintf_l 21 API calls 26656->26660 26663 5dd11c __vsnwprintf_l 26656->26663 26657 5dd0c3 26657->26648 26659 5dd5bc __vsnwprintf_l 11 API calls 26657->26659 26658 5dd191 26676 5dd213 20 API calls _free 26658->26676 26659->26648 26660->26663 26661 5dd5bc __vsnwprintf_l 11 API calls 26664 5dd170 26661->26664 26663->26658 26663->26661 26664->26658 26665 5dd17f WideCharToMultiByte 26664->26665 26665->26658 26666 5dd1bf 26665->26666 26678 5dd213 20 API calls _free 26666->26678 26669 5dd2e8 _unexpected 5 API calls 26668->26669 26670 5dd5e3 26669->26670 26672 5dd5ec 26670->26672 26679 5dd644 10 API calls 3 library calls 26670->26679 26674 5d10f9 CatchGuardHandler 5 API calls 26672->26674 26673 5dd62c LCMapStringW 26673->26672 26675 5dd0b0 26674->26675 26675->26648 26675->26656 26675->26657 26676->26648 26677->26655 26678->26648 26679->26673 26822 5d2580 LocalFree 26680 5d0782 26681 5d0686 26680->26681 26682 5d0d3a ___delayLoadHelper2@8 14 API calls 26681->26682 26682->26681 26683 5bb9ba 26684 5bb9c8 26683->26684 26685 5bb9cf 26683->26685 26686 5bb9dc GetStdHandle 26685->26686 26693 5bb9eb 26685->26693 26686->26693 26687 5bba43 WriteFile 26687->26693 26688 5bba0f 26689 5bba14 WriteFile 26688->26689 26688->26693 26689->26688 26689->26693 26691 5bbad5 26695 5b7e45 75 API calls 26691->26695 26693->26684 26693->26687 26693->26688 26693->26689 26693->26691 26694 5b7b1e 76 API calls 26693->26694 26694->26693 26695->26684 26824 5d11bf 48 API calls _unexpected 26828 5ccda0 71 API calls 26746 5b21a5 26747 5b21b0 26746->26747 26749 5b21b8 26746->26749 26752 5b21ca 27 API calls Concurrency::cancel_current_task 26747->26752 26750 5b21b6 26749->26750 26751 5d121c 27 API calls 26749->26751 26751->26750 26752->26750

                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                            Function 005CEA07 Relevance: 49.5, APIs: 24, Strings: 4, Instructions: 453fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 359 5cea07-5cea55 call 5d1590 362 5cea5b-5cea81 call 5cd5dd 359->362 363 5cf717-5cf739 call 5d10f9 359->363 368 5cea83 362->368 368->363 369 5cea89-5cea9d 368->369 370 5cea9e-5ceab3 call 5cd148 369->370 373 5ceab5 370->373 374 5ceab7-5ceacc call 5c4168 373->374 377 5ceace-5cead2 374->377 378 5cead9-5ceadc 374->378 377->374 381 5cead4 377->381 379 5cf6ea-5cf712 call 5cd5dd 378->379 380 5ceae2 378->380 379->368 383 5ced6d-5ced6f 380->383 384 5cecae-5cecb0 380->384 385 5ced4f-5ced51 380->385 386 5ceae9-5ceaec 380->386 381->379 383->379 389 5ced75-5ced7c 383->389 384->379 390 5cecb6-5cecc2 384->390 385->379 387 5ced57-5ced68 SetWindowTextW 385->387 386->379 391 5ceaf2-5ceb46 call 5cc5dd call 5bdd18 call 5bc351 call 5bc48b call 5b7eed 386->391 387->379 389->379 392 5ced82-5ced9b 389->392 393 5cecc4-5cecd5 call 5d9f09 390->393 394 5cecd6-5cecdb 390->394 447 5cec85-5cec97 call 5bc3de 391->447 396 5ced9d 392->396 397 5ceda3-5cedb1 call 5d6433 392->397 393->394 400 5cecdd-5cece3 394->400 401 5cece5-5cecf0 call 5cd76e 394->401 396->397 397->379 414 5cedb7-5cedc0 397->414 405 5cecf5-5cecf7 400->405 401->405 410 5cecf9-5ced00 call 5d6433 405->410 411 5ced02-5ced22 call 5d6433 call 5d66ae 405->411 410->411 434 5ced3b-5ced3d 411->434 435 5ced24-5ced2b 411->435 418 5cede9-5cedec 414->418 419 5cedc2-5cedc6 414->419 421 5ceee4-5ceef2 call 5c268b 418->421 422 5cedf2-5cedf5 418->422 419->422 424 5cedc8-5cedd0 419->424 444 5ceef4-5cef08 call 5d4b4e 421->444 426 5cedf7-5cedfc 422->426 427 5cee02-5cee1d RegOpenKeyExW 422->427 424->379 430 5cedd6-5cede4 call 5c268b 424->430 426->421 426->427 432 5cee1f-5cee5a RegCloseKey 427->432 433 5cee7a-5cee81 427->433 430->444 455 5cee5c-5cee63 432->455 456 5cee6b 432->456 442 5ceeaf-5ceed2 call 5d6433 * 2 433->442 443 5cee83-5cee9b call 5d6433 433->443 434->379 445 5ced43-5ced4a call 5d66a9 434->445 440 5ced2d-5ced2f 435->440 441 5ced32-5ced3a call 5d9f09 435->441 440->441 441->434 442->444 481 5ceed4-5ceee2 call 5c2663 442->481 443->442 467 5cee9d-5ceeaa call 5c2663 443->467 468 5cef0a-5cef0e 444->468 469 5cef15-5cef66 call 5c268b call 5cd41c GetDlgItem SetWindowTextW SendMessageW call 5d8796 444->469 445->379 470 5cec9d-5ceca9 call 5bc367 447->470 471 5ceb4b-5ceb5f SetFileAttributesW 447->471 464 5cf73c-5cf741 call 5d13f9 455->464 465 5cee69 455->465 466 5cee70-5cee72 456->466 465->466 466->433 467->442 468->469 476 5cef10-5cef12 468->476 496 5cef6b-5cef6f 469->496 470->379 478 5cec05-5cec15 GetFileAttributesW 471->478 479 5ceb65-5ceb98 call 5bd8ac call 5bd52f call 5d6433 471->479 476->469 478->447 486 5cec17-5cec26 DeleteFileW 478->486 504 5ceb9a-5ceba9 call 5d6433 479->504 505 5cebab-5cebb9 call 5bdcd9 479->505 481->444 486->447 490 5cec28-5cec2b 486->490 494 5cec2f-5cec5b call 5b4c00 GetFileAttributesW 490->494 502 5cec2d-5cec2e 494->502 503 5cec5d-5cec73 MoveFileW 494->503 496->379 499 5cef75-5cef89 SendMessageW 496->499 499->379 502->494 503->447 506 5cec75-5cec7f MoveFileExW 503->506 504->505 511 5cebbf-5cebfe call 5d6433 call 5d2640 504->511 505->470 505->511 506->447 511->478
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005CD5DD: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 005CD6C7
                                                                                                                                                                                                                              • Part of subcall function 005CC5DD: GetCurrentDirectoryW.KERNEL32(?,?), ref: 005CC5E5
                                                                                                                                                                                                                            • SetFileAttributesW.KERNEL32(?,00000000,?,?,?,00000800,?,8C7CEEEB,?,00000000,00000001), ref: 005CEB53
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005CEB8D
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005CEBA1
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005CEBC6
                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(?), ref: 005CEC0C
                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?), ref: 005CEC1E
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005CEC43
                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(?), ref: 005CEC52
                                                                                                                                                                                                                            • MoveFileW.KERNEL32(?,?), ref: 005CEC6B
                                                                                                                                                                                                                            • MoveFileExW.KERNEL32(?,00000000,00000004), ref: 005CEC7F
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005CECFA
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005CED03
                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,?), ref: 005CED62
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$_wcslen$Attributes$Move$CurrentDeleteDirectoryEnvironmentExpandStringsTextWindow_swprintf
                                                                                                                                                                                                                            • String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
                                                                                                                                                                                                                            • API String ID: 2983673336-312220925
                                                                                                                                                                                                                            • Opcode ID: 060839ed459dd0071d2f3293ab663b440d3eb4b10b880d3f16d7453b6d08f969
                                                                                                                                                                                                                            • Instruction ID: b8f4164179afd58609cd8f8a183f0cb1bc139e1e6b15f7992cf6f91304211f69
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 060839ed459dd0071d2f3293ab663b440d3eb4b10b880d3f16d7453b6d08f969
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8EF16072900259AEDB35EBE4DC99EEF3BBCBB49350F04042EE909D7150EB749A45CB60
                                                                                                                                                                                                                            Function 005D037C Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 208filesleeptimeCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005C290A: GetModuleHandleW.KERNEL32 ref: 005C2937
                                                                                                                                                                                                                              • Part of subcall function 005C290A: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 005C2949
                                                                                                                                                                                                                              • Part of subcall function 005C290A: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 005C2973
                                                                                                                                                                                                                              • Part of subcall function 005CC5DD: GetCurrentDirectoryW.KERNEL32(?,?), ref: 005CC5E5
                                                                                                                                                                                                                              • Part of subcall function 005CCCD9: OleInitialize.OLE32(00000000), ref: 005CCCF2
                                                                                                                                                                                                                              • Part of subcall function 005CCCD9: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 005CCD29
                                                                                                                                                                                                                              • Part of subcall function 005CCCD9: SHGetMalloc.SHELL32(005FC460), ref: 005CCD33
                                                                                                                                                                                                                            • GetCommandLineW.KERNEL32 ref: 005D03C9
                                                                                                                                                                                                                            • OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 005D03F3
                                                                                                                                                                                                                            • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007402), ref: 005D0404
                                                                                                                                                                                                                            • UnmapViewOfFile.KERNEL32(00000000), ref: 005D0455
                                                                                                                                                                                                                              • Part of subcall function 005CFFDD: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 005CFFFE
                                                                                                                                                                                                                              • Part of subcall function 005CFFDD: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 005D0038
                                                                                                                                                                                                                              • Part of subcall function 005C1421: _wcslen.LIBCMT ref: 005C1445
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 005D045C
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,00612CC0,00000800), ref: 005D0476
                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32(sfxname,00612CC0), ref: 005D0482
                                                                                                                                                                                                                            • GetLocalTime.KERNEL32(?), ref: 005D048D
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005D04E1
                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 005D04F6
                                                                                                                                                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 005D04FD
                                                                                                                                                                                                                            • LoadIconW.USER32(00000000,00000064), ref: 005D0514
                                                                                                                                                                                                                            • DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001DAE0,00000000), ref: 005D0565
                                                                                                                                                                                                                            • Sleep.KERNEL32(?), ref: 005D0593
                                                                                                                                                                                                                            • DeleteObject.GDI32 ref: 005D05CC
                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 005D05DC
                                                                                                                                                                                                                            • CloseHandle.KERNEL32 ref: 005D061F
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf_wcslen
                                                                                                                                                                                                                            • String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$pP_$sfxname$sfxstime$winrarsfxmappingfile.tmp
                                                                                                                                                                                                                            • API String ID: 3014515783-2075834481
                                                                                                                                                                                                                            • Opcode ID: 6292422d605873187c888d457e70838d8f53e8e01d0f3ab0fc14743a15316f6a
                                                                                                                                                                                                                            • Instruction ID: e7da566665bae3bdec9af8468eef324d22bd92ef3bccd6c75beae234adab0255
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6292422d605873187c888d457e70838d8f53e8e01d0f3ab0fc14743a15316f6a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A6712170500351AFC730AB65EC4DFBB7FADBB95781F04842BF68592292DE348948CBA1
                                                                                                                                                                                                                            Function 005CC652 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 100memorywindowCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 646 5cc652-5cc66f FindResourceW 647 5cc76b 646->647 648 5cc675-5cc686 SizeofResource 646->648 649 5cc76d-5cc771 647->649 648->647 650 5cc68c-5cc69b LoadResource 648->650 650->647 651 5cc6a1-5cc6ac LockResource 650->651 651->647 652 5cc6b2-5cc6c7 GlobalAlloc 651->652 653 5cc6cd-5cc6d6 GlobalLock 652->653 654 5cc763-5cc769 652->654 655 5cc75c-5cc75d GlobalFree 653->655 656 5cc6dc-5cc6fa call 5d4250 653->656 654->649 655->654 660 5cc6fc-5cc71e call 5cc5b6 656->660 661 5cc755-5cc756 GlobalUnlock 656->661 660->661 666 5cc720-5cc728 660->666 661->655 667 5cc72a-5cc73e GdipCreateHBITMAPFromBitmap 666->667 668 5cc743-5cc751 666->668 667->668 669 5cc740 667->669 668->661 669->668
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,005CDA3D,00000066), ref: 005CC665
                                                                                                                                                                                                                            • SizeofResource.KERNEL32(00000000,?,?,?,005CDA3D,00000066), ref: 005CC67C
                                                                                                                                                                                                                            • LoadResource.KERNEL32(00000000,?,?,?,005CDA3D,00000066), ref: 005CC693
                                                                                                                                                                                                                            • LockResource.KERNEL32(00000000,?,?,?,005CDA3D,00000066), ref: 005CC6A2
                                                                                                                                                                                                                            • GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,005CDA3D,00000066), ref: 005CC6BD
                                                                                                                                                                                                                            • GlobalLock.KERNEL32(00000000), ref: 005CC6CE
                                                                                                                                                                                                                            • CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 005CC6F2
                                                                                                                                                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 005CC756
                                                                                                                                                                                                                              • Part of subcall function 005CC5B6: GdipAlloc.GDIPLUS(00000010), ref: 005CC5BC
                                                                                                                                                                                                                            • GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 005CC737
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 005CC75D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
                                                                                                                                                                                                                            • String ID: F.vK]$PNG
                                                                                                                                                                                                                            • API String ID: 211097158-3154714884
                                                                                                                                                                                                                            • Opcode ID: acc8fb40a4ca60fe4586ad761265aaa03f265d95f0506869f52b8a52d12538bc
                                                                                                                                                                                                                            • Instruction ID: 64102a03c24fbcdd19ea3255a773519d881c8eb598337f0419dd2340453e64f4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: acc8fb40a4ca60fe4586ad761265aaa03f265d95f0506869f52b8a52d12538bc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B2318F71600602AFC7159FA1DC88E2B7FA8FFA5791705051DF94986261EB31D808EFA0
                                                                                                                                                                                                                            Function 005BF963 Relevance: 18.2, APIs: 3, Strings: 7, Instructions: 684COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000800,8C7CEEEB), ref: 005BF9CD
                                                                                                                                                                                                                              • Part of subcall function 005BE208: _wcslen.LIBCMT ref: 005BE210
                                                                                                                                                                                                                              • Part of subcall function 005C2663: _wcslen.LIBCMT ref: 005C2669
                                                                                                                                                                                                                              • Part of subcall function 005C3D10: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,8C7CEEEB,?,?,8C7CEEEB,00000001,005BDA04,00000000,8C7CEEEB,?,00010468,?,?), ref: 005C3D2C
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005BFD00
                                                                                                                                                                                                                            • __fprintf_l.LIBCMT ref: 005BFE50
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _wcslen$ByteCharFileModuleMultiNameWide__fprintf_l
                                                                                                                                                                                                                            • String ID: ,$$%s:$*messages***$*messages***$@%s:$RTL$|l^
                                                                                                                                                                                                                            • API String ID: 2646189078-1255868809
                                                                                                                                                                                                                            • Opcode ID: 11f54fbd44c2a8d62665f7332b56bff9d28bc7aec421af1fc39e75db445eef1b
                                                                                                                                                                                                                            • Instruction ID: ed05ccbc44b0947ddc463dbc2658a4d88fd66add4a38d43322970b0dc368801c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 11f54fbd44c2a8d62665f7332b56bff9d28bc7aec421af1fc39e75db445eef1b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7D42F271900259AFDF24EFA8CC45BFEBBB4FF54700F50052AE945AB281EB71AA41CB54
                                                                                                                                                                                                                            Function 005BC4A8 Relevance: 7.6, APIs: 5, Instructions: 111fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 1149 5bc4a8-5bc4e3 call 5d1590 1152 5bc548-5bc551 FindNextFileW 1149->1152 1153 5bc4e5-5bc4f0 FindFirstFileW 1149->1153 1154 5bc563-5bc606 call 5c268b call 5be27e call 5c3724 * 3 1152->1154 1156 5bc553-5bc561 GetLastError 1152->1156 1153->1154 1155 5bc4f2-5bc507 call 5bda1e 1153->1155 1162 5bc60b-5bc62c call 5d10f9 1154->1162 1164 5bc509-5bc520 FindFirstFileW 1155->1164 1165 5bc522-5bc52b GetLastError 1155->1165 1157 5bc53d-5bc543 1156->1157 1157->1162 1164->1154 1164->1165 1168 5bc53b 1165->1168 1169 5bc52d-5bc530 1165->1169 1168->1157 1169->1168 1172 5bc532-5bc535 1169->1172 1172->1168 1174 5bc537-5bc539 1172->1174 1174->1157
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FindFirstFileW.KERNELBASE(?,?,00000000,?,?,?,005BC39F,000000FF,?,?,?,?,005B87BC,?,?,00000000), ref: 005BC4E6
                                                                                                                                                                                                                              • Part of subcall function 005BDA1E: _wcslen.LIBCMT ref: 005BDA59
                                                                                                                                                                                                                            • FindFirstFileW.KERNEL32(?,00000000,?,?,00000800,?,?,005BC39F,000000FF,?,?,?,?,005B87BC,?,?), ref: 005BC516
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,00000800,?,?,005BC39F,000000FF,?,?,?,?,005B87BC,?,?,00000000,0000003A), ref: 005BC522
                                                                                                                                                                                                                            • FindNextFileW.KERNEL32(?,?,00000000,?,?,?,005BC39F,000000FF,?,?,?,?,005B87BC,?,?,00000000), ref: 005BC549
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,005BC39F,000000FF,?,?,?,?,005B87BC,?,?,00000000,0000003A,?,0000003A,00000802), ref: 005BC555
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileFind$ErrorFirstLast$Next_wcslen
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 42610566-0
                                                                                                                                                                                                                            • Opcode ID: 1ae1fe6116479715878caae1a63480f324588e9473d25e2a915dc14fe1cb40f3
                                                                                                                                                                                                                            • Instruction ID: c37967ff74754473b1824cde5e589c10aac7c2bc8c3f15856c78a8feef0a02c8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1ae1fe6116479715878caae1a63480f324588e9473d25e2a915dc14fe1cb40f3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 724173B1508245AFC724DF64D884AEAFBE8BB98350F004A1EF59AD3240D734B958CBA5
                                                                                                                                                                                                                            Function 005DA640 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(?,?,005DA616,?,005EF7B0,0000000C,005DA76D,?,00000002,00000000), ref: 005DA661
                                                                                                                                                                                                                            • TerminateProcess.KERNEL32(00000000,?,005DA616,?,005EF7B0,0000000C,005DA76D,?,00000002,00000000), ref: 005DA668
                                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 005DA67A
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1703294689-0
                                                                                                                                                                                                                            • Opcode ID: 3d1864091246222fd1816b948ca52d7cb0e36b83fe8537e0d223e0d9d184274c
                                                                                                                                                                                                                            • Instruction ID: 22745d3712936a65719025e774c731dd505756af795092c29dea8710a3c66a93
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3d1864091246222fd1816b948ca52d7cb0e36b83fe8537e0d223e0d9d184274c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D7E01231400148EBCB256F68CD4CA493F2ABBA0381B084412F8488A232DB36EC46DA90
                                                                                                                                                                                                                            Function 005B9906 Relevance: 2.4, Strings: 1, Instructions: 1169COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • __tmp_reference_source_, xrefs: 005B9C0E
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _wcslen$AttributesFile_swprintf$CurrentH_prolog3Process__aulldiv_wcsrchr
                                                                                                                                                                                                                            • String ID: __tmp_reference_source_
                                                                                                                                                                                                                            • API String ID: 3636405837-685763994
                                                                                                                                                                                                                            • Opcode ID: 53e4010c44df353d7e164c3d0e499558692109b125dce2f572b140627797d2af
                                                                                                                                                                                                                            • Instruction ID: fddd443cde0d0006ae02d8fcd29499b6337beaa68e4167bab0e22ff80d766954
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 53e4010c44df353d7e164c3d0e499558692109b125dce2f572b140627797d2af
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 83A21870904285AEDF25DF64C889BFE7FA5BF45300F0845BAED499B182D7307A48CBA1
                                                                                                                                                                                                                            Function 005C8C7E Relevance: .3, Instructions: 349COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: H_prolog3
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 431132790-0
                                                                                                                                                                                                                            • Opcode ID: d6b86750532ef157be7e05a22f8c74dc12199d6631c07263b494698571428751
                                                                                                                                                                                                                            • Instruction ID: 6feb396bafba2f3e5594e99be7fd4828f41304af979ca50d135010a24080f530
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d6b86750532ef157be7e05a22f8c74dc12199d6631c07263b494698571428751
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1FD1B3716083418FDB24DF68C848B6BBFE5BF89304F08456DE8999B342DB74E904CB96
                                                                                                                                                                                                                            Function 005C290A Relevance: 101.8, APIs: 23, Strings: 35, Instructions: 327libraryfileloaderCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 0 5c290a-5c2941 call 5d1590 GetModuleHandleW 3 5c2999-5c2bfa 0->3 4 5c2943-5c2953 GetProcAddress 0->4 5 5c2cda 3->5 6 5c2c00-5c2c0d call 5d9e7e 3->6 7 5c296d-5c297d GetProcAddress 4->7 8 5c2955-5c296b 4->8 10 5c2cdc-5c2d08 GetModuleFileNameW call 5be208 call 5c268b 5->10 6->10 17 5c2c13-5c2c41 GetModuleFileNameW CreateFileW 6->17 7->3 9 5c297f-5c2994 7->9 8->7 9->3 24 5c2d0a-5c2d16 call 5bd076 10->24 19 5c2ccc-5c2cd8 CloseHandle 17->19 20 5c2c47-5c2c53 SetFilePointer 17->20 19->10 20->19 23 5c2c55-5c2c71 ReadFile 20->23 23->19 25 5c2c73-5c2c7f 23->25 32 5c2d18-5c2d23 call 5c28ab 24->32 33 5c2d45-5c2d6c call 5be27e GetFileAttributesW 24->33 26 5c2ede-5c2ee3 call 5d13f9 25->26 27 5c2c85-5c2ca4 25->27 30 5c2cc1-5c2cca call 5c23d6 27->30 30->19 40 5c2ca6-5c2cc0 call 5c28ab 30->40 32->33 43 5c2d25-5c2d35 32->43 44 5c2d6e-5c2d72 33->44 45 5c2d76 33->45 40->30 49 5c2d40-5c2d43 43->49 44->24 47 5c2d74 44->47 48 5c2d78-5c2d7d 45->48 47->48 50 5c2d7f 48->50 51 5c2db4-5c2db6 48->51 49->33 49->44 54 5c2d81-5c2da8 call 5be27e GetFileAttributesW 50->54 52 5c2dbc-5c2dd3 call 5be252 call 5bd076 51->52 53 5c2ec3-5c2edb call 5d10f9 51->53 66 5c2e3b-5c2e6e call 5b4c00 AllocConsole 52->66 67 5c2dd5-5c2e36 call 5c28ab * 2 call 5c0597 call 5b4c00 call 5c0597 call 5cc774 52->67 61 5c2daa-5c2dae 54->61 62 5c2db2 54->62 61->54 64 5c2db0 61->64 62->51 64->51 72 5c2ebb-5c2ebd ExitProcess 66->72 73 5c2e70-5c2eb5 GetCurrentProcessId AttachConsole call 5d6433 GetStdHandle WriteConsoleW Sleep FreeConsole 66->73 67->72 73->72
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleHandleW.KERNEL32 ref: 005C2937
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 005C2949
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 005C2973
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 005C2C1D
                                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005C2C37
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 005C2C4B
                                                                                                                                                                                                                            • ReadFile.KERNEL32(00000000,?,00007FFE,$o^,00000000), ref: 005C2C69
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 005C2CCD
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 005C2CE6
                                                                                                                                                                                                                            • CompareStringW.KERNEL32(00000400,00001001,po^,?,DXGIDebug.dll,?,$o^,?,00000000,?,00000800), ref: 005C2D3A
                                                                                                                                                                                                                            • GetFileAttributesW.KERNELBASE(?,?,$o^,00000800,?,00000000,?,00000800), ref: 005C2D64
                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 005C2DA0
                                                                                                                                                                                                                              • Part of subcall function 005C28AB: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005C28D4
                                                                                                                                                                                                                              • Part of subcall function 005C28AB: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,005C1309,Crypt32.dll,00000000,005C1383,00000200,?,005C1366,00000000,00000000,?), ref: 005C28F4
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005C2E12
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005C2E5E
                                                                                                                                                                                                                            • AllocConsole.KERNEL32 ref: 005C2E66
                                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32 ref: 005C2E70
                                                                                                                                                                                                                            • AttachConsole.KERNEL32(00000000), ref: 005C2E77
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005C2E8C
                                                                                                                                                                                                                            • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 005C2E9D
                                                                                                                                                                                                                            • WriteConsoleW.KERNEL32(00000000), ref: 005C2EA4
                                                                                                                                                                                                                            • Sleep.KERNEL32(00002710), ref: 005C2EAF
                                                                                                                                                                                                                            • FreeConsole.KERNEL32 ref: 005C2EB5
                                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 005C2EBD
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite_wcslen
                                                                                                                                                                                                                            • String ID: $o^$$r^$$s^$(p^$(t^$,q^$4s^$<$<o^$<r^$@p^$DXGIDebug.dll$Dq^$Dt^$Ls^$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$Xo^$Xp^$\q^$\t^$`r^$ds^$dwmapi.dll$kernel32$po^$pp^$tq^$uxtheme.dll$xr^$xs^$xt^$o^$p^
                                                                                                                                                                                                                            • API String ID: 270162209-2347972808
                                                                                                                                                                                                                            • Opcode ID: 8bfaccfb811e1df0fb603224795db801dad725fabb901e7e56acb797a5c80dcd
                                                                                                                                                                                                                            • Instruction ID: 515f78c69b1c3ce138eb490e88d848ff5cedcdb2d0ace3225018fb170387478a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8bfaccfb811e1df0fb603224795db801dad725fabb901e7e56acb797a5c80dcd
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 08D17FB10083C99FD7389F91988CF9FBEE8BB98784F00091DF5D99A251C7B08549CB62
                                                                                                                                                                                                                            Function 005CDAE0 Relevance: 95.2, APIs: 47, Strings: 7, Instructions: 750windowfilesleepCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005B1366: GetDlgItem.USER32(00000000,00003021), ref: 005B13AA
                                                                                                                                                                                                                              • Part of subcall function 005B1366: SetWindowTextW.USER32(00000000,005E65F4), ref: 005B13C0
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 005CDC06
                                                                                                                                                                                                                            • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005CDC24
                                                                                                                                                                                                                            • IsDialogMessageW.USER32(?,?), ref: 005CDC37
                                                                                                                                                                                                                            • TranslateMessage.USER32(?), ref: 005CDC45
                                                                                                                                                                                                                            • DispatchMessageW.USER32(?), ref: 005CDC4F
                                                                                                                                                                                                                            • GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 005CDC72
                                                                                                                                                                                                                            • EndDialog.USER32(?,00000001), ref: 005CDC95
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000068), ref: 005CDCB8
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 005CDCD3
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,000000C2,00000000,005E65F4), ref: 005CDCE6
                                                                                                                                                                                                                              • Part of subcall function 005CF77B: _wcslen.LIBCMT ref: 005CF7A5
                                                                                                                                                                                                                            • SetFocus.USER32(00000000), ref: 005CDCED
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005CDD4C
                                                                                                                                                                                                                              • Part of subcall function 005B4C00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005B4C13
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,00000000,00000000,00000000,?,00000800), ref: 005CDDAF
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,00000000,00000000,00000000,?,00000800), ref: 005CDDD7
                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 005CDDF5
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005CDE0D
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,00000011), ref: 005CDE3F
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,00000000,00000000,00000000,?,00000800), ref: 005CDE92
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005CDEC9
                                                                                                                                                                                                                            • CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007402,winrarsfxmappingfile.tmp,?,?,?,?,00603482,00000200), ref: 005CDF1D
                                                                                                                                                                                                                            • GetCommandLineW.KERNEL32(?,?,?,?,00603482,00000200), ref: 005CDF33
                                                                                                                                                                                                                            • MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,00603482,00000400,00000001,00000001,?,?,?,?,00603482,00000200), ref: 005CDF8A
                                                                                                                                                                                                                            • ShellExecuteExW.SHELL32(?), ref: 005CDFB2
                                                                                                                                                                                                                            • Sleep.KERNEL32(00000064,?,?,?,?,00603482,00000200), ref: 005CDFFA
                                                                                                                                                                                                                            • UnmapViewOfFile.KERNEL32(?,?,0000421C,00603482,00000400,?,?,?,?,00603482,00000200), ref: 005CE023
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,00603482,00000200), ref: 005CE02C
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005CE05F
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 005CE0BE
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000065,005E65F4), ref: 005CE0D5
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000065), ref: 005CE0DE
                                                                                                                                                                                                                            • GetWindowLongW.USER32(00000000,000000F0), ref: 005CE0ED
                                                                                                                                                                                                                            • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 005CE0FC
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 005CE1A9
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005CE1FF
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005CE229
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000080,00000001,?), ref: 005CE273
                                                                                                                                                                                                                            • SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 005CE28D
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000068), ref: 005CE296
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 005CE2AC
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000066), ref: 005CE2C6
                                                                                                                                                                                                                            • SetWindowTextW.USER32(00000000,0060589A), ref: 005CE2E8
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 005CE348
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 005CE35B
                                                                                                                                                                                                                            • DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001D8C0,00000000,?), ref: 005CE3FE
                                                                                                                                                                                                                            • EnableWindow.USER32(00000000,00000000), ref: 005CE4CC
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000111,00000001,00000000), ref: 005CE50E
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 005CE532
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Item$MessageText$Send$Window_swprintf$File$DialogErrorLast$LongView_wcslen$CloseCommandCountCreateDispatchEnableExecuteFocusHandleLineMappingModuleNameParamShellSleepTickTranslateUnmap__vswprintf_c_l
                                                                                                                                                                                                                            • String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
                                                                                                                                                                                                                            • API String ID: 3951635750-1712381250
                                                                                                                                                                                                                            • Opcode ID: f47cb614cb3c7331947fe5b1737af279d8a117973e00693e93e06e71da8fd9f1
                                                                                                                                                                                                                            • Instruction ID: eec7765e0f059faa67cdef718e52eb0f24e95b31e5366e0d334fc0b10c68a929
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f47cb614cb3c7331947fe5b1737af279d8a117973e00693e93e06e71da8fd9f1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1042D370940389BEEB21ABA0DC4EFFE7FB9BB51700F08442AF545A61D1DBB45A44CB61
                                                                                                                                                                                                                            Function 005C0244 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 240COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 591 5c0244-5c02b7 call 5b4c00 call 5c3f47 call 5d87e0 598 5c02b9 591->598 599 5c0314-5c037a call 5bf6bc GetWindowRect GetClientRect 591->599 600 5c02be-5c02c1 598->600 606 5c0450-5c046e GetSystemMetrics GetWindow 599->606 607 5c0380-5c0385 599->607 602 5c0308-5c0312 600->602 603 5c02c3-5c02d6 call 5d8ff0 600->603 602->599 602->600 616 5c02d8-5c02f1 call 5bf8ec 603->616 617 5c0304 603->617 609 5c0474-5c0476 606->609 610 5c0516-5c052e call 5d10f9 606->610 611 5c038b-5c03db 607->611 612 5c0421-5c043f call 5bf74f 607->612 619 5c050e-5c0510 609->619 613 5c03dd 611->613 614 5c03e2-5c03e4 611->614 612->606 627 5c0441-5c044a SetWindowTextW 612->627 613->614 620 5c03e8-5c041b GetWindowLongW GetWindowRect 614->620 621 5c03e6 614->621 616->617 630 5c02f3-5c02fe SetDlgItemTextW 616->630 617->602 619->610 622 5c047b-5c0481 619->622 620->612 621->620 622->610 628 5c0487-5c050b GetWindowRect GetWindow 622->628 627->606 628->610 632 5c050d 628->632 630->617 632->619
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005C0284
                                                                                                                                                                                                                              • Part of subcall function 005B4C00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005B4C13
                                                                                                                                                                                                                              • Part of subcall function 005C3F47: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,005BF801,00000000,00000000,?,005F5070,?,005BF801,?,?,00000050,?), ref: 005C3F64
                                                                                                                                                                                                                            • _strlen.LIBCMT ref: 005C02A5
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,005F2274,?), ref: 005C02FE
                                                                                                                                                                                                                            • GetWindowRect.USER32(?,?), ref: 005C0334
                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 005C0340
                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 005C03EB
                                                                                                                                                                                                                            • GetWindowRect.USER32(?,?), ref: 005C041B
                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,?), ref: 005C044A
                                                                                                                                                                                                                            • GetSystemMetrics.USER32(00000008), ref: 005C0452
                                                                                                                                                                                                                            • GetWindow.USER32(?,00000005), ref: 005C045D
                                                                                                                                                                                                                            • GetWindowRect.USER32(00000000,?), ref: 005C048D
                                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000002), ref: 005C04FF
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
                                                                                                                                                                                                                            • String ID: $%s:$CAPTION$d$t"_
                                                                                                                                                                                                                            • API String ID: 2407758923-1192206394
                                                                                                                                                                                                                            • Opcode ID: 81e9042e9f6039c86c8f5338c70bbc5acf41456a5bac4716533588097091f961
                                                                                                                                                                                                                            • Instruction ID: 1057b3d9a5c433cd7f5a24b631fe325be433708232712f940b0f6c2be81de03b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 81e9042e9f6039c86c8f5338c70bbc5acf41456a5bac4716533588097091f961
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 79816A72608341AFD714DFA8CD89F6FBBF9FB88704F04591EF98592290D674A9088B52
                                                                                                                                                                                                                            Function 005CF7FC Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 103windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005CD864: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 005CD875
                                                                                                                                                                                                                              • Part of subcall function 005CD864: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005CD886
                                                                                                                                                                                                                              • Part of subcall function 005CD864: IsDialogMessageW.USER32(00010468,?), ref: 005CD89A
                                                                                                                                                                                                                              • Part of subcall function 005CD864: TranslateMessage.USER32(?), ref: 005CD8A8
                                                                                                                                                                                                                              • Part of subcall function 005CD864: DispatchMessageW.USER32(?), ref: 005CD8B2
                                                                                                                                                                                                                            • GetDlgItem.USER32(00000068,00613CF0), ref: 005CF81F
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,00000005,?,?,005CD099,00000001,?,?,005CDAB9,005E82F0,00613CF0,00613CF0,00001000,005F50C4,00000000,?), ref: 005CF844
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 005CF853
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,000000C2,00000000,005E65F4), ref: 005CF861
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 005CF87B
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 005CF895
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 005CF8D9
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 005CF8E4
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 005CF8F7
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 005CF91E
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,000000C2,00000000,005E769C), ref: 005CF92D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
                                                                                                                                                                                                                            • String ID: \
                                                                                                                                                                                                                            • API String ID: 3569833718-2967466578
                                                                                                                                                                                                                            • Opcode ID: 1da7002f4acd48af48bcb6958721714aacdaa6edf66b1759abd34dca850ddaad
                                                                                                                                                                                                                            • Instruction ID: 128a6d834e1a6bd2ecdaa963570d5d6d67fdfca1029099770bfe5740e3f44dc1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1da7002f4acd48af48bcb6958721714aacdaa6edf66b1759abd34dca850ddaad
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1B31CFB12493047FE310DF34DC4AFAB7FB9FB66704F08091AF5A19A191C76459088B66
                                                                                                                                                                                                                            Function 005CFAFC Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 198COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 908 5cfafc-5cfb2e call 5d1590 911 5cfd7e-5cfd95 call 5d10f9 908->911 912 5cfb34-5cfb40 call 5d6433 908->912 912->911 917 5cfb46-5cfb6e call 5d2640 912->917 920 5cfb78-5cfb89 917->920 921 5cfb70 917->921 922 5cfb8b-5cfb92 920->922 923 5cfb94-5cfb9d 920->923 921->920 924 5cfb9f-5cfba3 922->924 923->924 925 5cfbfa 923->925 927 5cfba6-5cfbac 924->927 926 5cfbfe-5cfc00 925->926 930 5cfc07-5cfc09 926->930 931 5cfc02-5cfc05 926->931 928 5cfbcd-5cfbda 927->928 929 5cfbae 927->929 933 5cfbe0-5cfbe4 928->933 934 5cfd53-5cfd55 928->934 932 5cfbb8-5cfbc2 929->932 935 5cfc1c-5cfc32 call 5bd848 930->935 936 5cfc0b-5cfc12 930->936 931->930 931->935 938 5cfbc4 932->938 939 5cfbb0-5cfbb6 932->939 940 5cfd59-5cfd61 933->940 941 5cfbea-5cfbf4 933->941 934->940 946 5cfc4b-5cfc56 call 5bbccb 935->946 947 5cfc34-5cfc41 call 5c4168 935->947 936->935 942 5cfc14 936->942 938->928 939->932 944 5cfbc6-5cfbc9 939->944 940->926 941->927 945 5cfbf6 941->945 942->935 944->928 945->925 953 5cfc58-5cfc6f call 5bd563 946->953 954 5cfc73-5cfc80 ShellExecuteExW 946->954 947->946 952 5cfc43 947->952 952->946 953->954 954->911 956 5cfc86-5cfc8c 954->956 958 5cfc8e-5cfc95 956->958 959 5cfc9f-5cfca1 956->959 958->959 962 5cfc97-5cfc9d 958->962 960 5cfcb8-5cfcd7 call 5d004d 959->960 961 5cfca3-5cfcac 959->961 963 5cfd0e-5cfd1a CloseHandle 960->963 979 5cfcd9-5cfce1 960->979 961->960 971 5cfcae-5cfcb6 ShowWindow 961->971 962->959 962->963 964 5cfd1c-5cfd29 call 5c4168 963->964 965 5cfd2b-5cfd39 963->965 964->965 977 5cfd66 964->977 969 5cfd6d-5cfd6f 965->969 970 5cfd3b-5cfd3d 965->970 969->911 976 5cfd71-5cfd73 969->976 970->969 974 5cfd3f-5cfd45 970->974 971->960 974->969 978 5cfd47-5cfd51 974->978 976->911 980 5cfd75-5cfd78 ShowWindow 976->980 977->969 978->969 979->963 981 5cfce3-5cfcf4 GetExitCodeProcess 979->981 980->911 981->963 982 5cfcf6-5cfd00 981->982 983 5cfd07 982->983 984 5cfd02 982->984 983->963 984->983
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005CFB35
                                                                                                                                                                                                                            • ShellExecuteExW.SHELL32(?), ref: 005CFC78
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 005CFCB0
                                                                                                                                                                                                                            • GetExitCodeProcess.KERNEL32(?,?), ref: 005CFCEC
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 005CFD12
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 005CFD78
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
                                                                                                                                                                                                                            • String ID: .exe$.inf
                                                                                                                                                                                                                            • API String ID: 36480843-3750412487
                                                                                                                                                                                                                            • Opcode ID: d51c4bdd3b182c7f7514f04b9014737be803841452ec7fb77b1e5d0090b51d57
                                                                                                                                                                                                                            • Instruction ID: 5265affe001b4704ea58b5af91fcb92d775e3a7e3d9aa05dc0382c9e17224c31
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d51c4bdd3b182c7f7514f04b9014737be803841452ec7fb77b1e5d0090b51d57
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8261AF711083859ED7309FA4D844FABBFE6BB84744F08882EF8C697250DB709D84CB92
                                                                                                                                                                                                                            Function 005CD41C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 149registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 985 5cd41c-5cd449 call 5d1590 988 5cd44f-5cd478 call 5ce9ba RegOpenKeyExW 985->988 989 5cd4e8-5cd4fd call 5d10f9 985->989 988->989 994 5cd47a-5cd4a3 988->994 996 5cd4de-5cd4e7 RegCloseKey 994->996 997 5cd4a5-5cd4b2 994->997 996->989 998 5cd4bc 997->998 999 5cd4b4-5cd4b8 997->999 1002 5cd4c1-5cd4d9 call 5c268b 998->1002 1000 5cd4ba 999->1000 1001 5cd500-5cd558 call 5d13f9 call 5b1366 999->1001 1000->1002 1008 5cd5bf-5cd5c1 1001->1008 1009 5cd55a-5cd560 1001->1009 1002->996 1010 5cd5c2-5cd5da call 5d10f9 1008->1010 1011 5cd5b5-5cd5b9 SetDlgItemTextW 1009->1011 1012 5cd562-5cd565 1009->1012 1011->1008 1014 5cd574-5cd576 1012->1014 1015 5cd567-5cd56d 1012->1015 1014->1010 1017 5cd56f-5cd572 1015->1017 1018 5cd583-5cd5b3 GetDlgItemTextW call 5c1421 call 5c145a 1015->1018 1017->1014 1019 5cd578 1017->1019 1021 5cd57a-5cd581 EndDialog 1018->1021 1019->1021 1021->1008
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegOpenKeyExW.KERNELBASE(80000001,Software\WinRAR SFX,00000000,00000001,?,?,?,00000800), ref: 005CD470
                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 005CD4E1
                                                                                                                                                                                                                            • EndDialog.USER32(?,00000001), ref: 005CD57B
                                                                                                                                                                                                                            • GetDlgItemTextW.USER32(?,00000066,00001000,00000200), ref: 005CD591
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000067,?), ref: 005CD5B9
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ItemText$CloseDialogOpen
                                                                                                                                                                                                                            • String ID: GETPASSWORD1$Software\WinRAR SFX
                                                                                                                                                                                                                            • API String ID: 817918715-1315819833
                                                                                                                                                                                                                            • Opcode ID: 2b210b08a26f04f2824f81bd12298ba9f7c7c241ee5b46d72a90fd271889ca73
                                                                                                                                                                                                                            • Instruction ID: e898e1dfa2a49e73d2318fe4ec6751f3f958975503d362077f155851fdbee48e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2b210b08a26f04f2824f81bd12298ba9f7c7c241ee5b46d72a90fd271889ca73
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FA4183725042096EDB30ABA49C85FFA7BBCFB49300F14483EF605E3181DA7065448B75
                                                                                                                                                                                                                            Function 005DCFAB Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 1025 5dcfab-5dcfc4 1026 5dcfda-5dcfdf 1025->1026 1027 5dcfc6-5dcfd6 call 5e159c 1025->1027 1029 5dcfec-5dd010 MultiByteToWideChar 1026->1029 1030 5dcfe1-5dcfe9 1026->1030 1027->1026 1034 5dcfd8 1027->1034 1032 5dd016-5dd022 1029->1032 1033 5dd1a3-5dd1b6 call 5d10f9 1029->1033 1030->1029 1035 5dd024-5dd035 1032->1035 1036 5dd076 1032->1036 1034->1026 1039 5dd054-5dd065 call 5dbc8e 1035->1039 1040 5dd037-5dd046 call 5e4660 1035->1040 1038 5dd078-5dd07a 1036->1038 1043 5dd198 1038->1043 1044 5dd080-5dd093 MultiByteToWideChar 1038->1044 1039->1043 1051 5dd06b 1039->1051 1040->1043 1050 5dd04c-5dd052 1040->1050 1048 5dd19a-5dd1a1 call 5dd213 1043->1048 1044->1043 1047 5dd099-5dd0ab call 5dd5bc 1044->1047 1055 5dd0b0-5dd0b4 1047->1055 1048->1033 1054 5dd071-5dd074 1050->1054 1051->1054 1054->1038 1055->1043 1057 5dd0ba-5dd0c1 1055->1057 1058 5dd0fb-5dd107 1057->1058 1059 5dd0c3-5dd0c8 1057->1059 1060 5dd109-5dd11a 1058->1060 1061 5dd153 1058->1061 1059->1048 1062 5dd0ce-5dd0d0 1059->1062 1063 5dd11c-5dd12b call 5e4660 1060->1063 1064 5dd135-5dd146 call 5dbc8e 1060->1064 1065 5dd155-5dd157 1061->1065 1062->1043 1066 5dd0d6-5dd0f0 call 5dd5bc 1062->1066 1068 5dd191-5dd197 call 5dd213 1063->1068 1080 5dd12d-5dd133 1063->1080 1064->1068 1081 5dd148 1064->1081 1067 5dd159-5dd172 call 5dd5bc 1065->1067 1065->1068 1066->1048 1078 5dd0f6 1066->1078 1067->1068 1082 5dd174-5dd17b 1067->1082 1068->1043 1078->1043 1083 5dd14e-5dd151 1080->1083 1081->1083 1084 5dd17d-5dd17e 1082->1084 1085 5dd1b7-5dd1bd 1082->1085 1083->1065 1086 5dd17f-5dd18f WideCharToMultiByte 1084->1086 1085->1086 1086->1068 1087 5dd1bf-5dd1c6 call 5dd213 1086->1087 1087->1048
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,005D7F99,005D7F99,?,?,?,005DD1FC,00000001,00000001,62E85006), ref: 005DD005
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,005DD1FC,00000001,00000001,62E85006,?,?,?), ref: 005DD08B
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,62E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 005DD185
                                                                                                                                                                                                                            • __freea.LIBCMT ref: 005DD192
                                                                                                                                                                                                                              • Part of subcall function 005DBC8E: RtlAllocateHeap.NTDLL(00000000,?,?,?,005D6A24,?,0000015D,?,?,?,?,005D7F00,000000FF,00000000,?,?), ref: 005DBCC0
                                                                                                                                                                                                                            • __freea.LIBCMT ref: 005DD19B
                                                                                                                                                                                                                            • __freea.LIBCMT ref: 005DD1C0
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1414292761-0
                                                                                                                                                                                                                            • Opcode ID: 4fa5dc3e6da933fae347851e44c158215a27f2ffce5cb20cae16a8a7a3400923
                                                                                                                                                                                                                            • Instruction ID: 2d6310d85987ad5bb766daa6ee9a34abe910d93cde099d90d54b1c55a68e3487
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4fa5dc3e6da933fae347851e44c158215a27f2ffce5cb20cae16a8a7a3400923
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E9519072600217AADB358FA8CC45EBA7FBAFB84750F15462BFC15D6240EB34DC44C6A0
                                                                                                                                                                                                                            Function 005CFF24 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 1090 5cff24-5cff51 call 5d1590 1093 5cffc2-5cffd7 call 5d10f9 1090->1093 1094 5cff53-5cff5b 1090->1094 1094->1093 1096 5cff5d-5cff96 call 5ce9ba RegCreateKeyExW 1094->1096 1100 5cff98-5cffbb call 5d6433 RegSetValueExW RegCloseKey 1096->1100 1101 5cffc1 1096->1101 1100->1101 1101->1093
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegCreateKeyExW.KERNELBASE(80000001,Software\WinRAR SFX,00000000,00000000,00000000,00020006,00000000,?,?,0060589A,?,00000800,?,00000800,?,005CDD77), ref: 005CFF8E
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005CFF99
                                                                                                                                                                                                                            • RegSetValueExW.KERNELBASE(?,?,00000000,00000001,?,00000000), ref: 005CFFB2
                                                                                                                                                                                                                            • RegCloseKey.KERNELBASE(?), ref: 005CFFBB
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseCreateValue_wcslen
                                                                                                                                                                                                                            • String ID: Software\WinRAR SFX
                                                                                                                                                                                                                            • API String ID: 951825311-754673328
                                                                                                                                                                                                                            • Opcode ID: 416e63a996f471f0cc7d00bfeb6e19aef68d201fdfef734e0641b703a70af003
                                                                                                                                                                                                                            • Instruction ID: 6c9ccd2ae4595773bca74500cbd7d67e0112e36a8235c0de4fba7f83cbc5187e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 416e63a996f471f0cc7d00bfeb6e19aef68d201fdfef734e0641b703a70af003
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 18118271600158AEEB30ABA5EC49FEF7FBDEB89740F15802FF516A6091DAB05548CF60
                                                                                                                                                                                                                            Function 005CCB49 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 1104 5ccb49-5ccb72 GetClassNameW 1105 5ccb9a-5ccb9c 1104->1105 1106 5ccb74-5ccb89 call 5c4168 1104->1106 1107 5ccb9e-5ccba0 1105->1107 1108 5ccba7-5ccbb3 call 5d10f9 1105->1108 1112 5ccb99 1106->1112 1113 5ccb8b-5ccb97 FindWindowExW 1106->1113 1107->1108 1112->1105 1113->1112
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetClassNameW.USER32(?,?,00000050), ref: 005CCB6A
                                                                                                                                                                                                                            • SHAutoComplete.SHLWAPI(?,00000010), ref: 005CCBA1
                                                                                                                                                                                                                              • Part of subcall function 005C4168: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,005BE084,00000000,.exe,?,?,00000800,?,?,?,005CAD5D), ref: 005C417E
                                                                                                                                                                                                                            • FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 005CCB91
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AutoClassCompareCompleteFindNameStringWindow
                                                                                                                                                                                                                            • String ID: @U\w$EDIT
                                                                                                                                                                                                                            • API String ID: 4243998846-1974088135
                                                                                                                                                                                                                            • Opcode ID: 855e14d7e1ab9bd84e1330c1853c01eb68a46dbd91aaeec0b77750cbfe751235
                                                                                                                                                                                                                            • Instruction ID: 44932b3f0f059a8db59a72f7e23a3608a6832ee74536d0616669fda1b951a753
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 855e14d7e1ab9bd84e1330c1853c01eb68a46dbd91aaeec0b77750cbfe751235
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E8F0A471601318BFDB20ABA59C06F9F7BBCEF89701F04405AF945EA180D6709E0586A9
                                                                                                                                                                                                                            Function 005BB2B0 Relevance: 7.6, APIs: 5, Instructions: 119filetimeCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 1115 5bb2b0-5bb2ea call 5d1590 1118 5bb2ec-5bb2ef 1115->1118 1119 5bb2f5 1115->1119 1118->1119 1120 5bb2f1-5bb2f3 1118->1120 1121 5bb2f7-5bb308 1119->1121 1120->1121 1122 5bb30a 1121->1122 1123 5bb310-5bb31a 1121->1123 1122->1123 1124 5bb31f-5bb32c call 5b7eed 1123->1124 1125 5bb31c 1123->1125 1128 5bb32e 1124->1128 1129 5bb334-5bb34d CreateFileW 1124->1129 1125->1124 1128->1129 1130 5bb39b-5bb39f 1129->1130 1131 5bb34f-5bb36e GetLastError call 5bda1e 1129->1131 1133 5bb3a3-5bb3a6 1130->1133 1136 5bb3a8-5bb3ad 1131->1136 1137 5bb370-5bb393 CreateFileW GetLastError 1131->1137 1135 5bb3b9-5bb3be 1133->1135 1133->1136 1139 5bb3df-5bb3f0 1135->1139 1140 5bb3c0-5bb3c3 1135->1140 1136->1135 1138 5bb3af 1136->1138 1137->1133 1141 5bb395-5bb399 1137->1141 1138->1135 1143 5bb40b-5bb424 call 5d10f9 1139->1143 1144 5bb3f2-5bb407 call 5c268b 1139->1144 1140->1139 1142 5bb3c5-5bb3d9 SetFileTime 1140->1142 1141->1133 1142->1139 1144->1143
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,005B8846,?,00000005), ref: 005BB342
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,005B8846,?,00000005), ref: 005BB34F
                                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,005B8846,?,00000005), ref: 005BB382
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,005B8846,?,00000005), ref: 005BB38A
                                                                                                                                                                                                                            • SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,005B8846,?,00000005), ref: 005BB3D9
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$CreateErrorLast$Time
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1999340476-0
                                                                                                                                                                                                                            • Opcode ID: ff9b0708b0c13b08f7a23a3e2f6337b63878d3e4e17e86da385cf71f374b7c49
                                                                                                                                                                                                                            • Instruction ID: 311f91aea4ca094726621235252f22789f9daa2040b9852fd4623d23909f0c09
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ff9b0708b0c13b08f7a23a3e2f6337b63878d3e4e17e86da385cf71f374b7c49
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B941F370545786AFE320DF24CC49BEABFE8BB54320F200E19F5A1962C1D7F1A948CB91
                                                                                                                                                                                                                            Function 005CD864 Relevance: 7.5, APIs: 5, Instructions: 38windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 1178 5cd864-5cd87d PeekMessageW 1179 5cd87f-5cd893 GetMessageW 1178->1179 1180 5cd8b8-5cd8ba 1178->1180 1181 5cd8a4-5cd8b2 TranslateMessage DispatchMessageW 1179->1181 1182 5cd895-5cd8a2 IsDialogMessageW 1179->1182 1181->1180 1182->1180 1182->1181
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 005CD875
                                                                                                                                                                                                                            • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005CD886
                                                                                                                                                                                                                            • IsDialogMessageW.USER32(00010468,?), ref: 005CD89A
                                                                                                                                                                                                                            • TranslateMessage.USER32(?), ref: 005CD8A8
                                                                                                                                                                                                                            • DispatchMessageW.USER32(?), ref: 005CD8B2
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$DialogDispatchPeekTranslate
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1266772231-0
                                                                                                                                                                                                                            • Opcode ID: 548ee43b498a3f72a89a3bccf4b96142d23e0f6f4ae5b15c6a502f11a5336be8
                                                                                                                                                                                                                            • Instruction ID: c979ed8873453efcd6a6034b20c9b07b5bb1cb84fc6915f2d2d1a2becb3a40e9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 548ee43b498a3f72a89a3bccf4b96142d23e0f6f4ae5b15c6a502f11a5336be8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DBF0D0B290521DABDF20ABE6DC4CEEB7F7CFE092527449425B51AD2050EB68D506C7B0
                                                                                                                                                                                                                            Function 005CFFDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 1183 5cffdd-5d0011 call 5d1590 SetEnvironmentVariableW call 5c23d6 1187 5d0016-5d001a 1183->1187 1188 5d001c-5d0020 1187->1188 1189 5d003e-5d004a call 5d10f9 1187->1189 1190 5d0029-5d0030 call 5c24f2 1188->1190 1195 5d0022-5d0028 1190->1195 1196 5d0032-5d0038 SetEnvironmentVariableW 1190->1196 1195->1190 1196->1189
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 005CFFFE
                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 005D0038
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: EnvironmentVariable
                                                                                                                                                                                                                            • String ID: sfxcmd$sfxpar
                                                                                                                                                                                                                            • API String ID: 1431749950-3493335439
                                                                                                                                                                                                                            • Opcode ID: 10d329e8632558d16ac3c3803393ad1f0941c7b1f4cbeb1896541e54df63c18a
                                                                                                                                                                                                                            • Instruction ID: 575a019b11dacd37df0bbe56fe5e8862f6038363680169308f552ee1ffd8af34
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 10d329e8632558d16ac3c3803393ad1f0941c7b1f4cbeb1896541e54df63c18a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2DF0FC71501225BBC738ABA48C49ABF7B9CFF5DB80F400417B94597281DAB49D40D7A5
                                                                                                                                                                                                                            Function 005CCCD9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34comCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005C28AB: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005C28D4
                                                                                                                                                                                                                              • Part of subcall function 005C28AB: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,005C1309,Crypt32.dll,00000000,005C1383,00000200,?,005C1366,00000000,00000000,?), ref: 005C28F4
                                                                                                                                                                                                                            • OleInitialize.OLE32(00000000), ref: 005CCCF2
                                                                                                                                                                                                                            • GdiplusStartup.GDIPLUS(?,?,00000000), ref: 005CCD29
                                                                                                                                                                                                                            • SHGetMalloc.SHELL32(005FC460), ref: 005CCD33
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
                                                                                                                                                                                                                            • String ID: riched20.dll
                                                                                                                                                                                                                            • API String ID: 3498096277-3360196438
                                                                                                                                                                                                                            • Opcode ID: e632b94bfe53ee4dd51f58e65758a480a354a228ecd41e6bb4cfcf68c7483f53
                                                                                                                                                                                                                            • Instruction ID: 6977c8fd0485eee8437e7e1bfe1b5ef7c6c3ad7d016a0d96fe1319e45cca0b9a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e632b94bfe53ee4dd51f58e65758a480a354a228ecd41e6bb4cfcf68c7483f53
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FFF0F9B1D00209ABCB10AF9AD8499EFFFFCEF94705F00406BE811A2251DBB856458BA1
                                                                                                                                                                                                                            Function 005D6232 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,005D61E3,00000000,00000001,006160C8,?,?,?,005D6386,00000004,InitializeCriticalSectionEx,005E9624,InitializeCriticalSectionEx), ref: 005D623F
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,005D61E3,00000000,00000001,006160C8,?,?,?,005D6386,00000004,InitializeCriticalSectionEx,005E9624,InitializeCriticalSectionEx,00000000,?,005D613D), ref: 005D6249
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,005D5083), ref: 005D6271
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: LibraryLoad$ErrorLast
                                                                                                                                                                                                                            • String ID: api-ms-
                                                                                                                                                                                                                            • API String ID: 3177248105-2084034818
                                                                                                                                                                                                                            • Opcode ID: 01da61a56348fb93b136e587a5df9e0db7470d252429278c4cd34a8bf2e38437
                                                                                                                                                                                                                            • Instruction ID: bf4742b395a38851ce52153e8cfdaec7bff0d64b412252d03052fdb80cc6c646
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 01da61a56348fb93b136e587a5df9e0db7470d252429278c4cd34a8bf2e38437
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 20E04F38680344B7EF201F65EC4AF593F65BF30BD1F100422FA4DA81E1EBA19D55A685
                                                                                                                                                                                                                            Function 005BC142 Relevance: 6.1, APIs: 4, Instructions: 135filetimeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,?,?,005B9343,?,?,?), ref: 005BC1EE
                                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,?,005B9343,?,?), ref: 005BC22C
                                                                                                                                                                                                                            • SetFileTime.KERNELBASE(00000800,?,?,00000000,?,?,?,005B9343,?,?,?,?,?,?,?,?), ref: 005BC2AF
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000800,?,?,?,005B9343,?,?,?,?,?,?,?,?,?,?), ref: 005BC2B6
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$Create$CloseHandleTime
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2287278272-0
                                                                                                                                                                                                                            • Opcode ID: 4d472c8b3852e2fbceae55ce55b8f749d16722b0d5d3cb444024c45a043cb48b
                                                                                                                                                                                                                            • Instruction ID: 79ae87d9b466cff0f6db0e5b8796f527fe6837320c331271869c715ac332a461
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4d472c8b3852e2fbceae55ce55b8f749d16722b0d5d3cb444024c45a043cb48b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2C41D2302483829EE324DF68DC49FEBBFE8BB99710F04091DB5D1D7181D664AA48C756
                                                                                                                                                                                                                            Function 005BB151 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetStdHandle.KERNEL32(000000F6,?,?,?,00000000,005BB662,?,?,00000000,?,?), ref: 005BB161
                                                                                                                                                                                                                            • ReadFile.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,005BB662,?,?,00000000,?,?), ref: 005BB179
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00000000,005BB662,?,?,00000000,?,?), ref: 005BB1AB
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00000000,005BB662,?,?,00000000,?,?), ref: 005BB1CA
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLast$FileHandleRead
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2244327787-0
                                                                                                                                                                                                                            • Opcode ID: 8ce10e496a59007fb2feaf0a272cb8bd603bc0b704804c72dab5d5e071fa3c34
                                                                                                                                                                                                                            • Instruction ID: 30ec0f448e6c7bfef0fdd98eff43a8a05e4799f18c6cc14bfe3970893de3b351
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8ce10e496a59007fb2feaf0a272cb8bd603bc0b704804c72dab5d5e071fa3c34
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7F118230900614EBFB355F28CC196E93FA9FB513A1F104929F86685290D7F1FE44DB51
                                                                                                                                                                                                                            Function 005DD384 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,005D688D,00000000,00000000,?,005DD32B,005D688D,00000000,00000000,00000000,?,005DD528,00000006,FlsSetValue), ref: 005DD3B6
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,005DD32B,005D688D,00000000,00000000,00000000,?,005DD528,00000006,FlsSetValue,005EAC00,FlsSetValue,00000000,00000364,?,005DBA77), ref: 005DD3C2
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,005DD32B,005D688D,00000000,00000000,00000000,?,005DD528,00000006,FlsSetValue,005EAC00,FlsSetValue,00000000), ref: 005DD3D0
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: LibraryLoad$ErrorLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3177248105-0
                                                                                                                                                                                                                            • Opcode ID: fa54b7b066710ce72807d5240adfdc3c656da997627618f10fb790c60e73c124
                                                                                                                                                                                                                            • Instruction ID: aba2e90ec23bd901974f647da1c134ed45dcc9d5c3177ae4621ea6eaae05c0cb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fa54b7b066710ce72807d5240adfdc3c656da997627618f10fb790c60e73c124
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 00012436211266ABCB304F3C9C84A577F68FB647E17110E22F946DB380CB20D80087F1
                                                                                                                                                                                                                            Function 005DE077 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005DB9A5: GetLastError.KERNEL32(?,005F50C4,005D6E12,005F50C4,?,?,005D688D,?,?,005F50C4), ref: 005DB9A9
                                                                                                                                                                                                                              • Part of subcall function 005DB9A5: _free.LIBCMT ref: 005DB9DC
                                                                                                                                                                                                                              • Part of subcall function 005DB9A5: SetLastError.KERNEL32(00000000,?,005F50C4), ref: 005DBA1D
                                                                                                                                                                                                                              • Part of subcall function 005DB9A5: _abort.LIBCMT ref: 005DBA23
                                                                                                                                                                                                                              • Part of subcall function 005DE19E: _abort.LIBCMT ref: 005DE1D0
                                                                                                                                                                                                                              • Part of subcall function 005DE19E: _free.LIBCMT ref: 005DE204
                                                                                                                                                                                                                              • Part of subcall function 005DDE0B: GetOEMCP.KERNEL32(00000000,?,?,005DE094,?), ref: 005DDE36
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DE0EF
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DE125
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _free$ErrorLast_abort
                                                                                                                                                                                                                            • String ID: p,_
                                                                                                                                                                                                                            • API String ID: 2991157371-1767216777
                                                                                                                                                                                                                            • Opcode ID: 7e16ca1e3af35093e2a48b809caa7dce017a99fad774f6a6ed969891be2e8146
                                                                                                                                                                                                                            • Instruction ID: 0a1d8ab171dbeeda0cac4db0605e5849863bdd005e42edda57491e1335e33aa0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7e16ca1e3af35093e2a48b809caa7dce017a99fad774f6a6ed969891be2e8146
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7F31A131900209EFDB20EBACD44AAAD7FE5BF80320F25409BE5049B3A1DBB69D41DB50
                                                                                                                                                                                                                            Function 005C3105 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateThread.KERNELBASE(00000000,00010000,Function_00013240,?,00000000,?), ref: 005C3129
                                                                                                                                                                                                                            • SetThreadPriority.KERNEL32(00000000,00000000), ref: 005C3170
                                                                                                                                                                                                                              • Part of subcall function 005B7BAD: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005B7BD5
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Thread$CreatePriority__vswprintf_c_l
                                                                                                                                                                                                                            • String ID: CreateThread failed
                                                                                                                                                                                                                            • API String ID: 2655393344-3849766595
                                                                                                                                                                                                                            • Opcode ID: e7c1e6e04a2d9c76de10a4c5f5a57e13c336a5033f341a4f7666205df971b844
                                                                                                                                                                                                                            • Instruction ID: 9c77e00fd5d8fc0b7cd48c29e1ec682d76b22a07198e7d7367764bd7f7385015
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e7c1e6e04a2d9c76de10a4c5f5a57e13c336a5033f341a4f7666205df971b844
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1201A275248B0E6FD3247F909C89FA67FE8FB95751F14012EF7829A180DEA0A8458664
                                                                                                                                                                                                                            Function 005BB9BA Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetStdHandle.KERNEL32(000000F5,?,?,?,?,005BF306,00000001,?,?,?,00000000,005C7564,?,?,?,?), ref: 005BB9DE
                                                                                                                                                                                                                            • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 005BBA25
                                                                                                                                                                                                                            • WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,005BF306,00000001,?,?,?), ref: 005BBA51
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileWrite$Handle
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4209713984-0
                                                                                                                                                                                                                            • Opcode ID: a77d544a3d73c4b60d55d03dd1c1eb320e3ffb11faeccc92b5c7b5bd0a74bbe3
                                                                                                                                                                                                                            • Instruction ID: 04ac9537eccb571a66e8631b39a27654a640a1e2db27c26af419554db66db4b8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a77d544a3d73c4b60d55d03dd1c1eb320e3ffb11faeccc92b5c7b5bd0a74bbe3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7B31E431608345AFEB14CF20D858BAA7BA9FF94765F10091DF5815B290CBF5BD48CBA2
                                                                                                                                                                                                                            Function 005BBEE1 Relevance: 4.6, APIs: 3, Instructions: 61COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005BE1EC: _wcslen.LIBCMT ref: 005BE1F2
                                                                                                                                                                                                                            • CreateDirectoryW.KERNELBASE(?,00000000,?,?,00000000,005BBBD0,?,00000001,00000000,?,?), ref: 005BBF12
                                                                                                                                                                                                                            • CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,00000000,005BBBD0,?,00000001,00000000,?,?), ref: 005BBF45
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00000000,005BBBD0,?,00000001,00000000,?,?), ref: 005BBF62
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateDirectory$ErrorLast_wcslen
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2260680371-0
                                                                                                                                                                                                                            • Opcode ID: 41c26f987d389a15790f1c9eeab7a05c7635282fe509f79f4673b83b99e196d7
                                                                                                                                                                                                                            • Instruction ID: ed9b7231c7a56747a5c4acc4f66c072387cb4c7097b43db2af16b12207afe8af
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 41c26f987d389a15790f1c9eeab7a05c7635282fe509f79f4673b83b99e196d7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D6112530200225AAEB20AF758C49BFE7F98BF19740F000455F942DA190DBF8EE85CE65
                                                                                                                                                                                                                            Function 005DDEE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 005DDF08
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Info
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1807457897-3916222277
                                                                                                                                                                                                                            • Opcode ID: 1c7be1b6990806f50c7499ca5abbb40016a8b7bc4d43c52c094eaacbfcd047ef
                                                                                                                                                                                                                            • Instruction ID: 79c8cb4609bc3de3fa651bf51f614f5d85e3332792bbe8117f751450094b718c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1c7be1b6990806f50c7499ca5abbb40016a8b7bc4d43c52c094eaacbfcd047ef
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 44410B705042899ADF328F6CCC85BF6BFB9FB45304F1408EFE59A86242D2759A45DF20
                                                                                                                                                                                                                            Function 005DD5BC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,62E85006,00000001,?,000000FF), ref: 005DD62D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: String
                                                                                                                                                                                                                            • String ID: LCMapStringEx
                                                                                                                                                                                                                            • API String ID: 2568140703-3893581201
                                                                                                                                                                                                                            • Opcode ID: 8d59715411c38e410e354a1fc7546d7369b3f231f9fc424a9d9a6641084b0ae3
                                                                                                                                                                                                                            • Instruction ID: f0be3792e1e150b8e0234d3dcaae30edaccec2b0204b75eefefe45d3948c7115
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8d59715411c38e410e354a1fc7546d7369b3f231f9fc424a9d9a6641084b0ae3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5A015332100249BBCF166FA4DD0ADAE7F72FF58750F004116FE0825260C6329931EB91
                                                                                                                                                                                                                            Function 005DD55A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,005DCBBF), ref: 005DD5A5
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CountCriticalInitializeSectionSpin
                                                                                                                                                                                                                            • String ID: InitializeCriticalSectionEx
                                                                                                                                                                                                                            • API String ID: 2593887523-3084827643
                                                                                                                                                                                                                            • Opcode ID: d677b99d1f6ca17fbf17ec4eaca6db2b214371ba725c952a5a931b03825e6291
                                                                                                                                                                                                                            • Instruction ID: 4e1f4cb4baec77cf4f0e796fe34fa5c46f43b81c5ef0f0459fdc31efdb70ffeb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d677b99d1f6ca17fbf17ec4eaca6db2b214371ba725c952a5a931b03825e6291
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1BF0243164125CBBCF296F65DC05CAD7F60FF68750B004066FC081A220CA356E14EB91
                                                                                                                                                                                                                            Function 005DD3FF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Alloc
                                                                                                                                                                                                                            • String ID: FlsAlloc
                                                                                                                                                                                                                            • API String ID: 2773662609-671089009
                                                                                                                                                                                                                            • Opcode ID: 9f282f385361ecd50a485706b6a40e44afdf23324d9a48eaf3c74970b1c6ff6f
                                                                                                                                                                                                                            • Instruction ID: b4ba311cf8ed0dc6551af97a7bf726a225a4051bf702354a63d71798c88f91ff
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9f282f385361ecd50a485706b6a40e44afdf23324d9a48eaf3c74970b1c6ff6f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 58E05C30A412586787186BB99C06D3DBF69EB64760F010527FC0556340C9B46D00A296
                                                                                                                                                                                                                            Function 005D0A70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D0A5D
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID: F.vK]
                                                                                                                                                                                                                            • API String ID: 1269201914-680511060
                                                                                                                                                                                                                            • Opcode ID: 579e88e9164c8f51e27eea4114031084c0d10fd451e11ca759fdb77bb235fe0e
                                                                                                                                                                                                                            • Instruction ID: e1281baff24097012186931c5b7b1890dd62a59953006498cfda52ffce7bfdc4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 579e88e9164c8f51e27eea4114031084c0d10fd451e11ca759fdb77bb235fe0e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 66B09281299101AC2218619D991AA760A5DF0C0B10B24A83BF444C0280988158420131
                                                                                                                                                                                                                            Function 005D0A8E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D0A5D
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID: F.vK]
                                                                                                                                                                                                                            • API String ID: 1269201914-680511060
                                                                                                                                                                                                                            • Opcode ID: 818150a2d5fe8e39f34f57e5b2de43fc20a0d66d02398914ab4fc9cde7a0018e
                                                                                                                                                                                                                            • Instruction ID: ad62ff039e39cfd18682696de77b5f609dde872994e93a44f5b65c7449f0c886
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 818150a2d5fe8e39f34f57e5b2de43fc20a0d66d02398914ab4fc9cde7a0018e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EFB09281299101BC2218659D9C1AA760A5DF0C0B10B24A82BF444C1280988058451131
                                                                                                                                                                                                                            Function 005D0A84 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D0A5D
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID: F.vK]
                                                                                                                                                                                                                            • API String ID: 1269201914-680511060
                                                                                                                                                                                                                            • Opcode ID: 7bd78970dc5439547ee951eb382de9fc3343f188ff47e6a61e6021b95045967b
                                                                                                                                                                                                                            • Instruction ID: 679636e19e456d796b0e752f04ae3df2a48c3a3a25d8943c1a5151fc882f4d02
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7bd78970dc5439547ee951eb382de9fc3343f188ff47e6a61e6021b95045967b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3BB092812A9201BC2358619DAC1AA760A5DF0C0B10B24A92BF444C0280988058811131
                                                                                                                                                                                                                            Function 005D0A50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D0A5D
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID: F.vK]
                                                                                                                                                                                                                            • API String ID: 1269201914-680511060
                                                                                                                                                                                                                            • Opcode ID: 2cb924348079af7fbc65260b363017c41b95c2bb7f96cb05c02c1e2ee8d9acb8
                                                                                                                                                                                                                            • Instruction ID: 4c7cb0635fd5df5c297e9e619f7233a3e0df7a6cb2f7b3bf0734fe20f4afbcb0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2cb924348079af7fbc65260b363017c41b95c2bb7f96cb05c02c1e2ee8d9acb8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6DA002D5295141BC311971999D1EE760B5DF4C0B15B30A92BF545D41C16C9158455131
                                                                                                                                                                                                                            Function 005D0A7F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D0A5D
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID: F.vK]
                                                                                                                                                                                                                            • API String ID: 1269201914-680511060
                                                                                                                                                                                                                            • Opcode ID: b05c7b81a37714a812caf2e9f14c76a0f312545ede8f50ce585edf406ef6e6f0
                                                                                                                                                                                                                            • Instruction ID: 7c6d1e509c04ee730959d21c3902cfd99d90c9542ccc3f52e0c1e6ae9bed4705
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b05c7b81a37714a812caf2e9f14c76a0f312545ede8f50ce585edf406ef6e6f0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B8A002D5299142FC311971999D1AD760A5DF4C4B55B30AD2BF445C41C15C9158455131
                                                                                                                                                                                                                            Function 005D0A6B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D0A5D
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID: F.vK]
                                                                                                                                                                                                                            • API String ID: 1269201914-680511060
                                                                                                                                                                                                                            • Opcode ID: 6b85bf7881574608ab60939eaa05d12a8111ba5407a5ccce088520513ba4e552
                                                                                                                                                                                                                            • Instruction ID: 7c6d1e509c04ee730959d21c3902cfd99d90c9542ccc3f52e0c1e6ae9bed4705
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6b85bf7881574608ab60939eaa05d12a8111ba5407a5ccce088520513ba4e552
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B8A002D5299142FC311971999D1AD760A5DF4C4B55B30AD2BF445C41C15C9158455131
                                                                                                                                                                                                                            Function 005DE240 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005DDE0B: GetOEMCP.KERNEL32(00000000,?,?,005DE094,?), ref: 005DDE36
                                                                                                                                                                                                                            • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,005DE0D9,?,00000000), ref: 005DE2B4
                                                                                                                                                                                                                            • GetCPInfo.KERNEL32(00000000,005DE0D9,?,?,?,005DE0D9,?,00000000), ref: 005DE2C7
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CodeInfoPageValid
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 546120528-0
                                                                                                                                                                                                                            • Opcode ID: ca4e44c39cdd855ef89529e4e6feb5dfa346645d1c0eb56c95909cfe47b3b894
                                                                                                                                                                                                                            • Instruction ID: f4d47493e2f083f4953522f373fadafe8713940f290ebce8aba8505c93e87114
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ca4e44c39cdd855ef89529e4e6feb5dfa346645d1c0eb56c95909cfe47b3b894
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 55510F709002469EDB35AF7DC8866BABFE5FF51300F14886FD0968F352D639A946CB90
                                                                                                                                                                                                                            Function 005BB45F Relevance: 3.1, APIs: 2, Instructions: 140COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetFilePointer.KERNELBASE(000000FF,?,00000800,?,?,00000000,?,?,005BB43B,00000800,00000800,00000000,?,?,005BA31D,?), ref: 005BB5EB
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,005BA31D,?,?,?,?,?,?,?,?), ref: 005BB5FA
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2976181284-0
                                                                                                                                                                                                                            • Opcode ID: f1d2bc5758726ba2c955ce25e2fa387e6ad1d24d89b2f934810b59294aa13660
                                                                                                                                                                                                                            • Instruction ID: 4cc3645e236d582f8f865a0b5f35766b03202254f5a77b875b11b12d822f519f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f1d2bc5758726ba2c955ce25e2fa387e6ad1d24d89b2f934810b59294aa13660
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0A41D4716047458BEB349F64D8849FE7BE6FF58360F100A19E48687282E7F4FC848B92
                                                                                                                                                                                                                            Function 005BB01E Relevance: 3.1, APIs: 2, Instructions: 89fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateFileW.KERNELBASE(?,?,00000000,00000000,00000002,00000000,00000000,?,00000000,?,?,?,005BB967,?,?,005B87FD), ref: 005BB0A4
                                                                                                                                                                                                                            • CreateFileW.KERNELBASE(?,?,00000000,00000000,00000002,00000000,00000000,?,?,00000800,?,?,005BB967,?,?,005B87FD), ref: 005BB0D4
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateFile
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 823142352-0
                                                                                                                                                                                                                            • Opcode ID: 4ebe3d6d1bc902b2a8d85314d56fe8a5e8deb3ee4dfcdb0abc4a4de9e4d334d7
                                                                                                                                                                                                                            • Instruction ID: a52fc5b41d36dac7d59a068762ffbf839b11be11a2156290edf1c0efc2fc862d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4ebe3d6d1bc902b2a8d85314d56fe8a5e8deb3ee4dfcdb0abc4a4de9e4d334d7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F7215071504345AFE330AB25CC89BF77BDCFB98320F504A19F9A5C61D1D7B4B9448661
                                                                                                                                                                                                                            Function 005BB7E2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FlushFileBuffers.KERNEL32(?), ref: 005BB7FC
                                                                                                                                                                                                                            • SetFileTime.KERNELBASE(?,?,?,?), ref: 005BB8B0
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$BuffersFlushTime
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1392018926-0
                                                                                                                                                                                                                            • Opcode ID: 01320289da92cf87d515e48e9d74eaa4bab91a7f20c3a4ee8d2845936450c99c
                                                                                                                                                                                                                            • Instruction ID: f844c805053bf6637589b3baf9a5cc16740b49946859584e8efaebf326b6e26d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 01320289da92cf87d515e48e9d74eaa4bab91a7f20c3a4ee8d2845936450c99c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0D21D0312482869FE715DE65C895AFABFE8BFA5304F08491CF4C1C7151D3A9E90CD762
                                                                                                                                                                                                                            Function 005B1FB0 Relevance: 3.1, APIs: 2, Instructions: 69COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: H_prolog3_wcslen
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3746244732-0
                                                                                                                                                                                                                            • Opcode ID: 822a029d8b374cf7c0bb88a259f987d94233249baac48104aa321cc87ef0c940
                                                                                                                                                                                                                            • Instruction ID: f51251be317974a864e8c4241e4d305653e3dcb9a3a1fed5424936513ad66f26
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 822a029d8b374cf7c0bb88a259f987d94233249baac48104aa321cc87ef0c940
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AC215E3590060ADFCF15AF94C899AEDBFB2BF48300F10442EF445672A1C7356951DB64
                                                                                                                                                                                                                            Function 005D6192 Relevance: 3.1, APIs: 2, Instructions: 67libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(00000000,00000001,006160C8,?,?,?,005D6386,00000004,InitializeCriticalSectionEx,005E9624,InitializeCriticalSectionEx,00000000,?,005D613D,006160C8,00000FA0), ref: 005D6215
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 005D621F
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3013587201-0
                                                                                                                                                                                                                            • Opcode ID: 924a033031ea428bc2300621f05a0c77189537fdc39d6d785ce7a55b8927692e
                                                                                                                                                                                                                            • Instruction ID: 03592b76e67724ac137c26f23c6818d5329b812f640d0debc9fca819e26b2423
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 924a033031ea428bc2300621f05a0c77189537fdc39d6d785ce7a55b8927692e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4811813A6011159F8B32CFACDC808997BA5FB56360724016BE9169B350E7309D42DB90
                                                                                                                                                                                                                            Function 005BB8C0 Relevance: 3.1, APIs: 2, Instructions: 56COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 005BB907
                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 005BB914
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2976181284-0
                                                                                                                                                                                                                            • Opcode ID: a70f4f31858e73130197a33f8024d0a96754c8656555da220ad29a9c9137e958
                                                                                                                                                                                                                            • Instruction ID: ab22c8c5535ca4dbd3264d50923ec1701635e3ed538eabb83a9a925e48b5d513
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a70f4f31858e73130197a33f8024d0a96754c8656555da220ad29a9c9137e958
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4B11CE30A00B15ABE7349628C889BE6BBE8BB453B0F600B28E252921D0E7F0FD45D750
                                                                                                                                                                                                                            Function 005DBB34 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DBB55
                                                                                                                                                                                                                              • Part of subcall function 005DBC8E: RtlAllocateHeap.NTDLL(00000000,?,?,?,005D6A24,?,0000015D,?,?,?,?,005D7F00,000000FF,00000000,?,?), ref: 005DBCC0
                                                                                                                                                                                                                            • HeapReAlloc.KERNEL32(00000000,?,?,?,?,005F50C4,005B190A,?,?,00000007,?,?,?,005B1476,?,00000000), ref: 005DBB91
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Heap$AllocAllocate_free
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2447670028-0
                                                                                                                                                                                                                            • Opcode ID: 643b80f3f8246e11f0bc0250203513bed80e59516d6fb251b47f490d4a20d740
                                                                                                                                                                                                                            • Instruction ID: df3f93f69bf1fc5e3380d7db0e2e7bc94c0bd0725b3f937ed76d82ccde4ee2eb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 643b80f3f8246e11f0bc0250203513bed80e59516d6fb251b47f490d4a20d740
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7CF04F35500216E7FB312A6EAC05E6B2F5BBBC1BA0B274117F8559A3A5DF20DC0191A6
                                                                                                                                                                                                                            Function 005BC2E5 Relevance: 3.0, APIs: 2, Instructions: 38COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetFileAttributesW.KERNELBASE(?,00000000,?,00000001,?,005BBF5E,?,?), ref: 005BC305
                                                                                                                                                                                                                              • Part of subcall function 005BDA1E: _wcslen.LIBCMT ref: 005BDA59
                                                                                                                                                                                                                            • SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,005BBF5E,?,?), ref: 005BC334
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AttributesFile$_wcslen
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2673547680-0
                                                                                                                                                                                                                            • Opcode ID: 3571edd92d80e7fc62db18e9c900699efc0316b057d420d2302695ea2a08f7c5
                                                                                                                                                                                                                            • Instruction ID: 402c177cbf2fc1faf1e4ffbda708ab77c0eb5dc37e587946020c9ca52278603f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3571edd92d80e7fc62db18e9c900699efc0316b057d420d2302695ea2a08f7c5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CBF0F630201219EBDB10AF748C059EE7BACFF18340F408096B941D7250DA31EE48DB64
                                                                                                                                                                                                                            Function 005BBC65 Relevance: 3.0, APIs: 2, Instructions: 36fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • DeleteFileW.KERNELBASE(?,?,?,?,005BB14B,?,00000000,005BAF6E,8C7CEEEB,00000000,005E517A,000000FF,?,005B8882,?,?), ref: 005BBC82
                                                                                                                                                                                                                              • Part of subcall function 005BDA1E: _wcslen.LIBCMT ref: 005BDA59
                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?,?,?,00000800,?,005BB14B,?,00000000,005BAF6E,8C7CEEEB,00000000,005E517A,000000FF,?,005B8882,?), ref: 005BBCAE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DeleteFile$_wcslen
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2643169976-0
                                                                                                                                                                                                                            • Opcode ID: 0cfcbba9344b565dfa98fad67064974962bd97b4009c337abed34b04ce24098e
                                                                                                                                                                                                                            • Instruction ID: 9ce9121cdf75924201cf9ec46519d354664229db37fb6f856d1434760ea8e667
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0cfcbba9344b565dfa98fad67064974962bd97b4009c337abed34b04ce24098e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5EF0B43560122AABD710EFA49C45EEE7BACAF19340F400066BA41D7141DFB4EE889BA4
                                                                                                                                                                                                                            Function 005D030B Relevance: 3.0, APIs: 2, Instructions: 34COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005D0341
                                                                                                                                                                                                                              • Part of subcall function 005B4C00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005B4C13
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(00000065,?), ref: 005D0358
                                                                                                                                                                                                                              • Part of subcall function 005CD864: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 005CD875
                                                                                                                                                                                                                              • Part of subcall function 005CD864: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005CD886
                                                                                                                                                                                                                              • Part of subcall function 005CD864: IsDialogMessageW.USER32(00010468,?), ref: 005CD89A
                                                                                                                                                                                                                              • Part of subcall function 005CD864: TranslateMessage.USER32(?), ref: 005CD8A8
                                                                                                                                                                                                                              • Part of subcall function 005CD864: DispatchMessageW.USER32(?), ref: 005CD8B2
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2718869927-0
                                                                                                                                                                                                                            • Opcode ID: bc8674942486ae9a0d070577bdce1b55aec6d1227c08a9e025020bbadf44768c
                                                                                                                                                                                                                            • Instruction ID: 31321534b6ab4e4cef0e2ea1761a8008dbdea472a64b5fa1d0d6d306fb52ae28
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bc8674942486ae9a0d070577bdce1b55aec6d1227c08a9e025020bbadf44768c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C4F0967150120CABCB11EB69DD0EEEE7FACAB49305F040466B201D3252D5789A059F61
                                                                                                                                                                                                                            Function 005BBCDD Relevance: 3.0, APIs: 2, Instructions: 34COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetFileAttributesW.KERNELBASE(?,?,?,?,005BBCD4,?,005B8607,?), ref: 005BBCFA
                                                                                                                                                                                                                              • Part of subcall function 005BDA1E: _wcslen.LIBCMT ref: 005BDA59
                                                                                                                                                                                                                            • GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,?,005BBCD4,?,005B8607,?), ref: 005BBD24
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AttributesFile$_wcslen
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2673547680-0
                                                                                                                                                                                                                            • Opcode ID: e126f7c846fbea6c28e7bb5df267b93155b2c946994874cb79ad895a9332d583
                                                                                                                                                                                                                            • Instruction ID: db50626fe9dda696c088a9f86a168e2a95fb7a009af0d17d78f5f9a8483a6f6d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e126f7c846fbea6c28e7bb5df267b93155b2c946994874cb79ad895a9332d583
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 11F0BB316002589BC710EB78DD499FEB7BCFB5D750F400165FA41D7280D7B4AE459A94
                                                                                                                                                                                                                            Function 005C3184 Relevance: 3.0, APIs: 2, Instructions: 33COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(?,?,00000002,00000002,?,005C31C7,005BD526), ref: 005C3191
                                                                                                                                                                                                                            • GetProcessAffinityMask.KERNEL32(00000000,?,005C31C7), ref: 005C3198
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Process$AffinityCurrentMask
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1231390398-0
                                                                                                                                                                                                                            • Opcode ID: 06a36fd4fbe569d6bbff8dcdbc665a9f8892a7fda9bc2a8170928ed0f255086d
                                                                                                                                                                                                                            • Instruction ID: a7990c6e47390eac85cbeb9ef3941ab106199eaeb53f6128b10d458682dafb78
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 06a36fd4fbe569d6bbff8dcdbc665a9f8892a7fda9bc2a8170928ed0f255086d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AFE0D872B001196F9F098BE49C09EEB77DDFA54288318807DA543D3200F974DF0986A4
                                                                                                                                                                                                                            Function 005C28AB Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005C28D4
                                                                                                                                                                                                                            • LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,005C1309,Crypt32.dll,00000000,005C1383,00000200,?,005C1366,00000000,00000000,?), ref: 005C28F4
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DirectoryLibraryLoadSystem
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1175261203-0
                                                                                                                                                                                                                            • Opcode ID: e0132b633142c350b43255f45bcaf7ca3010840ed6f48fb20cb7b01668ab2643
                                                                                                                                                                                                                            • Instruction ID: f209f0699fa0f7cbb3551395c7d9dffef4602290e69a3051281bbcaa54d9fcc2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e0132b633142c350b43255f45bcaf7ca3010840ed6f48fb20cb7b01668ab2643
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4FF0B475A01259AFCB10EBA8DC48DDFB7BCEF98751F00046AB645D3100DA74EA488B64
                                                                                                                                                                                                                            Function 005CCD3F Relevance: 3.0, APIs: 2, Instructions: 31COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GdiplusShutdown.GDIPLUS(?,?,?,?,005E505D,000000FF), ref: 005CCD7D
                                                                                                                                                                                                                            • CoUninitialize.COMBASE(?,?,?,?,005E505D,000000FF), ref: 005CCD82
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: GdiplusShutdownUninitialize
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3856339756-0
                                                                                                                                                                                                                            • Opcode ID: a300178d712a71ab94f3a8c3f3f825736ae9840c68e60ec9eef53391e99aa27c
                                                                                                                                                                                                                            • Instruction ID: 94c19c698a07c1c6bcefa54fa811c889d1508ec0ea8ddfd52860775f3b248bba
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a300178d712a71ab94f3a8c3f3f825736ae9840c68e60ec9eef53391e99aa27c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5BF05E76604A44EFC714DF19DC45B5AFBB8FB49B60F04426BE816C3760DB34A904DA94
                                                                                                                                                                                                                            Function 005CC34D Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 005CC36E
                                                                                                                                                                                                                            • GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 005CC375
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: BitmapCreateFromGdipStream
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1918208029-0
                                                                                                                                                                                                                            • Opcode ID: 84d538a4acb1d17e080742e3836d252b68638c5f5e24fce63f687ea5e5a32eb4
                                                                                                                                                                                                                            • Instruction ID: f69a8f34732f0cb015ade19d7d091663451dcd73fc0eba7fda7f1c771f79ffce
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 84d538a4acb1d17e080742e3836d252b68638c5f5e24fce63f687ea5e5a32eb4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4DE039B1404248EFCB20EF99C504B99BAF8BB05750F10841FE88A92301D270AA409B50
                                                                                                                                                                                                                            Function 005D51AC Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005D51CA
                                                                                                                                                                                                                            • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 005D51D5
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Value___vcrt____vcrt_uninitialize_ptd
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1660781231-0
                                                                                                                                                                                                                            • Opcode ID: c387b420a928b33ba2172b331cc154e09409e6e097a3144591731a169eae2c7c
                                                                                                                                                                                                                            • Instruction ID: c8d93ff8349d737c06806aed10392504d4e3fd12e47f9be77b08227b97e60d18
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c387b420a928b33ba2172b331cc154e09409e6e097a3144591731a169eae2c7c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 68D02328544F02448C3036FC2C0777A1F40B9517757F01E47F460C67C1FE115445E311
                                                                                                                                                                                                                            Function 005B1341 Relevance: 3.0, APIs: 2, Instructions: 11COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ItemShowWindow
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3351165006-0
                                                                                                                                                                                                                            • Opcode ID: dd61e57c535ec173e65382a935bfed29d2d45797fab9d30b62e9b49ef54515a0
                                                                                                                                                                                                                            • Instruction ID: aeb0bb69a076a77787781ac062a543d3adaac9c55b3ac2cada2cc0681f427a65
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dd61e57c535ec173e65382a935bfed29d2d45797fab9d30b62e9b49ef54515a0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 97C0123209C200BECB010BB0DC0AC6ABBBAABA4212F18CA0AF0A6C1060C239C010EB11
                                                                                                                                                                                                                            Function 005B1B63 Relevance: 1.8, APIs: 1, Instructions: 311COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: H_prolog3
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 431132790-0
                                                                                                                                                                                                                            • Opcode ID: 4dcda13963c7e76c9add4d2e3ca6c9bd2cc9916ff96805da31ca21ec7bc79935
                                                                                                                                                                                                                            • Instruction ID: 6cd68cdfa03eed5fb33c07c2786c7ce1171785bec3050f97e46989f42132fd01
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4dcda13963c7e76c9add4d2e3ca6c9bd2cc9916ff96805da31ca21ec7bc79935
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 70C1A034A00A519FDF65CF24C4A87E97FA5BF56350F5800B9EC069F286CB34AE44CBA5
                                                                                                                                                                                                                            Function 005B147C Relevance: 1.6, APIs: 1, Instructions: 100COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • __EH_prolog3.LIBCMT ref: 005B1483
                                                                                                                                                                                                                              • Part of subcall function 005B6AE8: __EH_prolog3.LIBCMT ref: 005B6AEF
                                                                                                                                                                                                                              • Part of subcall function 005BEE0F: __EH_prolog3.LIBCMT ref: 005BEE16
                                                                                                                                                                                                                              • Part of subcall function 005B668F: __EH_prolog3.LIBCMT ref: 005B6696
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: H_prolog3
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 431132790-0
                                                                                                                                                                                                                            • Opcode ID: ee3098cd2adee5250d37973b885a2e0f0d2a29b15c90c5c43112a60c71994bba
                                                                                                                                                                                                                            • Instruction ID: 8b95c9e68c92a0f437cc6e5e56750aefc0cd469f643395c9b15cf351d94f2dbf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ee3098cd2adee5250d37973b885a2e0f0d2a29b15c90c5c43112a60c71994bba
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C64124B0A067818ECB54DF2994842D97FE2BF59300F0801BEEC5DCF28AD7715215CBA5
                                                                                                                                                                                                                            Function 005C5617 Relevance: 1.6, APIs: 1, Instructions: 80COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: H_prolog3
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 431132790-0
                                                                                                                                                                                                                            • Opcode ID: 0e68927aadf79c11cc015ad2d769c02ed430d87a03008b0c39fb9098d852481e
                                                                                                                                                                                                                            • Instruction ID: ee78ee6ce52b78f21e532c64f72ce9abef9f30b23a00fe6086d1b43d674c97c8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0e68927aadf79c11cc015ad2d769c02ed430d87a03008b0c39fb9098d852481e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0D21D6B1E40A16AFDB14AFF88845B5A7EA8BB54314F04013FE505EB681E774A980C79C
                                                                                                                                                                                                                            Function 005DD2E8 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 005DD348
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressProc
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 190572456-0
                                                                                                                                                                                                                            • Opcode ID: 4a99ec47774e03eae3dd21f5fe3334b3987e795bc2394f2f248b6848d203aead
                                                                                                                                                                                                                            • Instruction ID: c97f8c56dcc1a423ed26a85a02743731bb9d39ccdc0d18ea7bbbc8eda95ace14
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4a99ec47774e03eae3dd21f5fe3334b3987e795bc2394f2f248b6848d203aead
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 45110A33A016259B9B319E2CEC409AE7BB5FB883607164A23FC15EB354D630DC05D7E2
                                                                                                                                                                                                                            Function 005DEAC9 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005DD786: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,005DB9D3,00000001,00000364,?,005D688D,?,?,005F50C4), ref: 005DD7C7
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DEB35
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AllocateHeap_free
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 614378929-0
                                                                                                                                                                                                                            • Opcode ID: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
                                                                                                                                                                                                                            • Instruction ID: e8429a055ebf2eadf243dfb985e357da7d570a1ed098a114e4e82bde4b2e9f0b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8301C472200246ABE3319E6D988695AFFE9FB85370F25051FE59587380EA70A805C774
                                                                                                                                                                                                                            Function 005BAB81 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: H_prolog3
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 431132790-0
                                                                                                                                                                                                                            • Opcode ID: c924ade6c633b449647cb2450345b8c3a8c27b93aea6a01442a709c6f31a8f6e
                                                                                                                                                                                                                            • Instruction ID: e3dc6b0fb81dea6de48de25f4c156d59cb8642d0d409fa97ab8c0429b1ff6785
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c924ade6c633b449647cb2450345b8c3a8c27b93aea6a01442a709c6f31a8f6e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6901843AD0062A5BCF25EE68C8969FEBF72BF84740B01451AFD21A7242DB35AC01C795
                                                                                                                                                                                                                            Function 005BEE0F Relevance: 1.5, APIs: 1, Instructions: 45COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • __EH_prolog3.LIBCMT ref: 005BEE16
                                                                                                                                                                                                                              • Part of subcall function 005B6AE8: __EH_prolog3.LIBCMT ref: 005B6AEF
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: H_prolog3
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 431132790-0
                                                                                                                                                                                                                            • Opcode ID: bb980bef68266e8249fc216d9cb40ff57225c04fe360c138f21135a81a300a39
                                                                                                                                                                                                                            • Instruction ID: 0acc2a6c2b46ebf99d640a5e64f0e153db9eba571cee438d106d92b733a56350
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bb980bef68266e8249fc216d9cb40ff57225c04fe360c138f21135a81a300a39
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D101C064A013419ADB20EBB9850A7EEBEE47F94300F18485EE485E7382DA78EA00C755
                                                                                                                                                                                                                            Function 005DD786 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,005DB9D3,00000001,00000364,?,005D688D,?,?,005F50C4), ref: 005DD7C7
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AllocateHeap
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1279760036-0
                                                                                                                                                                                                                            • Opcode ID: f44955ad013708f8bf899a9129ea43ee2a0356ee31b4e09d5c4f687ae8d23cf9
                                                                                                                                                                                                                            • Instruction ID: 1d09676e6efa6e9ff07ac0013277be03af0e34c156589f8c0d10c7d4195f59af
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f44955ad013708f8bf899a9129ea43ee2a0356ee31b4e09d5c4f687ae8d23cf9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 04F0B432640221E6DB315A6EDC45B9B7F69FF807A0F154093E80896796CA20DC0083F1
                                                                                                                                                                                                                            Function 005DBC8E Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(00000000,?,?,?,005D6A24,?,0000015D,?,?,?,?,005D7F00,000000FF,00000000,?,?), ref: 005DBCC0
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AllocateHeap
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1279760036-0
                                                                                                                                                                                                                            • Opcode ID: ff186f8921287b3f0aaf7809aaaa4d19614748786f43704e60897f35d7b68519
                                                                                                                                                                                                                            • Instruction ID: 7f4273b09c6762abf7642e2b86fcad67de092d52fd04b90413806d25f30dc437
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ff186f8921287b3f0aaf7809aaaa4d19614748786f43704e60897f35d7b68519
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 64E03025220623D6FB31276D9C05B5B3E5ABF917A0F170123AC05D63B2CF55CC0182E5
                                                                                                                                                                                                                            Function 005BC37A Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005BC4A8: FindFirstFileW.KERNELBASE(?,?,00000000,?,?,?,005BC39F,000000FF,?,?,?,?,005B87BC,?,?,00000000), ref: 005BC4E6
                                                                                                                                                                                                                              • Part of subcall function 005BC4A8: FindFirstFileW.KERNEL32(?,00000000,?,?,00000800,?,?,005BC39F,000000FF,?,?,?,?,005B87BC,?,?), ref: 005BC516
                                                                                                                                                                                                                              • Part of subcall function 005BC4A8: GetLastError.KERNEL32(?,?,00000800,?,?,005BC39F,000000FF,?,?,?,?,005B87BC,?,?,00000000,0000003A), ref: 005BC522
                                                                                                                                                                                                                            • FindClose.KERNELBASE(00000000,000000FF,?,?,?,?,005B87BC,?,?,00000000,0000003A,?,0000003A,00000802), ref: 005BC3A5
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Find$FileFirst$CloseErrorLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1464966427-0
                                                                                                                                                                                                                            • Opcode ID: 5b39d098f6484d92581bcf7ff693d217a6b3bc7de9581f1cede7b293585a5dd0
                                                                                                                                                                                                                            • Instruction ID: 3611e33f7a5921abd04732f550668035a164fb906fcda69dfae9cc2f9302bd38
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5b39d098f6484d92581bcf7ff693d217a6b3bc7de9581f1cede7b293585a5dd0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 67F08235008791AACA221BB4980A7CA7FD07F66372F00CE49F1FD121A2C6F570989B32
                                                                                                                                                                                                                            Function 005C2EE4 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetThreadExecutionState.KERNEL32(00000001), ref: 005C2F19
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExecutionStateThread
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2211380416-0
                                                                                                                                                                                                                            • Opcode ID: 6d2a59d24e20c1822cbe13b7eb41cda3cbcaa3fb0286a64afde7f23fdfa3b106
                                                                                                                                                                                                                            • Instruction ID: 006eeebabface70055d50093ad50b3e148cdd5cbd5aed81dc114a17b60e34781
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6d2a59d24e20c1822cbe13b7eb41cda3cbcaa3fb0286a64afde7f23fdfa3b106
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FCD02B0064851A1DD71633A5680EFFD1E4A3FC6351F08002EB108771C39F4E0C4AD6E2
                                                                                                                                                                                                                            Function 005CC5B6 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GdipAlloc.GDIPLUS(00000010), ref: 005CC5BC
                                                                                                                                                                                                                              • Part of subcall function 005CC34D: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 005CC36E
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Gdip$AllocBitmapCreateFromStream
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1915507550-0
                                                                                                                                                                                                                            • Opcode ID: bb184948fac70443b701d804218a49dfe2ebbc7c187f1a67eea2f7faab0ba8dc
                                                                                                                                                                                                                            • Instruction ID: 823a98da4d72a2baa8c1c109aceb31c686738ddf50b0d6c3d64f213d3a892461
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bb184948fac70443b701d804218a49dfe2ebbc7c187f1a67eea2f7faab0ba8dc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8AD0A730200209BFDF016BA4CC06F7E7DD9FB40340F00846AF805C5140EDB5DA106951
                                                                                                                                                                                                                            Function 005D017F Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 005D01A4
                                                                                                                                                                                                                              • Part of subcall function 005CD864: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 005CD875
                                                                                                                                                                                                                              • Part of subcall function 005CD864: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005CD886
                                                                                                                                                                                                                              • Part of subcall function 005CD864: IsDialogMessageW.USER32(00010468,?), ref: 005CD89A
                                                                                                                                                                                                                              • Part of subcall function 005CD864: TranslateMessage.USER32(?), ref: 005CD8A8
                                                                                                                                                                                                                              • Part of subcall function 005CD864: DispatchMessageW.USER32(?), ref: 005CD8B2
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$DialogDispatchItemPeekSendTranslate
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 897784432-0
                                                                                                                                                                                                                            • Opcode ID: 074bcfd094a7e7cead746dfc6c52e84e8e5d59140fc9d054cea313c36f212ace
                                                                                                                                                                                                                            • Instruction ID: a8a4856e95adbe2012bdddfa39e1104a278f2c9df87acff6a6eae83594cf830a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 074bcfd094a7e7cead746dfc6c52e84e8e5d59140fc9d054cea313c36f212ace
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 27D09E75148300AEDB112B51CE0AF1A7EB2BB98B06F004559B284750F1C6629E21AB16
                                                                                                                                                                                                                            Function 005D0A98 Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • DloadProtectSection.DELAYIMP ref: 005D0AC0
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DloadProtectSection
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2203082970-0
                                                                                                                                                                                                                            • Opcode ID: db3f2cca208a2290e1837408e18862d14aa8264ba731a08263fed2023ed3ebd6
                                                                                                                                                                                                                            • Instruction ID: 99474657b50d973a9a9255ace50824fb66054fde99aca0d3f73aa99178306fbb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: db3f2cca208a2290e1837408e18862d14aa8264ba731a08263fed2023ed3ebd6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0DD0A930900604CDC230AB3CAC8E3A4AAA2BB88308F8C3403B00ADA2E0C6A088C0870D
                                                                                                                                                                                                                            Function 005BB288 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetFileType.KERNELBASE(000000FF,005BB18A,?,?,?,00000000,005BB662,?,?,00000000,?,?), ref: 005BB294
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileType
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3081899298-0
                                                                                                                                                                                                                            • Opcode ID: a95504defe2aaa86e6cdbbe5a546705d12c14958f1451baaa1004150e3028ad3
                                                                                                                                                                                                                            • Instruction ID: 1a7c0f7abd6f2314329e04aca32aa5f9377a330be175b2c97749841758899a76
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a95504defe2aaa86e6cdbbe5a546705d12c14958f1451baaa1004150e3028ad3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 31C01238400104955E7046249C490DCBB11FE623A67B482A4C068890A1C3A39C47F600
                                                                                                                                                                                                                            Function 005D10A8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D10BA
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 7b1beed3c07424926e785462737ac055597c0ce23f39cbf0d15e9aa06ad7a484
                                                                                                                                                                                                                            • Instruction ID: ef68aa7b0e4e8e85dd9d86c0903db3ccbe5acd2480ac0c000e059f8e3aa11ee4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7b1beed3c07424926e785462737ac055597c0ce23f39cbf0d15e9aa06ad7a484
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D5B092E2298241BD22283149AA0A8760A1DE0C4B123209A2BF441C01C098402DC45032
                                                                                                                                                                                                                            Function 005D067C Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 788fb47b7ca4407c56bb1259c324ed4c1e62703e33925260096f1994bc3e06b9
                                                                                                                                                                                                                            • Instruction ID: fe97f05953e3bfec6146a374a0cf166f0c971441149a6670cb78e616638390cd
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 788fb47b7ca4407c56bb1259c324ed4c1e62703e33925260096f1994bc3e06b9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 46B0128535C043BE3238354D6C07D7F0D1DF0C0B10734993FF004C41C098405C405032
                                                                                                                                                                                                                            Function 005D06DD Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 08f4430fad6e8a70b5674727fedd8b9b4fbe081f17ba8957b664835db703c4bd
                                                                                                                                                                                                                            • Instruction ID: 1154ff91ffaffb9b0f8574f797028ee58349db1ea491a77bae6891cb3086952a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 08f4430fad6e8a70b5674727fedd8b9b4fbe081f17ba8957b664835db703c4bd
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 61B09285298182AD2268614D6806A7E0919E0C0B10724993BF408C42C0984058844132
                                                                                                                                                                                                                            Function 005D06D3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 537870d3fd1ecddbefdc19ef2b71b1adeb46a1b2c36959ef1b2460a10f9fe74e
                                                                                                                                                                                                                            • Instruction ID: cd8eb87ecdeb6dbfc4f0492bc11f8ebc2308e183dedf2f55606378fa04348cf7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 537870d3fd1ecddbefdc19ef2b71b1adeb46a1b2c36959ef1b2460a10f9fe74e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 95B09285258043AD2128694D6C06A7E0919E0C1B10724D93BF408C42C0984058444132
                                                                                                                                                                                                                            Function 005D06C9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 7386a628f1a4355dc2f46ce8355b77310fa047b4109dd446cb28013aab1517dc
                                                                                                                                                                                                                            • Instruction ID: 3ac8d541de367bc52d32ce350deb5c138d6bf99426bb01882f105f369a9680b2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7386a628f1a4355dc2f46ce8355b77310fa047b4109dd446cb28013aab1517dc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B9B09299258182AD3128614D6806E7F0929F0C0B10724983BF008C42C098805C404232
                                                                                                                                                                                                                            Function 005D06FB Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 8bcaa751c153b140c6aa2392ca9d6ab6d81756e0c8c03a74c4b7047562ba9168
                                                                                                                                                                                                                            • Instruction ID: 862c65db3c14079769d10d97f3811155d2ad5065fb66be9e89e36856466d0228
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8bcaa751c153b140c6aa2392ca9d6ab6d81756e0c8c03a74c4b7047562ba9168
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DEB09295258042AD2128654D6C06A7E0959E0C0B14724A83BF409C42C0984058405132
                                                                                                                                                                                                                            Function 005D06F1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 476d8267ef33c3bf52955bebf34757e8908fa73918f8950e03343b86e34bb0a3
                                                                                                                                                                                                                            • Instruction ID: d38c877c7483473584f66ca4022514a898a64e19d719ea0bcc73671f0992b219
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 476d8267ef33c3bf52955bebf34757e8908fa73918f8950e03343b86e34bb0a3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FEB09285258042AD3128619D6806A7E0919F0C0B10724983BF008C42C0984058444132
                                                                                                                                                                                                                            Function 005D06E7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 1b57239094c535ee04d75843a2642c8b1abbe9fa8e34c831b2ef9be72342792d
                                                                                                                                                                                                                            • Instruction ID: eaf9c5cd8ee809d06648bdcc106d81d46d7f17d7c58d717865e9230a12659476
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1b57239094c535ee04d75843a2642c8b1abbe9fa8e34c831b2ef9be72342792d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 15B09285398042AD2128614D6906A7E0919E0C0B10724983BF408C42C0985058494132
                                                                                                                                                                                                                            Function 005D0697 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 96fc09cdd0ae5a01d7e8dd725434832e2b1e1f1c9f0734b9a97200ce95825976
                                                                                                                                                                                                                            • Instruction ID: 103bebbf77ace58a48e3f2945a6e7e6336e36de3d8cbf2691db04f21ba7732f6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 96fc09cdd0ae5a01d7e8dd725434832e2b1e1f1c9f0734b9a97200ce95825976
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 24B09285298042AD2128614DA906A7E0929E0C0B107649A3BF408C42C0984058414132
                                                                                                                                                                                                                            Function 005D06B5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 89e37a11377de3c013b8d5ec60eef1b9359b579229c95dff788ed110f71b7331
                                                                                                                                                                                                                            • Instruction ID: 2687d64557b9fc4798744522f84954c42e15bfdc82f6ba1ea444dd61c2422222
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 89e37a11377de3c013b8d5ec60eef1b9359b579229c95dff788ed110f71b7331
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D6B09299298282AD2268614D6806A7F0919E0C0B10724993BF408C42C098805C808132
                                                                                                                                                                                                                            Function 005D06AB Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: ffcd14f3a2b1a90e8417315da7d3c9ed7a1e2911df8b2d36c61bf2d8379814a6
                                                                                                                                                                                                                            • Instruction ID: 56adaca5fde71f113e3863e6132df31882f79745578d6a21aa79927c6bd91e27
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ffcd14f3a2b1a90e8417315da7d3c9ed7a1e2911df8b2d36c61bf2d8379814a6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E2B09299258182AD2128654D6C06A7F0919E0C0B10724983BF408C42C098806C404132
                                                                                                                                                                                                                            Function 005D06A1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: dc8672bf4ad8970a53962bfd6a87f7437af4ecdb2f091c3b3a549526ea9cbdad
                                                                                                                                                                                                                            • Instruction ID: 86a71ad3e61ccac25586f2090fac9d300a87e1c232ee11e0d7df8f41217f8305
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dc8672bf4ad8970a53962bfd6a87f7437af4ecdb2f091c3b3a549526ea9cbdad
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2AB09289268142AD3128614DA806A7E0929F0C0B10724993BF008C42C0984058404132
                                                                                                                                                                                                                            Function 005D075F Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: dd326e85457cec0642b467c30bcc0da8df31f41fc75da2d7d0a2d2c0cbab24c4
                                                                                                                                                                                                                            • Instruction ID: 00ee91bf89944a197ea803af14ebf5cb60e3685e9f0ae1433ba371843af3a83d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dd326e85457cec0642b467c30bcc0da8df31f41fc75da2d7d0a2d2c0cbab24c4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C3B0129539C043BD3128715D6D07E7F0DADF0C0B10B34983FF408C42C0D8405C414132
                                                                                                                                                                                                                            Function 005D0719 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 7803c83fdd442941e53d88b509ec74d8f9ee037fb6702fe86c331f0f04955aa1
                                                                                                                                                                                                                            • Instruction ID: 2ca509cc53bc02722fb8aab65c9f6257d4052e153919fb743a427f41b62b10a6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7803c83fdd442941e53d88b509ec74d8f9ee037fb6702fe86c331f0f04955aa1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D1B0129535C043BD3128714E6C07E7F0D1DF0C0B14734A83FF009C42C0D8405C405132
                                                                                                                                                                                                                            Function 005D070F Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: ccf3b3029c78824013311f4265ccbb3a8d5700f92db62f0432ba77cd746fab2c
                                                                                                                                                                                                                            • Instruction ID: 48f5a1b302563500243047acbae424649590f31e6f0e8b62b11d340d6f74bb06
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ccf3b3029c78824013311f4265ccbb3a8d5700f92db62f0432ba77cd746fab2c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DBB0129539C043BD3128714D6D07E7F0D1DF0C0B14734A83FF409C42C0D8405D415132
                                                                                                                                                                                                                            Function 005D072D Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 34f73c05f24f27be29d6990f92cd3cb09be00ec20012f680e04a277673450553
                                                                                                                                                                                                                            • Instruction ID: f8ea1ee365ab23eb7aad2b3c46b65b094c5884d8e8528d42cb42788530da8f01
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 34f73c05f24f27be29d6990f92cd3cb09be00ec20012f680e04a277673450553
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 76B0129539D143BD3268B24D6C07E7F0D1EF1C0B20B34993FF408C42C0D8405C804132
                                                                                                                                                                                                                            Function 005D08CE Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D08A7
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 0c09cf981512ce1236fc778afa9a77e87d265db2dfd6df29b47fdca7d944d5ce
                                                                                                                                                                                                                            • Instruction ID: 442cdbb4fa7c9883731fda5dafebef6d16d03d8f293a4b62531c1f540f4d2bcb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0c09cf981512ce1236fc778afa9a77e87d265db2dfd6df29b47fdca7d944d5ce
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 91B09282298241AC2118B14EA806E7A0A2AF0C4B11720982BF008C428198401C801231
                                                                                                                                                                                                                            Function 005D08C4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D08A7
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 0beb6df0c320bff59ae5884f57d6a1e4ef5edde585f134e76b7f86a8552233bc
                                                                                                                                                                                                                            • Instruction ID: f29b5a2bd6fa7d181b29878bf2f2c29aa29e4ceb5f28a20a58b26b769d403143
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0beb6df0c320bff59ae5884f57d6a1e4ef5edde585f134e76b7f86a8552233bc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BFB092C2298241AC2618714EA806E7A0A1AE0C4B11720992BF008C42C198401DC45131
                                                                                                                                                                                                                            Function 005D08F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D08A7
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: de60e3ac1a655d5b944427690da620682f593075a47687298afbc48f6f93e1a0
                                                                                                                                                                                                                            • Instruction ID: 9f83b21fae0c3bdbcd9bce651ea5c297ec4eedc8845f01e27d790b960abaa398
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: de60e3ac1a655d5b944427690da620682f593075a47687298afbc48f6f93e1a0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F4B012C636C101EC311CB14EEC06F7A0E1EF0C4B117309A3FF048C42C1D8401C801131
                                                                                                                                                                                                                            Function 005D09EA Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D09FC
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 769d9ed5debfbebda8f5c1cb18570868a450eb92555a6013ffa2f7f2c058bf0a
                                                                                                                                                                                                                            • Instruction ID: 211c7b95ba06b0c0ecc0c8c963888360dca25badac032942e1241f5bb55b11d6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 769d9ed5debfbebda8f5c1cb18570868a450eb92555a6013ffa2f7f2c058bf0a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AAB012C639C202BC3118324DAD16DB60E1DF8C0B19B30D93BF000C01C29C611C410231
                                                                                                                                                                                                                            Function 005D0A0F Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D09FC
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: e5d1954067677f947cde3e2b556d9a572c15aedf4591db280eeb5584c854ee91
                                                                                                                                                                                                                            • Instruction ID: c9befd2df9977de52ff6b56c7c2a64b8989ea901a4ead7058aa4ba7371a22bc8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e5d1954067677f947cde3e2b556d9a572c15aedf4591db280eeb5584c854ee91
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 23B012C139C201AC3118725DAD16EB70E1DF0C4B11730D93BF008C12C1D8511C450331
                                                                                                                                                                                                                            Function 005D0A05 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D09FC
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 67f49e6866d3a01c7a79835bc480a96eee1218b03a19097c12007d07e718743d
                                                                                                                                                                                                                            • Instruction ID: 3296e0a712ef23c6f684beb8d6f17c67c30bbe7130b91ec55fb42e3886c3e264
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 67f49e6866d3a01c7a79835bc480a96eee1218b03a19097c12007d07e718743d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 43B012C13DC301EC3218725DAC16EB60E1DF0C4B117309A3BF008C13C1D8511C880331
                                                                                                                                                                                                                            Function 005D0A23 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D09FC
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: edb3d0b58447a257b9702997ae25564859ec6ce7610a1ae23d061d7452fe9f1a
                                                                                                                                                                                                                            • Instruction ID: 3861ba3964785b10db4b9882a1d1d1509bf171a232513cbdd29f855e93afe377
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: edb3d0b58447a257b9702997ae25564859ec6ce7610a1ae23d061d7452fe9f1a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FAB012C139C201EC3218724DAC16EB70E2DF0C4B11730D93BF404C22C1D8501C441331
                                                                                                                                                                                                                            Function 005D06C4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: d2cace0aed133c678b0eef103b71bc1bb8142024b10d419434540c7041a5de3b
                                                                                                                                                                                                                            • Instruction ID: 9f98e2bb8c254339acdfd338a2e2b271067fee989c401f8bb92531b32876e867
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d2cace0aed133c678b0eef103b71bc1bb8142024b10d419434540c7041a5de3b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEA01285258043BC302831496C06D3F090CF0C0B107309C3FF005C41C0584018004031
                                                                                                                                                                                                                            Function 005D075A Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: a07d26a0171975898ccb1457de85dc3d0f4630f0eb3a3ffc8d24a501463f67bf
                                                                                                                                                                                                                            • Instruction ID: 9f98e2bb8c254339acdfd338a2e2b271067fee989c401f8bb92531b32876e867
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a07d26a0171975898ccb1457de85dc3d0f4630f0eb3a3ffc8d24a501463f67bf
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEA01285258043BC302831496C06D3F090CF0C0B107309C3FF005C41C0584018004031
                                                                                                                                                                                                                            Function 005D0750 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 4fbe62c793db271e7c4c42431239c4190577df2e65ff7ea002fb08725389b1f0
                                                                                                                                                                                                                            • Instruction ID: 9f98e2bb8c254339acdfd338a2e2b271067fee989c401f8bb92531b32876e867
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4fbe62c793db271e7c4c42431239c4190577df2e65ff7ea002fb08725389b1f0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEA01285258043BC302831496C06D3F090CF0C0B107309C3FF005C41C0584018004031
                                                                                                                                                                                                                            Function 005D0746 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 11b372d9af01d5f8ec3a37edb4499c62ded8c076b4eb3a6a95475adcb597691a
                                                                                                                                                                                                                            • Instruction ID: 9f98e2bb8c254339acdfd338a2e2b271067fee989c401f8bb92531b32876e867
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 11b372d9af01d5f8ec3a37edb4499c62ded8c076b4eb3a6a95475adcb597691a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEA01285258043BC302831496C06D3F090CF0C0B107309C3FF005C41C0584018004031
                                                                                                                                                                                                                            Function 005D0778 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 1435332e581dbcbd8abfee770e88b1a1b35a097a95b8b4ca24f036d0727e89e8
                                                                                                                                                                                                                            • Instruction ID: 9f98e2bb8c254339acdfd338a2e2b271067fee989c401f8bb92531b32876e867
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1435332e581dbcbd8abfee770e88b1a1b35a097a95b8b4ca24f036d0727e89e8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEA01285258043BC302831496C06D3F090CF0C0B107309C3FF005C41C0584018004031
                                                                                                                                                                                                                            Function 005D076E Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 92a7fa0d363d2a2999d45b6b94a4716af706639d7c1a410de31550d247016d49
                                                                                                                                                                                                                            • Instruction ID: 9f98e2bb8c254339acdfd338a2e2b271067fee989c401f8bb92531b32876e867
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 92a7fa0d363d2a2999d45b6b94a4716af706639d7c1a410de31550d247016d49
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEA01285258043BC302831496C06D3F090CF0C0B107309C3FF005C41C0584018004031
                                                                                                                                                                                                                            Function 005D070A Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 63b8ba7e646b7b8c1d200dba081affca790799bbb07ed573d1c9b50105fed789
                                                                                                                                                                                                                            • Instruction ID: 9f98e2bb8c254339acdfd338a2e2b271067fee989c401f8bb92531b32876e867
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 63b8ba7e646b7b8c1d200dba081affca790799bbb07ed573d1c9b50105fed789
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEA01285258043BC302831496C06D3F090CF0C0B107309C3FF005C41C0584018004031
                                                                                                                                                                                                                            Function 005D073C Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: d4f52c369202f7140f43c3a34ec49f485f8d28599980e45c17e3e9d17e2e9a36
                                                                                                                                                                                                                            • Instruction ID: 9f98e2bb8c254339acdfd338a2e2b271067fee989c401f8bb92531b32876e867
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d4f52c369202f7140f43c3a34ec49f485f8d28599980e45c17e3e9d17e2e9a36
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEA01285258043BC302831496C06D3F090CF0C0B107309C3FF005C41C0584018004031
                                                                                                                                                                                                                            Function 005D0728 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: eec29665761d90c87c22f5769b97bc3526b9d1a8c73227d6a2576a34c357e1ff
                                                                                                                                                                                                                            • Instruction ID: 9f98e2bb8c254339acdfd338a2e2b271067fee989c401f8bb92531b32876e867
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: eec29665761d90c87c22f5769b97bc3526b9d1a8c73227d6a2576a34c357e1ff
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEA01285258043BC302831496C06D3F090CF0C0B107309C3FF005C41C0584018004031
                                                                                                                                                                                                                            Function 005D0782 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D068E
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: e510987a8620591c1c59b1c42085527dec2b6e3b63ab7eef0853d159a51bd426
                                                                                                                                                                                                                            • Instruction ID: 9f98e2bb8c254339acdfd338a2e2b271067fee989c401f8bb92531b32876e867
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e510987a8620591c1c59b1c42085527dec2b6e3b63ab7eef0853d159a51bd426
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEA01285258043BC302831496C06D3F090CF0C0B107309C3FF005C41C0584018004031
                                                                                                                                                                                                                            Function 005D08DD Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D08A7
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 6a0f55311400a980eed3edc9edb01471915c6a8a9cc0438167df30ff1a4d6a73
                                                                                                                                                                                                                            • Instruction ID: 857ee8d84fdbbf5d8aa8a209b438f727de870b69a5b09f32e998abef2a16dc5d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6a0f55311400a980eed3edc9edb01471915c6a8a9cc0438167df30ff1a4d6a73
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D3A00296259152FC351D715AAD06D7A1A1DF4C4B557309D2FF445C41C1585018455171
                                                                                                                                                                                                                            Function 005D08F1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D08A7
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: feed7eeb86f7ca20898eec39dbb4e9a3ad43182a9efb91d39ce02c0bafefde88
                                                                                                                                                                                                                            • Instruction ID: 857ee8d84fdbbf5d8aa8a209b438f727de870b69a5b09f32e998abef2a16dc5d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: feed7eeb86f7ca20898eec39dbb4e9a3ad43182a9efb91d39ce02c0bafefde88
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D3A00296259152FC351D715AAD06D7A1A1DF4C4B557309D2FF445C41C1585018455171
                                                                                                                                                                                                                            Function 005D08E7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D08A7
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: c32403b82ee8962719d5bd2888ffb8ee805cccce574aef9b9e51ee0ab4ac5ee6
                                                                                                                                                                                                                            • Instruction ID: 857ee8d84fdbbf5d8aa8a209b438f727de870b69a5b09f32e998abef2a16dc5d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c32403b82ee8962719d5bd2888ffb8ee805cccce574aef9b9e51ee0ab4ac5ee6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D3A00296259152FC351D715AAD06D7A1A1DF4C4B557309D2FF445C41C1585018455171
                                                                                                                                                                                                                            Function 005D089A Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D08A7
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: e9043a1302253cff52f20e07db1f0a6d546faa317dc57134e8746b80e6473bb5
                                                                                                                                                                                                                            • Instruction ID: 7a2250c6a6a9ef049e84d2111ba1da8c4537bef3257529afc74d920640753d88
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e9043a1302253cff52f20e07db1f0a6d546faa317dc57134e8746b80e6473bb5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 53A00296255151BC351D715AAD06D7A1A1DF4C0B15730997FF449D41C5585018455171
                                                                                                                                                                                                                            Function 005D08BF Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D08A7
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 0ca0092417c65beac45dd4345f6c22c2902d2e2eac49496757c5f162afdca041
                                                                                                                                                                                                                            • Instruction ID: 857ee8d84fdbbf5d8aa8a209b438f727de870b69a5b09f32e998abef2a16dc5d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0ca0092417c65beac45dd4345f6c22c2902d2e2eac49496757c5f162afdca041
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D3A00296259152FC351D715AAD06D7A1A1DF4C4B557309D2FF445C41C1585018455171
                                                                                                                                                                                                                            Function 005D08B5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D08A7
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 11a1abbe9c636eadf1351b89f292a2c5b6bcd5a7c172764d5adf396a59b90e8d
                                                                                                                                                                                                                            • Instruction ID: 857ee8d84fdbbf5d8aa8a209b438f727de870b69a5b09f32e998abef2a16dc5d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 11a1abbe9c636eadf1351b89f292a2c5b6bcd5a7c172764d5adf396a59b90e8d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D3A00296259152FC351D715AAD06D7A1A1DF4C4B557309D2FF445C41C1585018455171
                                                                                                                                                                                                                            Function 005D0A46 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D09FC
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: b31a6238c89c74c4f05b4cdde030fe7da72fa9ec1410447dce8ffba3b54f2ced
                                                                                                                                                                                                                            • Instruction ID: bee808ddd516a45e01a524881302f33dca4e6711f5e84d4f143266cfeac3684a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b31a6238c89c74c4f05b4cdde030fe7da72fa9ec1410447dce8ffba3b54f2ced
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B7A012C1398102BC30183249AC16D760E0CF0C0B107309D2BF001C01C1585018000230
                                                                                                                                                                                                                            Function 005D0A1E Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D09FC
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: 714f5dbcf090c969071feadd44b934cf08c8cc237d51788eac4e8e1ca8e44caf
                                                                                                                                                                                                                            • Instruction ID: bee808ddd516a45e01a524881302f33dca4e6711f5e84d4f143266cfeac3684a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 714f5dbcf090c969071feadd44b934cf08c8cc237d51788eac4e8e1ca8e44caf
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B7A012C1398102BC30183249AC16D760E0CF0C0B107309D2BF001C01C1585018000230
                                                                                                                                                                                                                            Function 005D0A3C Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D09FC
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: da2640d5cca49f38563aef68d4a85f3452ec381296e6b5e0c7af88cbe99b082a
                                                                                                                                                                                                                            • Instruction ID: bee808ddd516a45e01a524881302f33dca4e6711f5e84d4f143266cfeac3684a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: da2640d5cca49f38563aef68d4a85f3452ec381296e6b5e0c7af88cbe99b082a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B7A012C1398102BC30183249AC16D760E0CF0C0B107309D2BF001C01C1585018000230
                                                                                                                                                                                                                            Function 005D0A32 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D09FC
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: f13f1d1b1ce35b24fed9d077beba57c3a1c9e9a1f08c26ce5f6bb575d97e7968
                                                                                                                                                                                                                            • Instruction ID: bee808ddd516a45e01a524881302f33dca4e6711f5e84d4f143266cfeac3684a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f13f1d1b1ce35b24fed9d077beba57c3a1c9e9a1f08c26ce5f6bb575d97e7968
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B7A012C1398102BC30183249AC16D760E0CF0C0B107309D2BF001C01C1585018000230
                                                                                                                                                                                                                            Function 005D092F Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___delayLoadHelper2@8.DELAYIMP ref: 005D0937
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005D0DAD
                                                                                                                                                                                                                              • Part of subcall function 005D0D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005D0DBE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1269201914-0
                                                                                                                                                                                                                            • Opcode ID: e6a84b78a30f4a830cb6615d4ad5e11adfb8a1e79240a0aeaeb1e4d120af8f0c
                                                                                                                                                                                                                            • Instruction ID: ff3415b815bec7fc8161eaa274dab7b0b9de6fdec33c4b8690761dbfcf5d7e95
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e6a84b78a30f4a830cb6615d4ad5e11adfb8a1e79240a0aeaeb1e4d120af8f0c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 36A001962A9152BC3119729AAD0AD7A1A1DE4C0B25730992BF448C8181A89029854131
                                                                                                                                                                                                                            Function 005BB949 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetEndOfFile.KERNELBASE(?,005BA712,?,?,?,?,?,?,?), ref: 005BB94C
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 749574446-0
                                                                                                                                                                                                                            • Opcode ID: 6cf608683023dd26387b97edc569b9aa8ed9b63e82a39edcb14848b42c056742
                                                                                                                                                                                                                            • Instruction ID: 0c70f3b0be3834f3fcef2e8702a1ed26f726f2af6785ee0b4e443cd84fdbf1e2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6cf608683023dd26387b97edc569b9aa8ed9b63e82a39edcb14848b42c056742
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5AA0113008002A8ACE202B30CA0800C3B20EB30BC030002A8A08BCE0A2CB22880BAA00
                                                                                                                                                                                                                            Function 005CCBB6 Relevance: 1.5, APIs: 1, Instructions: 5COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetCurrentDirectoryW.KERNELBASE(?), ref: 005CCBBA
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentDirectory
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1611563598-0
                                                                                                                                                                                                                            • Opcode ID: 4f1c74e64c4440a6aaf2f5377ae94838d01a2c856d04cdbd2f3bc784d8e14f13
                                                                                                                                                                                                                            • Instruction ID: 0e1a9b648ea33d09129bd0bfd1fd7bbd299ec94dff7dc156648bfb35bc32e8fb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4f1c74e64c4440a6aaf2f5377ae94838d01a2c856d04cdbd2f3bc784d8e14f13
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BBA012301001008782050B318F4550E76556F71680F01C034604184030C7318820F500
                                                                                                                                                                                                                            Function 005BAFD0 Relevance: 1.3, APIs: 1, Instructions: 30COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CloseHandle.KERNELBASE(?,?,?,005BAF75,8C7CEEEB,00000000,005E517A,000000FF,?,005B8882,?,?), ref: 005BAFEB
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseHandle
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2962429428-0
                                                                                                                                                                                                                            • Opcode ID: fb3014c240af2b33ef3381da318bc4fefada56c3eb5eb9606cffb1eb47db0c0f
                                                                                                                                                                                                                            • Instruction ID: 214b67d8a44051e39bbb681159813119eca4024f593b2e593ff31980a7f6caba
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fb3014c240af2b33ef3381da318bc4fefada56c3eb5eb9606cffb1eb47db0c0f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEF0B470082B468EDB349A20C44C7E2BBE47B12325F141B1DD0E3424E0D3A1758D9641

                                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                                            Function 005CE560 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 240windowfileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005B1366: GetDlgItem.USER32(00000000,00003021), ref: 005B13AA
                                                                                                                                                                                                                              • Part of subcall function 005B1366: SetWindowTextW.USER32(00000000,005E65F4), ref: 005B13C0
                                                                                                                                                                                                                            • SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 005CE602
                                                                                                                                                                                                                            • EndDialog.USER32(?,00000006), ref: 005CE615
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,0000006C), ref: 005CE631
                                                                                                                                                                                                                            • SetFocus.USER32(00000000), ref: 005CE638
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000065,?), ref: 005CE66C
                                                                                                                                                                                                                            • SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 005CE69F
                                                                                                                                                                                                                            • FindFirstFileW.KERNEL32(?,?), ref: 005CE6B5
                                                                                                                                                                                                                              • Part of subcall function 005CCBC8: FileTimeToSystemTime.KERNEL32(?,?), ref: 005CCBEE
                                                                                                                                                                                                                              • Part of subcall function 005CCBC8: SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 005CCC05
                                                                                                                                                                                                                              • Part of subcall function 005CCBC8: SystemTimeToFileTime.KERNEL32(?,?), ref: 005CCC19
                                                                                                                                                                                                                              • Part of subcall function 005CCBC8: FileTimeToSystemTime.KERNEL32(?,?), ref: 005CCC2A
                                                                                                                                                                                                                              • Part of subcall function 005CCBC8: GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 005CCC42
                                                                                                                                                                                                                              • Part of subcall function 005CCBC8: GetTimeFormatW.KERNEL32(00000400,?,?,00000000,00000000,00000032), ref: 005CCC66
                                                                                                                                                                                                                              • Part of subcall function 005CCBC8: _swprintf.LIBCMT ref: 005CCC85
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005CE704
                                                                                                                                                                                                                              • Part of subcall function 005B4C00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005B4C13
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,0000006A,?), ref: 005CE717
                                                                                                                                                                                                                            • FindClose.KERNEL32(00000000), ref: 005CE71E
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005CE773
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000068,?), ref: 005CE786
                                                                                                                                                                                                                            • SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 005CE7A0
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005CE7D9
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,0000006B,?), ref: 005CE7EC
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005CE83C
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000069,?), ref: 005CE84F
                                                                                                                                                                                                                              • Part of subcall function 005CD0AB: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 005CD0E1
                                                                                                                                                                                                                              • Part of subcall function 005CD0AB: GetNumberFormatW.KERNEL32(00000400,00000000,?,005F272C,?,?), ref: 005CD12A
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Item$Time$Text$_swprintf$FileSystem$FormatMessageSend$Find$CloseDateDialogFirstFocusInfoLocalLocaleNumberSpecificWindow__vswprintf_c_l
                                                                                                                                                                                                                            • String ID: %s %s$-]$REPLACEFILEDLG
                                                                                                                                                                                                                            • API String ID: 3464475507-725800316
                                                                                                                                                                                                                            • Opcode ID: 88303b4f8036d5f789f0c9f6a78a36c386b2ca047972c997fdb3d60351716ba4
                                                                                                                                                                                                                            • Instruction ID: bc3cd581490ebb47830f1b81210e8003f9faf5cb1cec8f998c63de922526cd3c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 88303b4f8036d5f789f0c9f6a78a36c386b2ca047972c997fdb3d60351716ba4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2D7184B2649344BFE3319BA4DC4EFFF7BADBB89700F04481DB649D61C1D6716A048A62
                                                                                                                                                                                                                            Function 005B7FD3 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 365fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005B807F
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005B8112
                                                                                                                                                                                                                              • Part of subcall function 005B8C95: GetCurrentProcess.KERNEL32(00000020,?), ref: 005B8CB2
                                                                                                                                                                                                                              • Part of subcall function 005B8C95: GetLastError.KERNEL32 ref: 005B8CF6
                                                                                                                                                                                                                              • Part of subcall function 005B8C95: CloseHandle.KERNEL32(?), ref: 005B8D05
                                                                                                                                                                                                                              • Part of subcall function 005BBC65: DeleteFileW.KERNELBASE(?,?,?,?,005BB14B,?,00000000,005BAF6E,8C7CEEEB,00000000,005E517A,000000FF,?,005B8882,?,?), ref: 005BBC82
                                                                                                                                                                                                                              • Part of subcall function 005BBC65: DeleteFileW.KERNEL32(?,?,?,00000800,?,005BB14B,?,00000000,005BAF6E,8C7CEEEB,00000000,005E517A,000000FF,?,005B8882,?), ref: 005BBCAE
                                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 005B81C1
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 005B81DD
                                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000,?,?,?,?,?,?,?,8C7CEEEB,00000000), ref: 005B8329
                                                                                                                                                                                                                              • Part of subcall function 005BB7E2: FlushFileBuffers.KERNEL32(?), ref: 005BB7FC
                                                                                                                                                                                                                              • Part of subcall function 005BB7E2: SetFileTime.KERNELBASE(?,?,?,?), ref: 005BB8B0
                                                                                                                                                                                                                              • Part of subcall function 005BAFD0: CloseHandle.KERNELBASE(?,?,?,005BAF75,8C7CEEEB,00000000,005E517A,000000FF,?,005B8882,?,?), ref: 005BAFEB
                                                                                                                                                                                                                              • Part of subcall function 005BC2E5: SetFileAttributesW.KERNELBASE(?,00000000,?,00000001,?,005BBF5E,?,?), ref: 005BC305
                                                                                                                                                                                                                              • Part of subcall function 005BC2E5: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,005BBF5E,?,?), ref: 005BC334
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$CloseHandle$AttributesCreateDelete_wcslen$BuffersCurrentErrorFlushLastProcessTime
                                                                                                                                                                                                                            • String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
                                                                                                                                                                                                                            • API String ID: 374897892-3508440684
                                                                                                                                                                                                                            • Opcode ID: 13fb38382bf99374ee9d103a28c272949e836017b641a80ce161ab385d94689e
                                                                                                                                                                                                                            • Instruction ID: 57a4c19ab1476ee27eea2b081e97dcbf543e33703e22894452d8e76ec84c1aee
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 13fb38382bf99374ee9d103a28c272949e836017b641a80ce161ab385d94689e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D8D193B1900649AFDB25DB64CC89BFEBBACBF44700F00551AF656E7241EB74BA44CB60
                                                                                                                                                                                                                            Function 005DFF3E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: __floor_pentium4
                                                                                                                                                                                                                            • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                            • API String ID: 4168288129-2761157908
                                                                                                                                                                                                                            • Opcode ID: cf01da9e69ec56b592ccf4e24b5d0986a2407ebdd4011e1139fabea03f7be60d
                                                                                                                                                                                                                            • Instruction ID: fe5eee660489e93a98a04db0db80163cc0ef4d764507110019a8b69e822e00b6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cf01da9e69ec56b592ccf4e24b5d0986a2407ebdd4011e1139fabea03f7be60d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 89C25D71E046698FDB28CE29DD447EABBB5FB84304F1455EAD48DE7280E774AE818F40
                                                                                                                                                                                                                            Function 005B3AB7 Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 677COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _swprintf
                                                                                                                                                                                                                            • String ID: CMT$h%u$hc%u
                                                                                                                                                                                                                            • API String ID: 589789837-3282847064
                                                                                                                                                                                                                            • Opcode ID: 46fdb5b28f05e1f5bc25e0efa5ac0957377ac9a011fdce130d686845b9fb0255
                                                                                                                                                                                                                            • Instruction ID: 66402a42eac7b2bd14ee737959e9d59e6a72f95e54527f1bdbf92c3e84609517
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 46fdb5b28f05e1f5bc25e0efa5ac0957377ac9a011fdce130d686845b9fb0255
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D242D4319006459EDF24DF64C89ABEE7FA5BF55300F084479E84A9B283DB747A89CB60
                                                                                                                                                                                                                            Function 005B2FCB Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 830COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _strlen.LIBCMT ref: 005B35C3
                                                                                                                                                                                                                              • Part of subcall function 005C3D10: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,8C7CEEEB,?,?,8C7CEEEB,00000001,005BDA04,00000000,8C7CEEEB,?,00010468,?,?), ref: 005C3D2C
                                                                                                                                                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005B370D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
                                                                                                                                                                                                                            • String ID: CMT
                                                                                                                                                                                                                            • API String ID: 1610651222-2756464174
                                                                                                                                                                                                                            • Opcode ID: 4834c0484be28d6cfb0df437c327dae14715065729f65450224d528fe10bfb9e
                                                                                                                                                                                                                            • Instruction ID: 6b8a9952084400602f227d5e87442030b4efcb437f1f1dd45a3d1030951e9eb4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4834c0484be28d6cfb0df437c327dae14715065729f65450224d528fe10bfb9e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B9621871A002558FCF29DF78C8996EE7FE1BF55300F08057DE84AAB282DA74BA45CB51
                                                                                                                                                                                                                            Function 005D1FCA Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 005D1FD6
                                                                                                                                                                                                                            • IsDebuggerPresent.KERNEL32 ref: 005D20A2
                                                                                                                                                                                                                            • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 005D20C2
                                                                                                                                                                                                                            • UnhandledExceptionFilter.KERNEL32(?), ref: 005D20CC
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 254469556-0
                                                                                                                                                                                                                            • Opcode ID: 12c0d9a5ba34459713931c6873f310c676b641f916a0c95b6db22295b33ba3ec
                                                                                                                                                                                                                            • Instruction ID: 2280994f4cfb79119c9118af479861046390ea8c3b08a1b595d2be76d9e0c12e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 12c0d9a5ba34459713931c6873f310c676b641f916a0c95b6db22295b33ba3ec
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 02314B75D053199BDB21DFA4D9897CCBBB8BF14340F10409AE44DAB250EB719A88DF04
                                                                                                                                                                                                                            Function 005D0B80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • VirtualQuery.KERNEL32(80000000,005D0AC5,0000001C,005D0CBA,00000000,?,?,?,?,?,?,?,005D0AC5,00000004,00615D24,005D0D4A), ref: 005D0B91
                                                                                                                                                                                                                            • GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,005D0AC5,00000004,00615D24,005D0D4A), ref: 005D0BAC
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: InfoQuerySystemVirtual
                                                                                                                                                                                                                            • String ID: D
                                                                                                                                                                                                                            • API String ID: 401686933-2746444292
                                                                                                                                                                                                                            • Opcode ID: 6a33fcc7e8951d8deec87d142b7d897713139acc7849b7ce4e90773aeb4b1eca
                                                                                                                                                                                                                            • Instruction ID: 8d872b07001ed15cfff8e5a646bbb96db2ebf034e338ae2d84759fd3cdc90970
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6a33fcc7e8951d8deec87d142b7d897713139acc7849b7ce4e90773aeb4b1eca
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E201FC326041099FDB24DF29DC05FDE7BAAAFD4368F0CC126AD59DB244D634D805C680
                                                                                                                                                                                                                            Function 005D647F Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 005D6577
                                                                                                                                                                                                                            • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 005D6581
                                                                                                                                                                                                                            • UnhandledExceptionFilter.KERNEL32(-00000325,?,?,?,?,?,00000000), ref: 005D658E
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3906539128-0
                                                                                                                                                                                                                            • Opcode ID: 6e0e34b9cda052db81127ca44664e6f332530a096a955019f2cb0aae0c43cdd3
                                                                                                                                                                                                                            • Instruction ID: 1c6dc8e1f3dd716a4a65258d275137e88f3cc039414c06b50389f6e5f9019675
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6e0e34b9cda052db81127ca44664e6f332530a096a955019f2cb0aae0c43cdd3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3C31C475901229ABCF25DF68D98979CBBB8BF58310F5041DAE81CA7251EB309F85CF44
                                                                                                                                                                                                                            Function 005DD998 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: .
                                                                                                                                                                                                                            • API String ID: 0-248832578
                                                                                                                                                                                                                            • Opcode ID: ad9f2cc54e7a5479363d55e87b849977fbc5de6c674b6cfd03a2e727bba94cfc
                                                                                                                                                                                                                            • Instruction ID: db545cee2938360dc9d8d5e8b6ede268eb2371bcbf7e0a376938d5a1161c83aa
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad9f2cc54e7a5479363d55e87b849977fbc5de6c674b6cfd03a2e727bba94cfc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4F31F271900249ABCB349E7CCC88EFA7FBDEB85304F00419BE459D7251E6319D458B60
                                                                                                                                                                                                                            Function 005DFA90 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: ce33ea9f4ec23801448980fb748551bc40d278e625499f9c7663d63746eea6e2
                                                                                                                                                                                                                            • Instruction ID: d61d7da357d7b81c94ee83c4d55ebc7dd33408022f4ad78a00f8d8040ff2b89c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ce33ea9f4ec23801448980fb748551bc40d278e625499f9c7663d63746eea6e2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CB020B71E001199BDF24CFADC8906ADBBB5FF88314F25816BD81AE7355D730AE418B90
                                                                                                                                                                                                                            Function 005CD0AB Relevance: 3.1, APIs: 2, Instructions: 51COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 005CD0E1
                                                                                                                                                                                                                            • GetNumberFormatW.KERNEL32(00000400,00000000,?,005F272C,?,?), ref: 005CD12A
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FormatInfoLocaleNumber
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2169056816-0
                                                                                                                                                                                                                            • Opcode ID: a414936cfb397dfd5d44b1cfcf8dabf734ecbcc8323534138f4d675b15a53053
                                                                                                                                                                                                                            • Instruction ID: b50fd937fa0dacf27a3448f0a731dcad79cecc07e2c20d9697f8fa3decdbcc08
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a414936cfb397dfd5d44b1cfcf8dabf734ecbcc8323534138f4d675b15a53053
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A9118B75211308AFD711EF64DC46FAB7BB8FF28700F00842AF902E7291D670AA48CB65
                                                                                                                                                                                                                            Function 005B7BFF Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetLastError.KERNEL32(005B7D6C,?,00000400), ref: 005B7BFF
                                                                                                                                                                                                                            • FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 005B7C20
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFormatLastMessage
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3479602957-0
                                                                                                                                                                                                                            • Opcode ID: 5039cd9681e0e510833128729ffe186736e55a7027a21e1f968e3f4d34b179dc
                                                                                                                                                                                                                            • Instruction ID: 00a3e2c48f6cfacf5643263d468f237185a45d477756f0a5ed782cfb56ff413e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5039cd9681e0e510833128729ffe186736e55a7027a21e1f968e3f4d34b179dc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 33D0C771348314BBFA510E604C4AF6A7F59BB69BD1F14CC08B755D90E0D6709418B619
                                                                                                                                                                                                                            Function 005E4044 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,005E403F,?,?,00000008,?,?,005E3CDF,00000000), ref: 005E4271
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionRaise
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3997070919-0
                                                                                                                                                                                                                            • Opcode ID: a3a8d4377141fff0245aac21ce8f6b4943b0bf9543d9fe9e8c5aebf04e3964a9
                                                                                                                                                                                                                            • Instruction ID: 1d6cfe0fe3960007313b9fded6d1140216f0a7a1af203da5adf9d479d214aa06
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a3a8d4377141fff0245aac21ce8f6b4943b0bf9543d9fe9e8c5aebf04e3964a9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BAB159356106488FDB19CF29C48AB657FA0FF48365F298698E9D9CF2A1C335E991CF40
                                                                                                                                                                                                                            Function 005BD076 Relevance: 1.5, APIs: 1, Instructions: 34COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetVersionExW.KERNEL32(?), ref: 005BD0A7
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Version
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1889659487-0
                                                                                                                                                                                                                            • Opcode ID: cddf17b2741b08159714c60acd5b431902a06c82f5d02f2eef77e32e91f553c8
                                                                                                                                                                                                                            • Instruction ID: 07e834e0e04fd3dde89dbab49bc627b10bac4c6f87cee12008f6429b8d624ef9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cddf17b2741b08159714c60acd5b431902a06c82f5d02f2eef77e32e91f553c8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8D012C759006088BD724DF24EC89AA97BB5BB68304F204619D615D7395FF34A509DF40
                                                                                                                                                                                                                            Function 005B4C6E Relevance: 1.5, Strings: 1, Instructions: 283COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: gj
                                                                                                                                                                                                                            • API String ID: 0-4203073231
                                                                                                                                                                                                                            • Opcode ID: b7d2b0f5abcc63ed940e5434411ae91494bb47455e81cebd21906cb21be53b31
                                                                                                                                                                                                                            • Instruction ID: 3d6c8a1089b56869be15fcaa6718ab36e052b81ab05bc29ebc62437f479fbbfd
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b7d2b0f5abcc63ed940e5434411ae91494bb47455e81cebd21906cb21be53b31
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BAD105B2A083858FC754CF2AD88065AFBE1BFC9348F55492EE9D8D7301D734A955CB82
                                                                                                                                                                                                                            Function 005D215D Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetUnhandledExceptionFilter.KERNEL32(Function_00022170,005D1BC5), ref: 005D2162
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3192549508-0
                                                                                                                                                                                                                            • Opcode ID: 39dac55eb11d8e998d1d4aed2c901ef3490a5b83af93e1bb937d18f35a0ef9fe
                                                                                                                                                                                                                            • Instruction ID: 4f5172b211571d7642dd668a1972a88e95650c8747ac2fed52b1ce1290646e85
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 39dac55eb11d8e998d1d4aed2c901ef3490a5b83af93e1bb937d18f35a0ef9fe
                                                                                                                                                                                                                            • Instruction Fuzzy Hash:
                                                                                                                                                                                                                            Function 005C27A9 Relevance: 1.3, Strings: 1, Instructions: 60COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 0-3916222277
                                                                                                                                                                                                                            • Opcode ID: 934ccf0cd4b67d897cb7c2438ec395f92651c0feaeced376863ec7c5dca47e2e
                                                                                                                                                                                                                            • Instruction ID: 1398b31cab0a097341949c8148179451ce0f33e2e94876ddb1aafd259ade2748
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 934ccf0cd4b67d897cb7c2438ec395f92651c0feaeced376863ec7c5dca47e2e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 16114CB19047069FD72CCFA98895B6ABBF4FF00304F20C82ED4AAE2281D3B5A540CF40
                                                                                                                                                                                                                            Function 005DE680 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: HeapProcess
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 54951025-0
                                                                                                                                                                                                                            • Opcode ID: af658883932023f1b488a50c79df3fb722d018c0e6e3f24934eb245e49e909e6
                                                                                                                                                                                                                            • Instruction ID: 7434d25930ffada9bd029b4cba0ff7005be775d0cdcc26e3738e19ea0a51e836
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: af658883932023f1b488a50c79df3fb722d018c0e6e3f24934eb245e49e909e6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F5A012301002008B83044F32994420835A5A5111C0304C0166044C4160D62540109F00
                                                                                                                                                                                                                            Function 005C82D0 Relevance: .8, Instructions: 807COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 90c3c98ec23a744960941777bc03b1281d3b488c6a7f7634cefa33c0df39adee
                                                                                                                                                                                                                            • Instruction ID: b0b8379a0067483224b49233d1d9d7e8ce69ad6aea763141f71218f945e5a1f1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 90c3c98ec23a744960941777bc03b1281d3b488c6a7f7634cefa33c0df39adee
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DB62D6756047859FCB29CFB8C890BB97FE1BF95304F18896ED89A8B342DB34A945C710
                                                                                                                                                                                                                            Function 005C976F Relevance: .8, Instructions: 781COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: e008b3fe25645c420bb524d8f5ec445355e06715b0fa383b64c6e5b3b3f0fe45
                                                                                                                                                                                                                            • Instruction ID: 11bcda9f69f1f7f2192272651011618fbe9a360d6213d5362c75e6f6ad0d1691
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e008b3fe25645c420bb524d8f5ec445355e06715b0fa383b64c6e5b3b3f0fe45
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D96207756082859FCB18CF68C494AA8BFE1FF95304F08856DEC9A8B346D734ED45CB91
                                                                                                                                                                                                                            Function 005C1476 Relevance: .7, Instructions: 694COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 7b613aa6936206879556b4b98a40ab473639d5810861dad884f2e1ee316ea20b
                                                                                                                                                                                                                            • Instruction ID: 9a483960ef91062ea555f7cdade97894ef361101886addbd2267074c25f038a3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7b613aa6936206879556b4b98a40ab473639d5810861dad884f2e1ee316ea20b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0F525A726087018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D734EA19CB86
                                                                                                                                                                                                                            Function 005C9111 Relevance: .5, Instructions: 528COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 5d487350712f64b8544cb918d1885170430f5ea8894ec6a1d5ba11f67e9786ba
                                                                                                                                                                                                                            • Instruction ID: bb2db805066ea0609f5f4f305299aeb687a84117801e621780b341a174544467
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5d487350712f64b8544cb918d1885170430f5ea8894ec6a1d5ba11f67e9786ba
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8E1204716047468FC728CF68C499BB9BBE0FF84304F10892EE59BC7681D378A995CB49
                                                                                                                                                                                                                            Function 005BE394 Relevance: .5, Instructions: 460COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: a4a365d62a8d961efaea75d10f6eb8af42116bb82a415d785a01b9a9941ade92
                                                                                                                                                                                                                            • Instruction ID: 29dda8f900e947d029c969934f28938df4400f6322a26fc31d1343f1fc29a67d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a4a365d62a8d961efaea75d10f6eb8af42116bb82a415d785a01b9a9941ade92
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7FF17871A087528FC724CF28C59A5AABFE5FFD9304F184A2EF48597252DB30E905CB52
                                                                                                                                                                                                                            Function 005C0949 Relevance: .3, Instructions: 330COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: adabe4dadf57b7dea3920a0937c30b24c927d5ef8b882834fd8aedbfc1abd1e9
                                                                                                                                                                                                                            • Instruction ID: 55e8b9a23f0bb5322181bf9f073fc0f1b5fc9aaf0252fc381198079ac837ba81
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: adabe4dadf57b7dea3920a0937c30b24c927d5ef8b882834fd8aedbfc1abd1e9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4BE147B45183918FC304CF29D49492ABBF0FB99304F46095EF9D897352D239EA19DFA2
                                                                                                                                                                                                                            Function 005C60F7 Relevance: .3, Instructions: 278COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 1a4f988d0696cb699c0509177fc809113231aefe4c29b141f3b8194f1373669e
                                                                                                                                                                                                                            • Instruction ID: eb4a4c280c92512fd37a6621c90a90671f15a7207630d6809f0dfadf8f36c187
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1a4f988d0696cb699c0509177fc809113231aefe4c29b141f3b8194f1373669e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EB9134B02047469FDB24EFA8D895FFA7FD5BB94304F100C2DE5978B282EA74A644C751
                                                                                                                                                                                                                            Function 005C6445 Relevance: .3, Instructions: 254COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 2a8b91c39fd6a27cc8f5245132d7c7f32c6169f7cc345fada8f76bc89d6d8228
                                                                                                                                                                                                                            • Instruction ID: c8bf4f64d5965b620984ff323984b4724ec29faceac2424f9ca2af2f5fea631e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2a8b91c39fd6a27cc8f5245132d7c7f32c6169f7cc345fada8f76bc89d6d8228
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 758117717043425FDB24EEA8C8D1FBE7FD5BBD4304F10093EE9868B283DA649A858795
                                                                                                                                                                                                                            Function 005D7967 Relevance: .2, Instructions: 237COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: d66fbd7d07fab13e2f5d7b42cdb322daa7606aa66140c67a04c2ef8f8073537a
                                                                                                                                                                                                                            • Instruction ID: 38cc1c8c54547a3c69087d2d66766bc4d17764528094b085a0a7c28ae21cf948
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d66fbd7d07fab13e2f5d7b42cdb322daa7606aa66140c67a04c2ef8f8073537a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7A615B7264C70E66DE349B6C88AABBE6F94FB4D700F14091BE982DB381F6119E81C355
                                                                                                                                                                                                                            Function 005D7738 Relevance: .2, Instructions: 214COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
                                                                                                                                                                                                                            • Instruction ID: 3d9e26cc8bdc698857c1d2296b8e7b9436b61a5198dea636c8b7a72389152115
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6D51366160C60E56DB38896C855E7BE6F85FB5D300F180D0BD442D7382F605ED46D396
                                                                                                                                                                                                                            Function 005C0FAC Relevance: .2, Instructions: 171COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 570ce40a7f2c24b9d5bb3314da7da03895acfe43b5c47c0a2549e092b8930bac
                                                                                                                                                                                                                            • Instruction ID: 434e96c61980df5a91a80f60097d95df676fd8a2f401439138372dac8ee3f7bf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 570ce40a7f2c24b9d5bb3314da7da03895acfe43b5c47c0a2549e092b8930bac
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 085125715083D64FC711DF78848896EBFE1AEDB314F4A089DE4E95B243D221E68ACB52
                                                                                                                                                                                                                            Function 005C2125 Relevance: .1, Instructions: 148COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 43b7457ea95856f7333e11d402464a49db70a6516cbdf9cb3bbdab420efac42f
                                                                                                                                                                                                                            • Instruction ID: ec19b473f8656b75e1e230b4ffb5d1e982919635fc43c7b667c6ab681695a5bd
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 43b7457ea95856f7333e11d402464a49db70a6516cbdf9cb3bbdab420efac42f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BA51E1B1A087119FC758CF19D88055AF7E1FF88314F058A2EE899E3301DB30E955CB96
                                                                                                                                                                                                                            Function 005C5E86 Relevance: .1, Instructions: 112COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: a36805445e229c2b90d29c9fa108318b87a70c956e41b8f0a663b46aa5c9b3d3
                                                                                                                                                                                                                            • Instruction ID: 68c0b9e816a9b97beb95dda2ce115d5efb75ff8d1e09a1f8e1c76e8d9100e538
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a36805445e229c2b90d29c9fa108318b87a70c956e41b8f0a663b46aa5c9b3d3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9D31DDB1614B068FCB18DEA8C851AAEBFD0FBA9300F10492DE495C7342D774F949CB95
                                                                                                                                                                                                                            Function 005DF172 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ___free_lconv_mon.LIBCMT ref: 005DF1B6
                                                                                                                                                                                                                              • Part of subcall function 005DED51: _free.LIBCMT ref: 005DED6E
                                                                                                                                                                                                                              • Part of subcall function 005DED51: _free.LIBCMT ref: 005DED80
                                                                                                                                                                                                                              • Part of subcall function 005DED51: _free.LIBCMT ref: 005DED92
                                                                                                                                                                                                                              • Part of subcall function 005DED51: _free.LIBCMT ref: 005DEDA4
                                                                                                                                                                                                                              • Part of subcall function 005DED51: _free.LIBCMT ref: 005DEDB6
                                                                                                                                                                                                                              • Part of subcall function 005DED51: _free.LIBCMT ref: 005DEDC8
                                                                                                                                                                                                                              • Part of subcall function 005DED51: _free.LIBCMT ref: 005DEDDA
                                                                                                                                                                                                                              • Part of subcall function 005DED51: _free.LIBCMT ref: 005DEDEC
                                                                                                                                                                                                                              • Part of subcall function 005DED51: _free.LIBCMT ref: 005DEDFE
                                                                                                                                                                                                                              • Part of subcall function 005DED51: _free.LIBCMT ref: 005DEE10
                                                                                                                                                                                                                              • Part of subcall function 005DED51: _free.LIBCMT ref: 005DEE22
                                                                                                                                                                                                                              • Part of subcall function 005DED51: _free.LIBCMT ref: 005DEE34
                                                                                                                                                                                                                              • Part of subcall function 005DED51: _free.LIBCMT ref: 005DEE46
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DF1AB
                                                                                                                                                                                                                              • Part of subcall function 005DBAFA: RtlFreeHeap.NTDLL(00000000,00000000,?,005DEEE6,?,00000000,?,00000000,?,005DEF0D,?,00000007,?,?,005DF30A,?), ref: 005DBB10
                                                                                                                                                                                                                              • Part of subcall function 005DBAFA: GetLastError.KERNEL32(?,?,005DEEE6,?,00000000,?,00000000,?,005DEF0D,?,00000007,?,?,005DF30A,?,?), ref: 005DBB22
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DF1CD
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DF1E2
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DF1ED
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DF20F
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DF222
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DF230
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DF23B
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DF273
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DF27A
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DF297
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DF2AF
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                                                                                                                                                            • String ID: h)_
                                                                                                                                                                                                                            • API String ID: 161543041-102207492
                                                                                                                                                                                                                            • Opcode ID: 59344fbc47433fb9b18dadbe22b1226f0cee8959395776c06775802e49fa94ff
                                                                                                                                                                                                                            • Instruction ID: 5689486e1ebc67f7701957334a2f22b3c74e743d0c10ac70da0416f0722f79c5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 59344fbc47433fb9b18dadbe22b1226f0cee8959395776c06775802e49fa94ff
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 98312936600606EFEB30AA6DD849B967BEABF85310F25442BF44AD6351DF71AD80CB10
                                                                                                                                                                                                                            Function 005CB631 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 126memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005CB656
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005CB6F6
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?), ref: 005CB705
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 005CB726
                                                                                                                                                                                                                            • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 005CB74D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Global_wcslen$AllocByteCharCreateMultiStreamWide
                                                                                                                                                                                                                            • String ID: F.vK]$</html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
                                                                                                                                                                                                                            • API String ID: 1777411235-1592714848
                                                                                                                                                                                                                            • Opcode ID: 86e92fb64af88f59413c5fe7f172206789cf626ab38481cbfdde2202316352da
                                                                                                                                                                                                                            • Instruction ID: 275e268cd7945320459235302658ddb4e534eec57f3e99e38c8058d3eee1e93c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 86e92fb64af88f59413c5fe7f172206789cf626ab38481cbfdde2202316352da
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7A3115321083467EE729ABB49C4BF6B7F9CFFA1350F14011FF84196292FB64984583A5
                                                                                                                                                                                                                            Function 005BCE64 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 202COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ClearH_prolog3Variant
                                                                                                                                                                                                                            • String ID: K]$Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10$f]
                                                                                                                                                                                                                            • API String ID: 3629354427-644455545
                                                                                                                                                                                                                            • Opcode ID: fabe21d82e31197d0642e0ba9b62ca31f89cb870b26cc0bb1a2a510331347b95
                                                                                                                                                                                                                            • Instruction ID: 1c1a195165b4c9a70f219ee22e4ce035502f936a2103fd9e695ca3bccc8e93b2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fabe21d82e31197d0642e0ba9b62ca31f89cb870b26cc0bb1a2a510331347b95
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 80717D75A00219DFDB18DFA4CC94DBEBFB9BF98350B140169E546AB2A0CB30BC01CB64
                                                                                                                                                                                                                            Function 005CF9EE Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 86windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetWindow.USER32(?,00000005), ref: 005CFA20
                                                                                                                                                                                                                            • GetClassNameW.USER32(00000000,?,00000800), ref: 005CFA4C
                                                                                                                                                                                                                              • Part of subcall function 005C4168: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,005BE084,00000000,.exe,?,?,00000800,?,?,?,005CAD5D), ref: 005C417E
                                                                                                                                                                                                                            • GetWindowLongW.USER32(00000000,000000F0), ref: 005CFA68
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 005CFA7F
                                                                                                                                                                                                                            • GetObjectW.GDI32(00000000,00000018,?), ref: 005CFA93
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 005CFABC
                                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 005CFAC3
                                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000002), ref: 005CFACC
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
                                                                                                                                                                                                                            • String ID: STATIC
                                                                                                                                                                                                                            • API String ID: 3820355801-1882779555
                                                                                                                                                                                                                            • Opcode ID: 0992cd5b70a26c2515a8551e9e1e8189d35a612b47dd074ec241cba5f4d51d5f
                                                                                                                                                                                                                            • Instruction ID: a5839bef3f9c1990609282ac1b4a6a41dcb18f11d51d4eae2fe319fc577a2728
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0992cd5b70a26c2515a8551e9e1e8189d35a612b47dd074ec241cba5f4d51d5f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5C2128725447117FE320ABB49C4AFEF7EADBF88700F08442AF949A6191DB74990187A5
                                                                                                                                                                                                                            Function 005DB8B1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB8C5
                                                                                                                                                                                                                              • Part of subcall function 005DBAFA: RtlFreeHeap.NTDLL(00000000,00000000,?,005DEEE6,?,00000000,?,00000000,?,005DEF0D,?,00000007,?,?,005DF30A,?), ref: 005DBB10
                                                                                                                                                                                                                              • Part of subcall function 005DBAFA: GetLastError.KERNEL32(?,?,005DEEE6,?,00000000,?,00000000,?,005DEF0D,?,00000007,?,?,005DF30A,?,?), ref: 005DBB22
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB8D1
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB8DC
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB8E7
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB8F2
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB8FD
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB908
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB913
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB91E
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB92C
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 776569668-0
                                                                                                                                                                                                                            • Opcode ID: d093fc1c15850f6a7fd5161df2909031e01c2c9ff028e10c5d049af048960e31
                                                                                                                                                                                                                            • Instruction ID: 9f7a0e133cd91c38327b2a2bd74cf62a8242bf7dc05e95653f1bf11e832eb7bb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d093fc1c15850f6a7fd5161df2909031e01c2c9ff028e10c5d049af048960e31
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C2119979100149EFDB11EF59C996CD93F76FF88350B428067F9098B222D771DA519B80
                                                                                                                                                                                                                            Function 005D5451 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
                                                                                                                                                                                                                            • String ID: csm$csm$csm
                                                                                                                                                                                                                            • API String ID: 322700389-393685449
                                                                                                                                                                                                                            • Opcode ID: 7fb86f83cf7bb254ad5ac17391bd8f3dffe6185c33995ffa3aaa268acb0ef763
                                                                                                                                                                                                                            • Instruction ID: e670c2a2a5251be08f95546e53293f6af0183d9755c17832c116103b90f78851
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7fb86f83cf7bb254ad5ac17391bd8f3dffe6185c33995ffa3aaa268acb0ef763
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6EB14471800A0AEFCF25DFA8D8859AEBBB5FF54310B64455BE8016B312E731EA51CF91
                                                                                                                                                                                                                            Function 005E1CDD Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,005E2452,00000000,00000000,00000000,00000000,00000000,?), ref: 005E1D1F
                                                                                                                                                                                                                            • __fassign.LIBCMT ref: 005E1D9A
                                                                                                                                                                                                                            • __fassign.LIBCMT ref: 005E1DB5
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 005E1DDB
                                                                                                                                                                                                                            • WriteFile.KERNEL32(?,00000000,00000000,R$^,00000000,?,?,?,?,?,?,?,?,?,005E2452,00000000), ref: 005E1DFA
                                                                                                                                                                                                                            • WriteFile.KERNEL32(?,00000000,00000001,R$^,00000000,?,?,?,?,?,?,?,?,?,005E2452,00000000), ref: 005E1E33
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                                                                                                                                                            • String ID: R$^
                                                                                                                                                                                                                            • API String ID: 1324828854-3980574361
                                                                                                                                                                                                                            • Opcode ID: 7757b6989f95ff410518d274da17850322a5a62e7b83cb6c7d93efd6fd90c524
                                                                                                                                                                                                                            • Instruction ID: a7c8acbc3871c33a0519d947a88b32c47077be78bf1177c349d975a09400bfce
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7757b6989f95ff410518d274da17850322a5a62e7b83cb6c7d93efd6fd90c524
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8E51C171A006899FDB14CFA8DC85AEEBFB9FF18310F14451AF996E7251D7309940CB64
                                                                                                                                                                                                                            Function 005CD8C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005B1366: GetDlgItem.USER32(00000000,00003021), ref: 005B13AA
                                                                                                                                                                                                                              • Part of subcall function 005B1366: SetWindowTextW.USER32(00000000,005E65F4), ref: 005B13C0
                                                                                                                                                                                                                            • EndDialog.USER32(?,00000001), ref: 005CD910
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000080,00000001,?), ref: 005CD937
                                                                                                                                                                                                                            • SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 005CD950
                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,?), ref: 005CD961
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000065), ref: 005CD96A
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 005CD97E
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 005CD994
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Item$TextWindow$Dialog
                                                                                                                                                                                                                            • String ID: LICENSEDLG
                                                                                                                                                                                                                            • API String ID: 3214253823-2177901306
                                                                                                                                                                                                                            • Opcode ID: 698e0edaa7ca3ae42b11843cd2fd2bffd73a87b27e16862f4a06066f0c4631e4
                                                                                                                                                                                                                            • Instruction ID: 0925dad82b440a4e16b7694571055af2e7015df94de9dc628f0190bbb76af7d7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 698e0edaa7ca3ae42b11843cd2fd2bffd73a87b27e16862f4a06066f0c4631e4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 622196362442157FD7115FA5EC4EFBB3F7EFB4AB81F08942AF601E11A0CA61A901D671
                                                                                                                                                                                                                            Function 005BBF89 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005BBFA3
                                                                                                                                                                                                                              • Part of subcall function 005C34D7: GetSystemTime.KERNEL32(?,00000000), ref: 005C34EF
                                                                                                                                                                                                                              • Part of subcall function 005C34D7: SystemTimeToFileTime.KERNEL32(?,?), ref: 005C34FD
                                                                                                                                                                                                                              • Part of subcall function 005C3480: __aulldiv.LIBCMT ref: 005C3489
                                                                                                                                                                                                                            • __aulldiv.LIBCMT ref: 005BBFCF
                                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,?,?,?,?), ref: 005BBFD6
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005BC001
                                                                                                                                                                                                                              • Part of subcall function 005B4C00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005B4C13
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005BC00B
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005BC061
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005BC06B
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Time_wcslen$System__aulldiv_swprintf$CurrentFileProcess__vswprintf_c_l
                                                                                                                                                                                                                            • String ID: %u.%03u
                                                                                                                                                                                                                            • API String ID: 2956649372-1114938957
                                                                                                                                                                                                                            • Opcode ID: cc1dd888413735827003eb23ee63046b28e7c39bb6b0f7bac069f04a64166c7f
                                                                                                                                                                                                                            • Instruction ID: b22ee55c0279501f9aa0361d5a9572c6c68aa102e830f5c397645940bdb02fd5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cc1dd888413735827003eb23ee63046b28e7c39bb6b0f7bac069f04a64166c7f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BD2150716043459FC624EB69CC89EAF7FDCBBD4740F40491EB444D7252DA34A90887A6
                                                                                                                                                                                                                            Function 005CCBC8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 005CCBEE
                                                                                                                                                                                                                            • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 005CCC05
                                                                                                                                                                                                                            • SystemTimeToFileTime.KERNEL32(?,?), ref: 005CCC19
                                                                                                                                                                                                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 005CCC2A
                                                                                                                                                                                                                            • GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 005CCC42
                                                                                                                                                                                                                            • GetTimeFormatW.KERNEL32(00000400,?,?,00000000,00000000,00000032), ref: 005CCC66
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005CCC85
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Time$System$File$Format$DateLocalSpecific_swprintf
                                                                                                                                                                                                                            • String ID: %s %s
                                                                                                                                                                                                                            • API String ID: 385609497-2939940506
                                                                                                                                                                                                                            • Opcode ID: 69e9a7a04a58d53f2bccdfe183dd855867e5e8a5dc54a22ac1f1bf59e662d5f5
                                                                                                                                                                                                                            • Instruction ID: 3ba5ea27a814a418ecd9182f1dd4747930f21072ed77285aaf3997c100573738
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 69e9a7a04a58d53f2bccdfe183dd855867e5e8a5dc54a22ac1f1bf59e662d5f5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4E212CB250024DABDB25DFA1DD88EEE77BCFB59340F00456AFA19D7112E6309A09CB60
                                                                                                                                                                                                                            Function 005D2360 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,005BCEA9,005BCEAB,00000000,00000000,8C7CEEEB,00000001,00000000,00000000,?,005BCD87,?,00000004,005BCEA9,ROOT\CIMV2), ref: 005D23E9
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,005BCEA9,?,00000000,00000000,?,?,005BCD87,?,00000004,005BCEA9), ref: 005D2464
                                                                                                                                                                                                                            • SysAllocString.OLEAUT32(00000000), ref: 005D246F
                                                                                                                                                                                                                            • _com_issue_error.COMSUPP ref: 005D2498
                                                                                                                                                                                                                            • _com_issue_error.COMSUPP ref: 005D24A2
                                                                                                                                                                                                                            • GetLastError.KERNEL32(80070057,8C7CEEEB,00000001,00000000,00000000,?,005BCD87,?,00000004,005BCEA9,ROOT\CIMV2), ref: 005D24A7
                                                                                                                                                                                                                            • _com_issue_error.COMSUPP ref: 005D24BA
                                                                                                                                                                                                                            • GetLastError.KERNEL32(00000000,?,005BCD87,?,00000004,005BCEA9,ROOT\CIMV2), ref: 005D24D0
                                                                                                                                                                                                                            • _com_issue_error.COMSUPP ref: 005D24E3
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1353541977-0
                                                                                                                                                                                                                            • Opcode ID: d19f9dce90f412a3836dfa20605920ad4698d0fa526ea95487ec03ed86c2e26d
                                                                                                                                                                                                                            • Instruction ID: d9125b174abfcb4f4506e030a4f6e0c17216209e2349519a9bc886f3047c7ece
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d19f9dce90f412a3836dfa20605920ad4698d0fa526ea95487ec03ed86c2e26d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FD41E771A00305ABDB249F6CDC49BAEBFA8FB68750F10462BF905E7351D7359900CBA5
                                                                                                                                                                                                                            Function 005DC06A Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: __alldvrm$_strrchr
                                                                                                                                                                                                                            • String ID: =z]$=z]$=z]
                                                                                                                                                                                                                            • API String ID: 1036877536-4149509115
                                                                                                                                                                                                                            • Opcode ID: d14ae59a6c47695d102f38ce8bebab2561187863f3de3b9f7c7780fcd14afeb7
                                                                                                                                                                                                                            • Instruction ID: ce4efef39c4ca49653ad29ee1002387305aed0b36c8ddb31246c56119db56209
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d14ae59a6c47695d102f38ce8bebab2561187863f3de3b9f7c7780fcd14afeb7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9DA135769043879FDB35CE9CC8917AEBFA5FF52350F1845ABE4859B382C2348941CB50
                                                                                                                                                                                                                            Function 005D4F20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _ValidateLocalCookies.LIBCMT ref: 005D4F57
                                                                                                                                                                                                                            • ___except_validate_context_record.LIBVCRUNTIME ref: 005D4F5F
                                                                                                                                                                                                                            • _ValidateLocalCookies.LIBCMT ref: 005D4FE8
                                                                                                                                                                                                                            • __IsNonwritableInCurrentImage.LIBCMT ref: 005D5013
                                                                                                                                                                                                                            • _ValidateLocalCookies.LIBCMT ref: 005D5068
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                                                            • String ID: M]$csm
                                                                                                                                                                                                                            • API String ID: 1170836740-4223030912
                                                                                                                                                                                                                            • Opcode ID: 85fc2a4cd747f262928cbcda89ad454eff448a502b4ed6160fe108ba668b3d3a
                                                                                                                                                                                                                            • Instruction ID: e21d919ff4dd190664207bb6b2cc0f8532752e21c5d5530153247d23c9687c10
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 85fc2a4cd747f262928cbcda89ad454eff448a502b4ed6160fe108ba668b3d3a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9B419274A0025AABCF20DF6CC889A9EBFB5FF45314F148157E9149B362D7329A06CF91
                                                                                                                                                                                                                            Function 005C32F8 Relevance: 12.1, APIs: 8, Instructions: 131timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • __aulldiv.LIBCMT ref: 005C331D
                                                                                                                                                                                                                              • Part of subcall function 005BD076: GetVersionExW.KERNEL32(?), ref: 005BD0A7
                                                                                                                                                                                                                            • FileTimeToLocalFileTime.KERNEL32(000000FF,?,?,000000FF,00000064,00000000,?,00000000), ref: 005C3340
                                                                                                                                                                                                                            • FileTimeToSystemTime.KERNEL32(000000FF,?,?,000000FF,00000064,00000000,?,00000000), ref: 005C3352
                                                                                                                                                                                                                            • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 005C3363
                                                                                                                                                                                                                            • SystemTimeToFileTime.KERNEL32(?,?), ref: 005C3373
                                                                                                                                                                                                                            • SystemTimeToFileTime.KERNEL32(?,?), ref: 005C3383
                                                                                                                                                                                                                            • FileTimeToSystemTime.KERNEL32(?,?,?), ref: 005C33BE
                                                                                                                                                                                                                            • __aullrem.LIBCMT ref: 005C3464
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1247370737-0
                                                                                                                                                                                                                            • Opcode ID: ff1a9191a78d542ab40de9d087fd84370f8a11373d7bbc263f50f1e8444d6fc2
                                                                                                                                                                                                                            • Instruction ID: ea11259b199b4c73bd4df0d27083947d7cbfbf9ec0a6e5ac5333c584d9c40561
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ff1a9191a78d542ab40de9d087fd84370f8a11373d7bbc263f50f1e8444d6fc2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 585145B1508345AFC714DFA4C88496BBBE9FF98754F00892EF596C6210E734EA08CB62
                                                                                                                                                                                                                            Function 005CBC7E Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _wcslen
                                                                                                                                                                                                                            • String ID: </p>$</style>$<br>$<style>$>
                                                                                                                                                                                                                            • API String ID: 176396367-3568243669
                                                                                                                                                                                                                            • Opcode ID: aa2fe5cd59803332a265e2f3c1543bab1943d6edfeb87fb1445fac699849417c
                                                                                                                                                                                                                            • Instruction ID: 8de73233f6a3876ce2bb5e68120c5d3b668d735705f4ddedf8dd882b2cb28010
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: aa2fe5cd59803332a265e2f3c1543bab1943d6edfeb87fb1445fac699849417c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A25119566403575EFB345A995823F767BE4FFA0790F68042EFDC28B181FB548C418251
                                                                                                                                                                                                                            Function 005BACE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 149fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetLongPathNameW.KERNEL32(?,?,00000800), ref: 005BAD2B
                                                                                                                                                                                                                            • GetShortPathNameW.KERNEL32(?,?,00000800), ref: 005BAD4A
                                                                                                                                                                                                                              • Part of subcall function 005BE208: _wcslen.LIBCMT ref: 005BE210
                                                                                                                                                                                                                              • Part of subcall function 005C4168: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,005BE084,00000000,.exe,?,?,00000800,?,?,?,005CAD5D), ref: 005C417E
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005BADEC
                                                                                                                                                                                                                              • Part of subcall function 005B4C00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005B4C13
                                                                                                                                                                                                                            • MoveFileW.KERNEL32(?,?), ref: 005BAE5E
                                                                                                                                                                                                                            • MoveFileW.KERNEL32(?,?), ref: 005BAE9E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileMoveNamePath$CompareLongShortString__vswprintf_c_l_swprintf_wcslen
                                                                                                                                                                                                                            • String ID: rtmp%d
                                                                                                                                                                                                                            • API String ID: 2133196417-3303766350
                                                                                                                                                                                                                            • Opcode ID: 2429f3b29c3d42aa7978c2b56f2daaab93e8441a8f4bf5ebf2939ec08f7a9cfe
                                                                                                                                                                                                                            • Instruction ID: 0d793ffcbaaa9465216fd2fe5989d8bdb9c0748205ac3144cbb49a924d71cca9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2429f3b29c3d42aa7978c2b56f2daaab93e8441a8f4bf5ebf2939ec08f7a9cfe
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 585160719006596ADB20EBA0CC89EEF7B7CBF54340F0408A9F556A7141EB74AA88DF61
                                                                                                                                                                                                                            Function 005CBE55 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000000), ref: 005CBE8A
                                                                                                                                                                                                                            • GetWindowRect.USER32(?,?), ref: 005CBED1
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000005,00000000), ref: 005CBF6C
                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,00000000), ref: 005CBF74
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,00000005), ref: 005CBF8A
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$Show$RectText
                                                                                                                                                                                                                            • String ID: RarHtmlClassName
                                                                                                                                                                                                                            • API String ID: 3937224194-1658105358
                                                                                                                                                                                                                            • Opcode ID: e084b543f96326544fcffea2fe280fb141205aea143ce2af984f19bb562d4142
                                                                                                                                                                                                                            • Instruction ID: 968c45b775da79b5971989f75c71a6dc79a62ff8e7a3208f6f2001eb47ba8861
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e084b543f96326544fcffea2fe280fb141205aea143ce2af984f19bb562d4142
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2B417F72508201AFDB209FA49C4AF9B7FB9FF88701F19855EF9459A251DB70D804CBA1
                                                                                                                                                                                                                            Function 005CB8D5 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _wcslen
                                                                                                                                                                                                                            • String ID: $&nbsp;$<br>$<style>body{font-family:"Arial";font-size:12;}</style>
                                                                                                                                                                                                                            • API String ID: 176396367-3743748572
                                                                                                                                                                                                                            • Opcode ID: a6a649c45ef739e5750d4a793d5aa8f1aac7d0b8fc56326a8f5ead7eb70c157b
                                                                                                                                                                                                                            • Instruction ID: c82ea33f43b6a5ac17578e33c5a13d55aa336bb21c4e9174c91388d912625512
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a6a649c45ef739e5750d4a793d5aa8f1aac7d0b8fc56326a8f5ead7eb70c157b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FA3128226443465EE634ABD49843F76BBA4FB90360F60442FE68597380FBB1AC4583A1
                                                                                                                                                                                                                            Function 005DEEF4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005DEEB8: _free.LIBCMT ref: 005DEEE1
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DEF42
                                                                                                                                                                                                                              • Part of subcall function 005DBAFA: RtlFreeHeap.NTDLL(00000000,00000000,?,005DEEE6,?,00000000,?,00000000,?,005DEF0D,?,00000007,?,?,005DF30A,?), ref: 005DBB10
                                                                                                                                                                                                                              • Part of subcall function 005DBAFA: GetLastError.KERNEL32(?,?,005DEEE6,?,00000000,?,00000000,?,005DEF0D,?,00000007,?,?,005DF30A,?,?), ref: 005DBB22
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DEF4D
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DEF58
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DEFAC
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DEFB7
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DEFC2
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DEFCD
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 776569668-0
                                                                                                                                                                                                                            • Opcode ID: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
                                                                                                                                                                                                                            • Instruction ID: 9238e96f303c405f60527ef6e930674663ac71594bb1ac5b0e1252aff5143fba
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1F11D872940B06AAE530F7B5CC0BFCB7FADBF84701F404817F29A6A392DA75A5094754
                                                                                                                                                                                                                            Function 005B8C95 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 51COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000020,?), ref: 005B8CB2
                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 005B8CF6
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 005B8D05
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseCurrentErrorHandleLastProcess
                                                                                                                                                                                                                            • String ID: @]$J]$^]
                                                                                                                                                                                                                            • API String ID: 1009092642-895915026
                                                                                                                                                                                                                            • Opcode ID: 6325b77e60ad4d14e6401c9164c75924e80ce272073c87711ef2fa37990f5117
                                                                                                                                                                                                                            • Instruction ID: 1831530bcb9ac41e1becdab5e18571a42f38261d4a4708cd99141cc9262051a4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6325b77e60ad4d14e6401c9164c75924e80ce272073c87711ef2fa37990f5117
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DF0100B0601219AFDB119FA5DC89AFFBBBDFB14385F44541AB501E2190DA309E48DB70
                                                                                                                                                                                                                            Function 005D0ACB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,005D0B46,005D0AA9,005D0D4A), ref: 005D0AE2
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 005D0AF8
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 005D0B0D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                            • String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
                                                                                                                                                                                                                            • API String ID: 667068680-1718035505
                                                                                                                                                                                                                            • Opcode ID: c59a4ff05ebdeb550eb4441a54884ce2be8b16c51d89514e9d985e03f715fe27
                                                                                                                                                                                                                            • Instruction ID: c57aae4ae7ae3eb71c915a3923abd03cae8211f9416425838cf8b5af31a63dee
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c59a4ff05ebdeb550eb4441a54884ce2be8b16c51d89514e9d985e03f715fe27
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C5F0F431755761876B308FA85CC977E6E99BE61394734283B9845D73C0EA108C8193D0
                                                                                                                                                                                                                            Function 005C418A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005C4192
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005C41A3
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005C41B3
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005C41C1
                                                                                                                                                                                                                            • CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,005BD2D3,?,?,00000000,?,?,?), ref: 005C41DC
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _wcslen$CompareString
                                                                                                                                                                                                                            • String ID: <
                                                                                                                                                                                                                            • API String ID: 3397213944-4251816714
                                                                                                                                                                                                                            • Opcode ID: b379af0090c8c0793cfc1d264da2f64d4c7d2cb5ebe4e7c191b567a333094519
                                                                                                                                                                                                                            • Instruction ID: d0d4e35ca77bb875c2214425c507f1daa716534b616aa31347da5d485dc69309
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b379af0090c8c0793cfc1d264da2f64d4c7d2cb5ebe4e7c191b567a333094519
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 88F06D32048164BFCF221F94EC49D8A3F26FB907B0B118006F6195A161CA329592DAD0
                                                                                                                                                                                                                            Function 005DB160 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB17E
                                                                                                                                                                                                                              • Part of subcall function 005DBAFA: RtlFreeHeap.NTDLL(00000000,00000000,?,005DEEE6,?,00000000,?,00000000,?,005DEF0D,?,00000007,?,?,005DF30A,?), ref: 005DBB10
                                                                                                                                                                                                                              • Part of subcall function 005DBAFA: GetLastError.KERNEL32(?,?,005DEEE6,?,00000000,?,00000000,?,005DEF0D,?,00000007,?,?,005DF30A,?,?), ref: 005DBB22
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB190
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB1A3
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB1B4
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB1C5
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                                            • String ID: p,_
                                                                                                                                                                                                                            • API String ID: 776569668-1767216777
                                                                                                                                                                                                                            • Opcode ID: e025ab5d712a6b1d48c8f1cb824b1dab02ee75afbe7e2ce4e67c795ecbfa4dab
                                                                                                                                                                                                                            • Instruction ID: 6159d348c5672c07b587cd90d78e9b561559a6c62d6a47db4725cfe95683bd81
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e025ab5d712a6b1d48c8f1cb824b1dab02ee75afbe7e2ce4e67c795ecbfa4dab
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6F017B8800221EB9B21AB19EC054E83F67F79972471AA20BF516923A0CB7B4905DF91
                                                                                                                                                                                                                            Function 005C3583 Relevance: 9.1, APIs: 6, Instructions: 104timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 005C35E6
                                                                                                                                                                                                                              • Part of subcall function 005BD076: GetVersionExW.KERNEL32(?), ref: 005BD0A7
                                                                                                                                                                                                                            • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 005C360A
                                                                                                                                                                                                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 005C3624
                                                                                                                                                                                                                            • TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 005C3637
                                                                                                                                                                                                                            • SystemTimeToFileTime.KERNEL32(?,?), ref: 005C3647
                                                                                                                                                                                                                            • SystemTimeToFileTime.KERNEL32(?,?), ref: 005C3657
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Time$File$System$Local$SpecificVersion
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2092733347-0
                                                                                                                                                                                                                            • Opcode ID: 61babb7db58ca9616e6a22c1049b19d6786966e07ca588a3d6e9cfe9845020eb
                                                                                                                                                                                                                            • Instruction ID: 6b4f113d2991c4988c8e0f79fa62ce8f1a2fbdb3da0a1d6f98bf01feafecb436
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 61babb7db58ca9616e6a22c1049b19d6786966e07ca588a3d6e9cfe9845020eb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D4411A761083559FCB44DFA8C88499BBBE8FFA8744F04891EF995C7210E730D549CBA6
                                                                                                                                                                                                                            Function 005D511A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,005D5111,005D4ECC,005D21B4), ref: 005D5128
                                                                                                                                                                                                                            • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 005D5136
                                                                                                                                                                                                                            • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005D514F
                                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000,005D5111,005D4ECC,005D21B4), ref: 005D51A1
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3852720340-0
                                                                                                                                                                                                                            • Opcode ID: 632b8c5a819f1644a1f83afe6a29bbe21e6eb45a7fec006df4a657d7040da504
                                                                                                                                                                                                                            • Instruction ID: 1fc7f79d4421c52aa787f9e13576f4fc07216ac2dd5a787c5e36f149a676130c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 632b8c5a819f1644a1f83afe6a29bbe21e6eb45a7fec006df4a657d7040da504
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7A01B136109B12AEE63526FCBC8A7262E54FBA1371BA0122BF160863E0FE515C46E344
                                                                                                                                                                                                                            Function 005DB9A5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,005F50C4,005D6E12,005F50C4,?,?,005D688D,?,?,005F50C4), ref: 005DB9A9
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DB9DC
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DBA04
                                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000,?,005F50C4), ref: 005DBA11
                                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000,?,005F50C4), ref: 005DBA1D
                                                                                                                                                                                                                            • _abort.LIBCMT ref: 005DBA23
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLast$_free$_abort
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3160817290-0
                                                                                                                                                                                                                            • Opcode ID: 10fe6581b50ccfc9cc9854277a7401428f7b9818277ad8e17e0bd6a18e06549b
                                                                                                                                                                                                                            • Instruction ID: 4d6e1d652d58088baacedaeecc1bd19b0edec8d15bb474c5c50360791544bd3c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 10fe6581b50ccfc9cc9854277a7401428f7b9818277ad8e17e0bd6a18e06549b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F8F0D136106542E7E675732D6C0EA6A2D2BFBE17B0F230417F605E6392FF258C066161
                                                                                                                                                                                                                            Function 005D004D Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(?,0000000A), ref: 005D0059
                                                                                                                                                                                                                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 005D0073
                                                                                                                                                                                                                            • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005D0084
                                                                                                                                                                                                                            • TranslateMessage.USER32(?), ref: 005D008E
                                                                                                                                                                                                                            • DispatchMessageW.USER32(?), ref: 005D0098
                                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(?,0000000A), ref: 005D00A3
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$ObjectSingleWait$DispatchPeekTranslate
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2148572870-0
                                                                                                                                                                                                                            • Opcode ID: 85fd940e0840b7b80a40d7307dbceeb249e5ce754a7d52d0006d06f89f93b82f
                                                                                                                                                                                                                            • Instruction ID: 7cc3c53627fc9339b790ae7acafbacdb415e1831004d5555411682317300ee21
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 85fd940e0840b7b80a40d7307dbceeb249e5ce754a7d52d0006d06f89f93b82f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 46F03CB2A0122DBBCF309BA6DC4CECB7E7EEF557A2F049012B60AD2050D634C545C7A0
                                                                                                                                                                                                                            Function 005BE033 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005C2663: _wcslen.LIBCMT ref: 005C2669
                                                                                                                                                                                                                              • Part of subcall function 005BD848: _wcsrchr.LIBVCRUNTIME ref: 005BD85F
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005BE105
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005BE14D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _wcslen$_wcsrchr
                                                                                                                                                                                                                            • String ID: .exe$.rar$.sfx
                                                                                                                                                                                                                            • API String ID: 3513545583-31770016
                                                                                                                                                                                                                            • Opcode ID: f5f4468aa7570dd34af2495478d6ba8e371addadf275d4bc55fdc9a6418903a1
                                                                                                                                                                                                                            • Instruction ID: d37685897131993c810bc475c075d43c443e3aa3ca72629832c58130ad6a724b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f5f4468aa7570dd34af2495478d6ba8e371addadf275d4bc55fdc9a6418903a1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8F41E22250075699C7366F78C85BAFB7FA8FF41754F28490EF8C19B180E7A06D81C351
                                                                                                                                                                                                                            Function 005BDA1E Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 134COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005BDA59
                                                                                                                                                                                                                            • GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,005BBD19,?,?,00000800,?,?,?,005BBCD4), ref: 005BDB02
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005BDB70
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _wcslen$CurrentDirectory
                                                                                                                                                                                                                            • String ID: UNC$\\?\
                                                                                                                                                                                                                            • API String ID: 3341907918-253988292
                                                                                                                                                                                                                            • Opcode ID: 4494144f9a46d576fd421f7fce7141679994a96f7782c360d755674c9e789a7f
                                                                                                                                                                                                                            • Instruction ID: 2522f9918d6802f3c019c5a273a16460b81d01eeaa0b3fa03ea5b87c57670166
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4494144f9a46d576fd421f7fce7141679994a96f7782c360d755674c9e789a7f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3A4173325443926AD620AB608C89EFB7FBCFF95780F05485EF5C493141FBA4A985CA72
                                                                                                                                                                                                                            Function 005B10E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _wcslen
                                                                                                                                                                                                                            • String ID: %]
                                                                                                                                                                                                                            • API String ID: 176396367-98552601
                                                                                                                                                                                                                            • Opcode ID: d71edc9ea396e4c537cbacdd787ac8939607cfc97fe42068d443c5986afa98d0
                                                                                                                                                                                                                            • Instruction ID: 6c44e349e3e318f81dc6ef428f5da517e315e5a11fe5efbb6730c523efe65145
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d71edc9ea396e4c537cbacdd787ac8939607cfc97fe42068d443c5986afa98d0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F5418EB16047529BC765DF38C8599AFBBE8BF85300F44492EF989D3250DB30A9098B96
                                                                                                                                                                                                                            Function 005CD9DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • LoadBitmapW.USER32(00000065), ref: 005CD9ED
                                                                                                                                                                                                                            • GetObjectW.GDI32(00000000,00000018,?), ref: 005CDA12
                                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 005CDA44
                                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 005CDA67
                                                                                                                                                                                                                              • Part of subcall function 005CC652: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,005CDA3D,00000066), ref: 005CC665
                                                                                                                                                                                                                              • Part of subcall function 005CC652: SizeofResource.KERNEL32(00000000,?,?,?,005CDA3D,00000066), ref: 005CC67C
                                                                                                                                                                                                                              • Part of subcall function 005CC652: LoadResource.KERNEL32(00000000,?,?,?,005CDA3D,00000066), ref: 005CC693
                                                                                                                                                                                                                              • Part of subcall function 005CC652: LockResource.KERNEL32(00000000,?,?,?,005CDA3D,00000066), ref: 005CC6A2
                                                                                                                                                                                                                              • Part of subcall function 005CC652: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,005CDA3D,00000066), ref: 005CC6BD
                                                                                                                                                                                                                              • Part of subcall function 005CC652: GlobalLock.KERNEL32(00000000), ref: 005CC6CE
                                                                                                                                                                                                                              • Part of subcall function 005CC652: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 005CC6F2
                                                                                                                                                                                                                              • Part of subcall function 005CC652: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 005CC737
                                                                                                                                                                                                                              • Part of subcall function 005CC652: GlobalUnlock.KERNEL32(00000000), ref: 005CC756
                                                                                                                                                                                                                              • Part of subcall function 005CC652: GlobalFree.KERNEL32(00000000), ref: 005CC75D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
                                                                                                                                                                                                                            • String ID: ]
                                                                                                                                                                                                                            • API String ID: 1797374341-3352871620
                                                                                                                                                                                                                            • Opcode ID: f8cd39ab92bc56b53c07c37d999d70f13bc38418f7c68e495d09378e41894b38
                                                                                                                                                                                                                            • Instruction ID: 3e6d7dcb8d4227c563c8733a5f21c6cca46e94f0c736fe70e78b51c42282b1de
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f8cd39ab92bc56b53c07c37d999d70f13bc38418f7c68e495d09378e41894b38
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1701C0725447026FCB1267A89C09FBF7E7ABBC1B62F190029F908E7291DF318D4586B0
                                                                                                                                                                                                                            Function 005CF950 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005B1366: GetDlgItem.USER32(00000000,00003021), ref: 005B13AA
                                                                                                                                                                                                                              • Part of subcall function 005B1366: SetWindowTextW.USER32(00000000,005E65F4), ref: 005B13C0
                                                                                                                                                                                                                            • EndDialog.USER32(?,00000001), ref: 005CF99B
                                                                                                                                                                                                                            • GetDlgItemTextW.USER32(?,00000068,00000800), ref: 005CF9B1
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000066,?), ref: 005CF9C5
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000068), ref: 005CF9D4
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ItemText$DialogWindow
                                                                                                                                                                                                                            • String ID: RENAMEDLG
                                                                                                                                                                                                                            • API String ID: 445417207-3299779563
                                                                                                                                                                                                                            • Opcode ID: 506f7ec4fdee52ddd1fb06689085c457e2f14aec9edd2ecaabb16f35351be410
                                                                                                                                                                                                                            • Instruction ID: 7145dabe529a3513175e62d9c6841f2963e14a2a402f2bf5a77b03d64ca4a045
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 506f7ec4fdee52ddd1fb06689085c457e2f14aec9edd2ecaabb16f35351be410
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3F01F9322443107FDB114BA59C09FB77F6FFB49701F14942AF245A1190C6B2960087B5
                                                                                                                                                                                                                            Function 005DA6C5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,005DA676,?,?,005DA616,?,005EF7B0,0000000C,005DA76D,?,00000002), ref: 005DA6E5
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005DA6F8
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(00000000,?,?,?,005DA676,?,?,005DA616,?,005EF7B0,0000000C,005DA76D,?,00000002,00000000), ref: 005DA71B
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                            • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                            • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                            • Opcode ID: e5f2d719491cd4b6a599bb26ce7db23f2e9e679752be7b2627a71ba4f760cf34
                                                                                                                                                                                                                            • Instruction ID: 4235ae964933f1a597f108445a5ffc57ccd5cc4053daaef4dbcf11662ea1e898
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e5f2d719491cd4b6a599bb26ce7db23f2e9e679752be7b2627a71ba4f760cf34
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B3F0C831501258BBCF149FA5DC89BAEBFB5FF54791F00006AF905A6290CB305E44DB81
                                                                                                                                                                                                                            Function 005B1366 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005C0244: _swprintf.LIBCMT ref: 005C0284
                                                                                                                                                                                                                              • Part of subcall function 005C0244: _strlen.LIBCMT ref: 005C02A5
                                                                                                                                                                                                                              • Part of subcall function 005C0244: SetDlgItemTextW.USER32(?,005F2274,?), ref: 005C02FE
                                                                                                                                                                                                                              • Part of subcall function 005C0244: GetWindowRect.USER32(?,?), ref: 005C0334
                                                                                                                                                                                                                              • Part of subcall function 005C0244: GetClientRect.USER32(?,?), ref: 005C0340
                                                                                                                                                                                                                            • GetDlgItem.USER32(00000000,00003021), ref: 005B13AA
                                                                                                                                                                                                                            • SetWindowTextW.USER32(00000000,005E65F4), ref: 005B13C0
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ItemRectTextWindow$Client_strlen_swprintf
                                                                                                                                                                                                                            • String ID: 0$pP_$pP_
                                                                                                                                                                                                                            • API String ID: 2622349952-3580852510
                                                                                                                                                                                                                            • Opcode ID: 33f92d4d3636b39a6063404121855922113b6bfc073550112445967acd8a4577
                                                                                                                                                                                                                            • Instruction ID: 343a7d1bd3e0114a04fd7c168e3e25edbae7d7811cda6d7304ced51e22fdfe30
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 33f92d4d3636b39a6063404121855922113b6bfc073550112445967acd8a4577
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E7F0D13014464CAACF550F61DC2EBE93FE9BB02394F888814FD4540891EFB4D950DA14
                                                                                                                                                                                                                            Function 005C12F6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005C28AB: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005C28D4
                                                                                                                                                                                                                              • Part of subcall function 005C28AB: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,005C1309,Crypt32.dll,00000000,005C1383,00000200,?,005C1366,00000000,00000000,?), ref: 005C28F4
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 005C1315
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(005FC1F0,CryptUnprotectMemory), ref: 005C1325
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressProc$DirectoryLibraryLoadSystem
                                                                                                                                                                                                                            • String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
                                                                                                                                                                                                                            • API String ID: 2141747552-1753850145
                                                                                                                                                                                                                            • Opcode ID: d7b5bc7546d8830d6ca8ecf86011c1e0b0df3809faf1fb8b1986b0f3d2ae6c44
                                                                                                                                                                                                                            • Instruction ID: 11423ebaff2b59eef8b0410dcb337ebcc9f452eb9cc82522f1f2dfb86223d105
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d7b5bc7546d8830d6ca8ecf86011c1e0b0df3809faf1fb8b1986b0f3d2ae6c44
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 73E08670A40BD19ED7245F759E4DB427EE47F75BD4F448C1DE0C597541D6B4D4408B10
                                                                                                                                                                                                                            Function 005D51FA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AdjustPointer$_abort
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2252061734-0
                                                                                                                                                                                                                            • Opcode ID: 8da39c041a7616237252ac915aeb6162b581d6c4b2e83e5a918982fe7401c338
                                                                                                                                                                                                                            • Instruction ID: e5c22a06ac8a253a007fbe55398fc516dc02a94d3bd2e1cf7ae2c2bd712552af
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8da39c041a7616237252ac915aeb6162b581d6c4b2e83e5a918982fe7401c338
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B051A076500A06AFEB398F5CD845B6A7BA4FF84750F14482BE90547391F771EC84DB90
                                                                                                                                                                                                                            Function 005DE580 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetEnvironmentStringsW.KERNEL32 ref: 005DE589
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005DE5AC
                                                                                                                                                                                                                              • Part of subcall function 005DBC8E: RtlAllocateHeap.NTDLL(00000000,?,?,?,005D6A24,?,0000015D,?,?,?,?,005D7F00,000000FF,00000000,?,?), ref: 005DBCC0
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 005DE5D2
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DE5E5
                                                                                                                                                                                                                            • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 005DE5F4
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 336800556-0
                                                                                                                                                                                                                            • Opcode ID: 65c6bb1b2881f11c9681c8eed5a632fbc13d5bc88240b887d6f54e9e3c154e12
                                                                                                                                                                                                                            • Instruction ID: ede90b380f1ca6a64a0b6bebb3bcaf4d896a49800ebce1b80f92b6df97fc6ab2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 65c6bb1b2881f11c9681c8eed5a632fbc13d5bc88240b887d6f54e9e3c154e12
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DB019E76601212BF2736667E6C8EC7F6E6DFEC2EE4315012BB805CA301EE618D01D2B0
                                                                                                                                                                                                                            Function 005DBA29 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,005DBC80,005DD7D8,?,005DB9D3,00000001,00000364,?,005D688D,?,?,005F50C4), ref: 005DBA2E
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DBA63
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DBA8A
                                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000,?,005F50C4), ref: 005DBA97
                                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000,?,005F50C4), ref: 005DBAA0
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLast$_free
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3170660625-0
                                                                                                                                                                                                                            • Opcode ID: 4a1fee98ce4f551042e157ece9b025491d61067c488803466a4062ba5fa551fa
                                                                                                                                                                                                                            • Instruction ID: f88cf995f8d863ab082108101d82d4d5d57f7253ea77ec9a7913ca32845bb6cc
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4a1fee98ce4f551042e157ece9b025491d61067c488803466a4062ba5fa551fa
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2F012672105602EBA635EB3D5C8A96A2E2FFBD03B17230427F40592351EF608C056120
                                                                                                                                                                                                                            Function 005C2FC9 Relevance: 7.5, APIs: 5, Instructions: 48COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005C32AF: ResetEvent.KERNEL32(?), ref: 005C32C1
                                                                                                                                                                                                                              • Part of subcall function 005C32AF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 005C32D5
                                                                                                                                                                                                                            • ReleaseSemaphore.KERNEL32(?,00000040,00000000,8C7CEEEB,?,?,00000001,?,005E52FF,000000FF,?,005C43C0,?,00000000,?,005B4766), ref: 005C3007
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,005C43C0,?,00000000,?,005B4766,?,?,?,00000000,?,?,?,00000001), ref: 005C3021
                                                                                                                                                                                                                            • DeleteCriticalSection.KERNEL32(?,?,005C43C0,?,00000000,?,005B4766,?,?,?,00000000,?,?,?,00000001,?), ref: 005C303A
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,005C43C0,?,00000000,?,005B4766,?,?,?,00000000,?,?,?,00000001,?), ref: 005C3046
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,005C43C0,?,00000000,?,005B4766,?,?,?,00000000,?,?,?,00000001,?), ref: 005C3052
                                                                                                                                                                                                                              • Part of subcall function 005C30CA: WaitForSingleObject.KERNEL32(?,000000FF,005C31E7,?,?,005C325F,?,?,?,?,?,005C3249), ref: 005C30D0
                                                                                                                                                                                                                              • Part of subcall function 005C30CA: GetLastError.KERNEL32(?,?,005C325F,?,?,?,?,?,005C3249), ref: 005C30DC
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1868215902-0
                                                                                                                                                                                                                            • Opcode ID: ea622eab3893fa02bf21ebcc59655a6b3e2ab540cb9eca66d78df9c022609d3e
                                                                                                                                                                                                                            • Instruction ID: c66e2c890a7eb7d04ec5e355a7dcaed8faaf7a559e650118030d59e18220dbaf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ea622eab3893fa02bf21ebcc59655a6b3e2ab540cb9eca66d78df9c022609d3e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1611C876400754EFC725DFA4DC88FC6BBA9FB18790F00492DF157A2160C7756A08DB50
                                                                                                                                                                                                                            Function 005DEE4F Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DEE67
                                                                                                                                                                                                                              • Part of subcall function 005DBAFA: RtlFreeHeap.NTDLL(00000000,00000000,?,005DEEE6,?,00000000,?,00000000,?,005DEF0D,?,00000007,?,?,005DF30A,?), ref: 005DBB10
                                                                                                                                                                                                                              • Part of subcall function 005DBAFA: GetLastError.KERNEL32(?,?,005DEEE6,?,00000000,?,00000000,?,005DEF0D,?,00000007,?,?,005DF30A,?,?), ref: 005DBB22
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DEE79
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DEE8B
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DEE9D
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DEEAF
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 776569668-0
                                                                                                                                                                                                                            • Opcode ID: 9d13f3d519e864ca1556e33120c0aba14ec3b2971c7a72adfe375ee8fbf96008
                                                                                                                                                                                                                            • Instruction ID: a8f95834be297df88c06f1d2dd2d13558ca4465e1aac995200bca13c12fd846a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9d13f3d519e864ca1556e33120c0aba14ec3b2971c7a72adfe375ee8fbf96008
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E9F0EC72504201EF9674EB6DE886CAA7BEEFB94710B65080BF149DB741CB74FC848A50
                                                                                                                                                                                                                            Function 005CC79C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 240COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005CC629: GetDC.USER32(00000000), ref: 005CC62D
                                                                                                                                                                                                                              • Part of subcall function 005CC629: GetDeviceCaps.GDI32(00000000,0000000C), ref: 005CC638
                                                                                                                                                                                                                              • Part of subcall function 005CC629: ReleaseDC.USER32(00000000,00000000), ref: 005CC643
                                                                                                                                                                                                                            • GetObjectW.GDI32(?,00000018,?), ref: 005CC7E0
                                                                                                                                                                                                                              • Part of subcall function 005CCA67: GetDC.USER32(00000000), ref: 005CCA70
                                                                                                                                                                                                                              • Part of subcall function 005CCA67: GetObjectW.GDI32(?,00000018,?), ref: 005CCA9F
                                                                                                                                                                                                                              • Part of subcall function 005CCA67: ReleaseDC.USER32(00000000,?), ref: 005CCB37
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ObjectRelease$CapsDevice
                                                                                                                                                                                                                            • String ID: ($f]
                                                                                                                                                                                                                            • API String ID: 1061551593-3148667360
                                                                                                                                                                                                                            • Opcode ID: 449f32dc7f321b3e5af7b6294cd767011ae3ff35785deefbca4edcc988a113aa
                                                                                                                                                                                                                            • Instruction ID: 5711cc5e59d25b2ba5aab14159dc5efc29bc08555d155660f6d870eccd89c92f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 449f32dc7f321b3e5af7b6294cd767011ae3ff35785deefbca4edcc988a113aa
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9591F1756083549FD614DF69C888E2BBBE8FF99B50F00495EF58AD7260CB30A905CB62
                                                                                                                                                                                                                            Function 005C3748 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 203COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _swprintf
                                                                                                                                                                                                                            • String ID: %ls$%s: %s
                                                                                                                                                                                                                            • API String ID: 589789837-2259941744
                                                                                                                                                                                                                            • Opcode ID: 14f2a1dd26219777ebbed03cd8c4a96b3fb600f9607eadf5ba8df94a6d40d154
                                                                                                                                                                                                                            • Instruction ID: 3fee488091722a4cc22d6901e4e5029d2ab2a08354d902a78b6791cbe255235d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 14f2a1dd26219777ebbed03cd8c4a96b3fb600f9607eadf5ba8df94a6d40d154
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2351B3B524830EFEFB212AD49D46F257EB5FB09F04F20C91EB387640E1C6A19750AE56
                                                                                                                                                                                                                            Function 005DA7C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\u08NgsGNym.exe,00000104), ref: 005DA800
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DA8CB
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DA8D5
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _free$FileModuleName
                                                                                                                                                                                                                            • String ID: C:\Users\user\Desktop\u08NgsGNym.exe
                                                                                                                                                                                                                            • API String ID: 2506810119-1754844935
                                                                                                                                                                                                                            • Opcode ID: fe20c78e0e981c718c08ac76aa8a4707602da5e3857335b6648c05d1246ecfb6
                                                                                                                                                                                                                            • Instruction ID: 0377431db45cb2a1e5784bafe38f7fbbf64505745bfe4eebdd807cbe070f21e0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fe20c78e0e981c718c08ac76aa8a4707602da5e3857335b6648c05d1246ecfb6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EF316971A00219EFDB31DB9DD88599FBFB9FB85310B14806BF90497311D6718E42EBA2
                                                                                                                                                                                                                            Function 005D57F6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 005D581B
                                                                                                                                                                                                                            • _abort.LIBCMT ref: 005D5926
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: EncodePointer_abort
                                                                                                                                                                                                                            • String ID: MOC$RCC
                                                                                                                                                                                                                            • API String ID: 948111806-2084237596
                                                                                                                                                                                                                            • Opcode ID: b048029d43a041030de96ea63cbf8e1e07a3f5390cc585503a2a1f68c1c61053
                                                                                                                                                                                                                            • Instruction ID: 2c67384557e76114ffb87e2d015a6f76b73f6c49af125d5173c0560abc3e3649
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b048029d43a041030de96ea63cbf8e1e07a3f5390cc585503a2a1f68c1c61053
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D8412772900609EFCF26DF98C885AAEBFB5FF48314F28805BF914A6251E3359991DB50
                                                                                                                                                                                                                            Function 005BF7B8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • __fprintf_l.LIBCMT ref: 005BF82D
                                                                                                                                                                                                                            • _strncpy.LIBCMT ref: 005BF871
                                                                                                                                                                                                                              • Part of subcall function 005C3F47: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,005BF801,00000000,00000000,?,005F5070,?,005BF801,?,?,00000050,?), ref: 005C3F64
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWide__fprintf_l_strncpy
                                                                                                                                                                                                                            • String ID: $%s$@%s
                                                                                                                                                                                                                            • API String ID: 562999700-834177443
                                                                                                                                                                                                                            • Opcode ID: 1c5fc61ff4d076a9cacb63d3367b62fcb9e2767f754021a346b986502231768d
                                                                                                                                                                                                                            • Instruction ID: 8da76a21025b5b96040df56e5321fa14a5ff4f830b76f2c122bd3e5eee09eab8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1c5fc61ff4d076a9cacb63d3367b62fcb9e2767f754021a346b986502231768d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4D2190729003499BDB24DFA8CC45FFE7BA8FB14700F14052AF92192191E771EA04CB60
                                                                                                                                                                                                                            Function 005CCDA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005B1366: GetDlgItem.USER32(00000000,00003021), ref: 005B13AA
                                                                                                                                                                                                                              • Part of subcall function 005B1366: SetWindowTextW.USER32(00000000,005E65F4), ref: 005B13C0
                                                                                                                                                                                                                            • EndDialog.USER32(?,00000001), ref: 005CCE28
                                                                                                                                                                                                                            • GetDlgItemTextW.USER32(?,00000066,?,?), ref: 005CCE3D
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000066,?), ref: 005CCE52
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ItemText$DialogWindow
                                                                                                                                                                                                                            • String ID: ASKNEXTVOL
                                                                                                                                                                                                                            • API String ID: 445417207-3402441367
                                                                                                                                                                                                                            • Opcode ID: 7ea7d1e1d96a2ff93bf376ab87cbe6ce5569b71b478f952d708ee2cafb4d4847
                                                                                                                                                                                                                            • Instruction ID: 5cbd5f9988ad6cb278175ec3bf19f67a0abf37335c8a7f54b59071df172cf007
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7ea7d1e1d96a2ff93bf376ab87cbe6ce5569b71b478f952d708ee2cafb4d4847
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A611E932644601BFD7129FE8DC09FA67F6EFB8BB00F08441EF646A70A4C7616901C7A5
                                                                                                                                                                                                                            Function 005C2F22 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,005BCAA0,00000008,00000004,005BF1F0,?,00000000), ref: 005C2F61
                                                                                                                                                                                                                            • CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,005BCAA0,00000008,00000004,005BF1F0,?,00000000), ref: 005C2F6B
                                                                                                                                                                                                                            • CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,005BCAA0,00000008,00000004,005BF1F0,?,00000000), ref: 005C2F7B
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • Thread pool initialization failed., xrefs: 005C2F93
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Create$CriticalEventInitializeSectionSemaphore
                                                                                                                                                                                                                            • String ID: Thread pool initialization failed.
                                                                                                                                                                                                                            • API String ID: 3340455307-2182114853
                                                                                                                                                                                                                            • Opcode ID: af4407353dfc72e148e7dc8640665ec59c0071b24b4b581144d7b4e43ece45a9
                                                                                                                                                                                                                            • Instruction ID: c0089d3ebbb5cc57b2fd73eadf6c13789a141d0280f315c290bc9b0d1bb2adcf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: af4407353dfc72e148e7dc8640665ec59c0071b24b4b581144d7b4e43ece45a9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 061186B160470DAFC3215F658CC9A97FFECFBA5344F10482EF1D686200D67159408B50
                                                                                                                                                                                                                            Function 005D00EF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: RENAMEDLG$REPLACEFILEDLG
                                                                                                                                                                                                                            • API String ID: 0-56093855
                                                                                                                                                                                                                            • Opcode ID: d936a05627fc8639db19f4895f4188977cc680d40ee67120c3a3f2a450a45d79
                                                                                                                                                                                                                            • Instruction ID: b6dc6f7ed9a50db060a2fcc0a5dc7045e7b71eb6b0c2664be21c0a06cde6b0ef
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d936a05627fc8639db19f4895f4188977cc680d40ee67120c3a3f2a450a45d79
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 55019E71604249AFDB218FA9EC48BB67FA9FB59781F045427FA05D23B0D6318854EBA0
                                                                                                                                                                                                                            Function 005B4B3D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • std::_Xinvalid_argument.LIBCPMT ref: 005B4B42
                                                                                                                                                                                                                              • Part of subcall function 005D106D: std::invalid_argument::invalid_argument.LIBCONCRT ref: 005D1079
                                                                                                                                                                                                                              • Part of subcall function 005D106D: ___delayLoadHelper2@8.DELAYIMP ref: 005D109F
                                                                                                                                                                                                                            • std::_Xinvalid_argument.LIBCPMT ref: 005B4B4D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Xinvalid_argumentstd::_$Helper2@8Load___delaystd::invalid_argument::invalid_argument
                                                                                                                                                                                                                            • String ID: string too long$vector too long
                                                                                                                                                                                                                            • API String ID: 2355824318-1617939282
                                                                                                                                                                                                                            • Opcode ID: 2398df86a67b705f97e0ad24647bcb361993f826b5c489cf0fd72ff4f01252f7
                                                                                                                                                                                                                            • Instruction ID: e930d4f975b63defb974551eb5fd844b22d3e3d86f95ef277c9635e21cb1a049
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2398df86a67b705f97e0ad24647bcb361993f826b5c489cf0fd72ff4f01252f7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 26F01C212107547B8A34AF5ADC4998ABBA9FBD4BA1710091AFA8583602D7B0F9448BB5
                                                                                                                                                                                                                            Function 005BBD61 Relevance: 6.1, APIs: 4, Instructions: 126COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005BBD93
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005BBDB6
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005BBE4C
                                                                                                                                                                                                                            • _wcslen.LIBCMT ref: 005BBEB1
                                                                                                                                                                                                                              • Part of subcall function 005BC37A: FindClose.KERNELBASE(00000000,000000FF,?,?,?,?,005B87BC,?,?,00000000,0000003A,?,0000003A,00000802), ref: 005BC3A5
                                                                                                                                                                                                                              • Part of subcall function 005BBBFF: RemoveDirectoryW.KERNEL32(00000001,?,00000001,00000000), ref: 005BBC1C
                                                                                                                                                                                                                              • Part of subcall function 005BBBFF: RemoveDirectoryW.KERNEL32(?,00000001,?,00000800), ref: 005BBC48
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _wcslen$DirectoryRemove$CloseFind
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 973666142-0
                                                                                                                                                                                                                            • Opcode ID: 4a9c70bcbb0f5f76b03587e9c3f42184a08be0589a5e3187043d4dd98e980e07
                                                                                                                                                                                                                            • Instruction ID: f9902237c6f711a05a6d71336ad7a2b0dfddcf937b50f04ac2cdd67018546bc5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4a9c70bcbb0f5f76b03587e9c3f42184a08be0589a5e3187043d4dd98e980e07
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5F41FB7250479196DB30AB648849AEB7BEDBFC4300F444C1BEA8593151EBF4FD84C7A1
                                                                                                                                                                                                                            Function 005B849E Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 112COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,00000000,00000800,?,?,8C7CEEEB,00000000,?,00000000), ref: 005B8596
                                                                                                                                                                                                                              • Part of subcall function 005B8C95: GetCurrentProcess.KERNEL32(00000020,?), ref: 005B8CB2
                                                                                                                                                                                                                              • Part of subcall function 005B8C95: GetLastError.KERNEL32 ref: 005B8CF6
                                                                                                                                                                                                                              • Part of subcall function 005B8C95: CloseHandle.KERNEL32(?), ref: 005B8D05
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLast$CloseCurrentHandleProcess
                                                                                                                                                                                                                            • String ID: SeRestorePrivilege$SeSecurityPrivilege$T]
                                                                                                                                                                                                                            • API String ID: 1245819386-3365400413
                                                                                                                                                                                                                            • Opcode ID: 2c1edb4f41b92f21734a72650f858db879880b210400b807938006957033679c
                                                                                                                                                                                                                            • Instruction ID: 671f069b22e6d483b99d80ba20d01d2e98879290714692ccebae65a2a223f849
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2c1edb4f41b92f21734a72650f858db879880b210400b807938006957033679c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7B41B371904289AEDB24EF549C49BFE7FBCBB98344F04005AF545E7281DB746E44CA61
                                                                                                                                                                                                                            Function 005DEFD8 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000000,?,005D6F64,00000000,00000000,005D7F99,?,005D7F99,?,00000001,005D6F64,?,00000001,005D7F99,005D7F99), ref: 005DF025
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 005DF0AE
                                                                                                                                                                                                                            • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 005DF0C0
                                                                                                                                                                                                                            • __freea.LIBCMT ref: 005DF0C9
                                                                                                                                                                                                                              • Part of subcall function 005DBC8E: RtlAllocateHeap.NTDLL(00000000,?,?,?,005D6A24,?,0000015D,?,?,?,?,005D7F00,000000FF,00000000,?,?), ref: 005DBCC0
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2652629310-0
                                                                                                                                                                                                                            • Opcode ID: 38ac84ad9192216b7cc59f21b79987f89c49c38beae18009625d5dbc41d1b5f1
                                                                                                                                                                                                                            • Instruction ID: 6cc1de1101e998e51d826ba0dc33e701b3302cfa8b24ee46e42f3bd5f67b3654
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 38ac84ad9192216b7cc59f21b79987f89c49c38beae18009625d5dbc41d1b5f1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0C31BF71A0020AABDB399F68DC49DAE7FA5FB44350B04416BF806D7251E735CD54CB90
                                                                                                                                                                                                                            Function 005CC5F3 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDC.USER32(00000000), ref: 005CC5F6
                                                                                                                                                                                                                            • GetDeviceCaps.GDI32(00000000,00000058), ref: 005CC605
                                                                                                                                                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 005CC613
                                                                                                                                                                                                                            • ReleaseDC.USER32(00000000,00000000), ref: 005CC621
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CapsDevice$Release
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1035833867-0
                                                                                                                                                                                                                            • Opcode ID: d48e84321f6cb76cc0f23b6c8c50098ad47fa0ff96eca738e6c233798be83b42
                                                                                                                                                                                                                            • Instruction ID: 44bc3e470376079e75bb9700a1f2a40ba8db44cba6005f5a7d563eee667b1001
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d48e84321f6cb76cc0f23b6c8c50098ad47fa0ff96eca738e6c233798be83b42
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0FE08C31989760ABC7215B60AC1DFE63F34EB19713F089016FA01D6290CAB444448FD0
                                                                                                                                                                                                                            Function 005DD808 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DD974
                                                                                                                                                                                                                              • Part of subcall function 005D6676: IsProcessorFeaturePresent.KERNEL32(00000017,005D6648,00000000,005DB5F4,00000000,00000000,00000000,00000016,?,?,005D6655,00000000,00000000,00000000,00000000,00000000), ref: 005D6678
                                                                                                                                                                                                                              • Part of subcall function 005D6676: GetCurrentProcess.KERNEL32(C0000417,005DB5F4,00000000,?,00000003,005DBA28), ref: 005D669A
                                                                                                                                                                                                                              • Part of subcall function 005D6676: TerminateProcess.KERNEL32(00000000,?,00000003,005DBA28), ref: 005D66A1
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Process$CurrentFeaturePresentProcessorTerminate_free
                                                                                                                                                                                                                            • String ID: *?$.
                                                                                                                                                                                                                            • API String ID: 2667617558-3972193922
                                                                                                                                                                                                                            • Opcode ID: d880ea29d1525385f5bc4d26a230f40480b8b7b7c38aab8f8975374564cc868a
                                                                                                                                                                                                                            • Instruction ID: 0730557c7a3aa5a71b955223f22c320ed2b5adeff9993f23075cdca9ca3c444c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d880ea29d1525385f5bc4d26a230f40480b8b7b7c38aab8f8975374564cc868a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C8517F75E0020AEFDF25DFADC881AADBBB5FF98310F24416BE455E7341E6319A018B60
                                                                                                                                                                                                                            Function 005CD76E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _wcslen
                                                                                                                                                                                                                            • String ID: }
                                                                                                                                                                                                                            • API String ID: 176396367-4239843852
                                                                                                                                                                                                                            • Opcode ID: dd4d8bbb02b7319bcd8e9959971120ab4ea7ed5ff41dd909d029d4b7cbf546d5
                                                                                                                                                                                                                            • Instruction ID: f5503ddfc50f9d6ceae2694a2c1c28578e654acd7231505f8659ce137b945722
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dd4d8bbb02b7319bcd8e9959971120ab4ea7ed5ff41dd909d029d4b7cbf546d5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 21214C6290474A5ED731EBA8D949F6BBBF8FBC4710F40083EE544C6241EA75E94887B2
                                                                                                                                                                                                                            Function 005CCEBF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005CD392: GetCurrentProcess.KERNEL32(00020008,?), ref: 005CD3A1
                                                                                                                                                                                                                              • Part of subcall function 005CD392: GetLastError.KERNEL32 ref: 005CD3CC
                                                                                                                                                                                                                            • CreateDirectoryW.KERNEL32(?,?), ref: 005CCF61
                                                                                                                                                                                                                            • LocalFree.KERNEL32(?), ref: 005CCF6F
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
                                                                                                                                                                                                                            • String ID: ]
                                                                                                                                                                                                                            • API String ID: 1077098981-539558556
                                                                                                                                                                                                                            • Opcode ID: 51e5dd804c9ac5012a60a7a97cc65386cfb3e32fe453b475d2c094cc45654940
                                                                                                                                                                                                                            • Instruction ID: 892909a95eb53d9ba74c84c2ccfdd27a8fece2d4a18b0d4a6e45a6bdaefde732
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 51e5dd804c9ac5012a60a7a97cc65386cfb3e32fe453b475d2c094cc45654940
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4C21D6B1900209AFDB11DFA5D9889EFBBFDFB48340F10812AF815D2210E734DA19CBA0
                                                                                                                                                                                                                            Function 005C136B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005C12F6: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 005C1315
                                                                                                                                                                                                                              • Part of subcall function 005C12F6: GetProcAddress.KERNEL32(005FC1F0,CryptUnprotectMemory), ref: 005C1325
                                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32(?,00000200,?,005C1366), ref: 005C13F9
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • CryptProtectMemory failed, xrefs: 005C13B0
                                                                                                                                                                                                                            • CryptUnprotectMemory failed, xrefs: 005C13F1
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressProc$CurrentProcess
                                                                                                                                                                                                                            • String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
                                                                                                                                                                                                                            • API String ID: 2190909847-396321323
                                                                                                                                                                                                                            • Opcode ID: b444f6f863ad1d411302c62d0c18b61534ee1b5e7e0bf9cfc164d98dc9e6d52f
                                                                                                                                                                                                                            • Instruction ID: a84be0019567ea5af6fce78be431e0dc8d106cbef36fd2269a1a7225f4f4b653
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b444f6f863ad1d411302c62d0c18b61534ee1b5e7e0bf9cfc164d98dc9e6d52f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 07113A35600A699FDF19AB619C44E7D3F64BF62BA4B004129FC01AF153DA346C41D6D8
                                                                                                                                                                                                                            Function 005BD8AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _swprintf.LIBCMT ref: 005BD8D3
                                                                                                                                                                                                                              • Part of subcall function 005B4C00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005B4C13
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: __vswprintf_c_l_swprintf
                                                                                                                                                                                                                            • String ID: %c:\
                                                                                                                                                                                                                            • API String ID: 1543624204-3142399695
                                                                                                                                                                                                                            • Opcode ID: ff69523750f141cf4dbb5020f818cc8961e6a2eeccf56a7151feb6023fed44e9
                                                                                                                                                                                                                            • Instruction ID: f74ba43fcc3e9e1aab34e6f187f53ca1dd6056520069156d93a67a289af695b8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ff69523750f141cf4dbb5020f818cc8961e6a2eeccf56a7151feb6023fed44e9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C901B5635047127ADB346B699C4ADABAFBCFED5BB0750441BF885C6192FA20F840C6B1
                                                                                                                                                                                                                            Function 005D10F9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 005D130A
                                                                                                                                                                                                                            • ___raise_securityfailure.LIBCMT ref: 005D13F2
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                                                                                                                                                                            • String ID: 8]a
                                                                                                                                                                                                                            • API String ID: 3761405300-3768131565
                                                                                                                                                                                                                            • Opcode ID: fa199337f594184b99ad5a23e7538798c935db0c1d64cda4ceb2259faa679be2
                                                                                                                                                                                                                            • Instruction ID: 030673033eb5b39328543e98aa0ccec007efa77b3142e2084848fa2f69b0650c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fa199337f594184b99ad5a23e7538798c935db0c1d64cda4ceb2259faa679be2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0721E6B5911A00DBD310DF15F885694BBB6FB88314F58A42BE50ACB7B0D3B55A80CF49
                                                                                                                                                                                                                            Function 005CD392 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00020008,?), ref: 005CD3A1
                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 005CD3CC
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentErrorLastProcess
                                                                                                                                                                                                                            • String ID: @]
                                                                                                                                                                                                                            • API String ID: 335030130-1271120594
                                                                                                                                                                                                                            • Opcode ID: 22dbfbfaa47889ae16b1eeb0d567acb4f95b07d11efa1097b22ce96c643e9ec9
                                                                                                                                                                                                                            • Instruction ID: e192af3014a1a7f8f7eeed17fd7d6f1f4ddbbac897bec7cbbf1b1a20c7a63aa0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 22dbfbfaa47889ae16b1eeb0d567acb4f95b07d11efa1097b22ce96c643e9ec9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4D0157B5540208BFDF155FE0AC89EEE7F7EFB18390B14442AF601E1150EAB19A44AA30
                                                                                                                                                                                                                            Function 005DE19E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005DB9A5: GetLastError.KERNEL32(?,005F50C4,005D6E12,005F50C4,?,?,005D688D,?,?,005F50C4), ref: 005DB9A9
                                                                                                                                                                                                                              • Part of subcall function 005DB9A5: _free.LIBCMT ref: 005DB9DC
                                                                                                                                                                                                                              • Part of subcall function 005DB9A5: SetLastError.KERNEL32(00000000,?,005F50C4), ref: 005DBA1D
                                                                                                                                                                                                                              • Part of subcall function 005DB9A5: _abort.LIBCMT ref: 005DBA23
                                                                                                                                                                                                                            • _abort.LIBCMT ref: 005DE1D0
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DE204
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLast_abort_free
                                                                                                                                                                                                                            • String ID: p,_
                                                                                                                                                                                                                            • API String ID: 289325740-1767216777
                                                                                                                                                                                                                            • Opcode ID: 36c36ee8ce33364079b76098225672dffce37fcb366d01944154f9078e72e855
                                                                                                                                                                                                                            • Instruction ID: b25abb3c95739d9b1147ba627f95305cafae326a9bd0c41d3722ae5e6a8b1339
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 36c36ee8ce33364079b76098225672dffce37fcb366d01944154f9078e72e855
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2D01A1B5D01A22DBCB31BF5CC80626CBB75BB88B20B15020BE965AB380CB746D41CFC1
                                                                                                                                                                                                                            Function 005D1405 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 005D1410
                                                                                                                                                                                                                            • ___raise_securityfailure.LIBCMT ref: 005D14CD
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                                                                                                                                                                            • String ID: 8]a
                                                                                                                                                                                                                            • API String ID: 3761405300-3768131565
                                                                                                                                                                                                                            • Opcode ID: 3c49dcd7144fddea87cb56b9d45c4d1e58b57a86866ec7a0d0ed921038de88be
                                                                                                                                                                                                                            • Instruction ID: 6bb53799283d8cebc8fdbc2d9ad31d98b0cd73f0f7317fc81359fa5a56edb928
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3c49dcd7144fddea87cb56b9d45c4d1e58b57a86866ec7a0d0ed921038de88be
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 131193B5D11A04DBC750DF15F885684BBB6BF88350B08E02BE90A8B770E3B09A51CF49
                                                                                                                                                                                                                            Function 005DAABA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 005DE580: GetEnvironmentStringsW.KERNEL32 ref: 005DE589
                                                                                                                                                                                                                              • Part of subcall function 005DE580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005DE5AC
                                                                                                                                                                                                                              • Part of subcall function 005DE580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 005DE5D2
                                                                                                                                                                                                                              • Part of subcall function 005DE580: _free.LIBCMT ref: 005DE5E5
                                                                                                                                                                                                                              • Part of subcall function 005DE580: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 005DE5F4
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DAB00
                                                                                                                                                                                                                            • _free.LIBCMT ref: 005DAB07
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
                                                                                                                                                                                                                            • String ID: pba
                                                                                                                                                                                                                            • API String ID: 400815659-3335449001
                                                                                                                                                                                                                            • Opcode ID: f9b439ffbe571e0c69192561982fdd9ca3ded2db274a705a3654c6e52df667f5
                                                                                                                                                                                                                            • Instruction ID: 9a20d7d5fc5adc1d906473d4fd9c1ad420a0ee4f356d77cd74a29e26df48dfc7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f9b439ffbe571e0c69192561982fdd9ca3ded2db274a705a3654c6e52df667f5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 48E0E526B0540259FB717A7EAC4AA9B0D167BC1370B160717F4208B3C2EEA489428197
                                                                                                                                                                                                                            Function 005C30CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(?,000000FF,005C31E7,?,?,005C325F,?,?,?,?,?,005C3249), ref: 005C30D0
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,005C325F,?,?,?,?,?,005C3249), ref: 005C30DC
                                                                                                                                                                                                                              • Part of subcall function 005B7BAD: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 005B7BD5
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • WaitForMultipleObjects error %d, GetLastError %d, xrefs: 005C30E5
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLastObjectSingleWait__vswprintf_c_l
                                                                                                                                                                                                                            • String ID: WaitForMultipleObjects error %d, GetLastError %d
                                                                                                                                                                                                                            • API String ID: 1091760877-2248577382
                                                                                                                                                                                                                            • Opcode ID: dfa83e0d980ed00df1efc38a85ac9cb20a6c630760fe231a42c53c6c88457c99
                                                                                                                                                                                                                            • Instruction ID: 1d344bcb7e0df30723ea3a049b4275f67c779932a75c5eb73824867250d59881
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dfa83e0d980ed00df1efc38a85ac9cb20a6c630760fe231a42c53c6c88457c99
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4CD02E3140C9393BCA0033246C0EDAF3D09BBB23B1F204B08F239691E0EE204E4196D1
                                                                                                                                                                                                                            Function 005C01FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleHandleW.KERNEL32(00000000,?,005BF951,?), ref: 005C01FF
                                                                                                                                                                                                                            • FindResourceW.KERNEL32(00000000,RTL,00000005,?,005BF951,?), ref: 005C020D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1345378498.00000000005B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345354216.00000000005B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345412108.00000000005E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.00000000005F9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345431544.0000000000616000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1345506629.0000000000617000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_5b0000_u08NgsGNym.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FindHandleModuleResource
                                                                                                                                                                                                                            • String ID: RTL
                                                                                                                                                                                                                            • API String ID: 3537982541-834975271
                                                                                                                                                                                                                            • Opcode ID: 0dc201787f51d59f146f9c0ec25cf7097a14e0a139ce72012d587d3dff581229
                                                                                                                                                                                                                            • Instruction ID: 69e4c25c5553ee18e9d602c1478da6fc6fd1e897ce4c74c744e313e6f77a811f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0dc201787f51d59f146f9c0ec25cf7097a14e0a139ce72012d587d3dff581229
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CAC012312407A09AD63457716C4DB872E547B207D1F050498B585DE1D0D6E6CC458760

                                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                                            Execution Coverage:11.1%
                                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                            Signature Coverage:0.6%
                                                                                                                                                                                                                            Total number of Nodes:2000
                                                                                                                                                                                                                            Total number of Limit Nodes:46
                                                                                                                                                                                                                            execution_graph 18326 7ff72f94b240 18327 7ff72f94b26e 18326->18327 18328 7ff72f94b255 18326->18328 18328->18327 18330 7ff72f95dbbc 12 API calls 18328->18330 18329 7ff72f94b2cc 18330->18329 15340 7ff72f957e4c 15341 7ff72f957e7a 15340->15341 15342 7ff72f957eb3 15340->15342 15343 7ff72f9554c4 _get_daylight 11 API calls 15341->15343 15342->15341 15344 7ff72f957eb8 FindFirstFileExW 15342->15344 15345 7ff72f957e7f 15343->15345 15346 7ff72f957eda GetLastError 15344->15346 15347 7ff72f957f21 15344->15347 15348 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 15345->15348 15350 7ff72f957ee5 15346->15350 15351 7ff72f957f11 15346->15351 15400 7ff72f9580bc 15347->15400 15352 7ff72f957e8a 15348->15352 15350->15351 15356 7ff72f957eef 15350->15356 15357 7ff72f957f01 15350->15357 15353 7ff72f9554c4 _get_daylight 11 API calls 15351->15353 15359 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15352->15359 15353->15352 15355 7ff72f9580bc _wfindfirst32i64 10 API calls 15360 7ff72f957f47 15355->15360 15356->15351 15361 7ff72f957ef4 15356->15361 15358 7ff72f9554c4 _get_daylight 11 API calls 15357->15358 15358->15352 15362 7ff72f957e9e 15359->15362 15363 7ff72f9580bc _wfindfirst32i64 10 API calls 15360->15363 15364 7ff72f9554c4 _get_daylight 11 API calls 15361->15364 15365 7ff72f957f55 15363->15365 15364->15352 15407 7ff72f960e54 15365->15407 15368 7ff72f957f7f 15369 7ff72f95aec4 _wfindfirst32i64 17 API calls 15368->15369 15370 7ff72f957f93 15369->15370 15371 7ff72f957fbd 15370->15371 15374 7ff72f957ffc FindNextFileW 15370->15374 15372 7ff72f9554c4 _get_daylight 11 API calls 15371->15372 15373 7ff72f957fc2 15372->15373 15375 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 15373->15375 15376 7ff72f95800b GetLastError 15374->15376 15377 7ff72f95804c 15374->15377 15393 7ff72f957fcd 15375->15393 15379 7ff72f958016 15376->15379 15380 7ff72f95803f 15376->15380 15378 7ff72f9580bc _wfindfirst32i64 10 API calls 15377->15378 15382 7ff72f958064 15378->15382 15379->15380 15383 7ff72f958020 15379->15383 15384 7ff72f958032 15379->15384 15381 7ff72f9554c4 _get_daylight 11 API calls 15380->15381 15381->15393 15386 7ff72f9580bc _wfindfirst32i64 10 API calls 15382->15386 15383->15380 15387 7ff72f958025 15383->15387 15388 7ff72f9554c4 _get_daylight 11 API calls 15384->15388 15385 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15389 7ff72f957fe0 15385->15389 15390 7ff72f958072 15386->15390 15392 7ff72f9554c4 _get_daylight 11 API calls 15387->15392 15388->15393 15391 7ff72f9580bc _wfindfirst32i64 10 API calls 15390->15391 15394 7ff72f958080 15391->15394 15392->15393 15393->15385 15395 7ff72f960e54 _wfindfirst32i64 37 API calls 15394->15395 15396 7ff72f95809e 15395->15396 15396->15393 15397 7ff72f9580a6 15396->15397 15398 7ff72f95aec4 _wfindfirst32i64 17 API calls 15397->15398 15399 7ff72f9580ba 15398->15399 15401 7ff72f9580da FileTimeToSystemTime 15400->15401 15402 7ff72f9580d4 15400->15402 15403 7ff72f9580e9 SystemTimeToTzSpecificLocalTime 15401->15403 15404 7ff72f9580ff 15401->15404 15402->15401 15402->15404 15403->15404 15405 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15404->15405 15406 7ff72f957f39 15405->15406 15406->15355 15408 7ff72f960e6b 15407->15408 15409 7ff72f960e61 15407->15409 15410 7ff72f9554c4 _get_daylight 11 API calls 15408->15410 15409->15408 15414 7ff72f960e87 15409->15414 15411 7ff72f960e73 15410->15411 15413 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 15411->15413 15412 7ff72f957f73 15412->15352 15412->15368 15413->15412 15414->15412 15415 7ff72f9554c4 _get_daylight 11 API calls 15414->15415 15415->15411 19323 7ff72f961d20 19334 7ff72f967cb4 19323->19334 19335 7ff72f967cc1 19334->19335 19336 7ff72f95af0c __free_lconv_mon 11 API calls 19335->19336 19337 7ff72f967cdd 19335->19337 19336->19335 19338 7ff72f95af0c __free_lconv_mon 11 API calls 19337->19338 19339 7ff72f961d29 19337->19339 19338->19337 19340 7ff72f960cb8 EnterCriticalSection 19339->19340 15416 7ff72f94c07c 15437 7ff72f94c24c 15416->15437 15419 7ff72f94c1c8 15533 7ff72f94c57c IsProcessorFeaturePresent 15419->15533 15420 7ff72f94c098 __scrt_acquire_startup_lock 15422 7ff72f94c1d2 15420->15422 15429 7ff72f94c0b6 __scrt_release_startup_lock 15420->15429 15423 7ff72f94c57c 7 API calls 15422->15423 15425 7ff72f94c1dd __FrameHandler3::FrameUnwindToEmptyState 15423->15425 15424 7ff72f94c0db 15426 7ff72f94c161 15443 7ff72f94c6c8 15426->15443 15428 7ff72f94c166 15446 7ff72f941000 15428->15446 15429->15424 15429->15426 15522 7ff72f95a0bc 15429->15522 15434 7ff72f94c189 15434->15425 15529 7ff72f94c3e0 15434->15529 15540 7ff72f94c84c 15437->15540 15440 7ff72f94c090 15440->15419 15440->15420 15441 7ff72f94c27b __scrt_initialize_crt 15441->15440 15542 7ff72f94d998 15441->15542 15569 7ff72f94d0e0 15443->15569 15445 7ff72f94c6df GetStartupInfoW 15445->15428 15447 7ff72f94100b 15446->15447 15571 7ff72f9486b0 15447->15571 15449 7ff72f94101d 15578 7ff72f955ef8 15449->15578 15451 7ff72f9439cb 15585 7ff72f941eb0 15451->15585 15455 7ff72f9439ea 15518 7ff72f943ad2 15455->15518 15601 7ff72f947b60 15455->15601 15456 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15457 7ff72f943ae6 15456->15457 15527 7ff72f94c70c GetModuleHandleW 15457->15527 15459 7ff72f943a1f 15460 7ff72f943a6b 15459->15460 15462 7ff72f947b60 61 API calls 15459->15462 15616 7ff72f948040 15460->15616 15467 7ff72f943a40 __std_exception_destroy 15462->15467 15463 7ff72f943a80 15620 7ff72f941cb0 15463->15620 15466 7ff72f943b71 15468 7ff72f943b95 15466->15468 15639 7ff72f9414f0 15466->15639 15467->15460 15470 7ff72f948040 58 API calls 15467->15470 15473 7ff72f943bef 15468->15473 15468->15518 15646 7ff72f948ae0 15468->15646 15469 7ff72f941cb0 121 API calls 15471 7ff72f943ab6 15469->15471 15470->15460 15475 7ff72f943aba 15471->15475 15476 7ff72f943af8 15471->15476 15660 7ff72f946de0 15473->15660 15721 7ff72f942b30 15475->15721 15476->15466 15734 7ff72f943fd0 15476->15734 15477 7ff72f943bcc 15482 7ff72f943be2 SetDllDirectoryW 15477->15482 15483 7ff72f943bd1 15477->15483 15482->15473 15485 7ff72f942b30 59 API calls 15483->15485 15485->15518 15487 7ff72f943b16 15492 7ff72f942b30 59 API calls 15487->15492 15488 7ff72f943c09 15514 7ff72f943c3b 15488->15514 15766 7ff72f9465f0 15488->15766 15490 7ff72f943d06 15664 7ff72f9434c0 15490->15664 15491 7ff72f943b44 15491->15466 15495 7ff72f943b49 15491->15495 15492->15518 15753 7ff72f95018c 15495->15753 15499 7ff72f943c5a 15505 7ff72f943ca5 15499->15505 15802 7ff72f941ef0 15499->15802 15500 7ff72f943c3d 15504 7ff72f946840 FreeLibrary 15500->15504 15504->15514 15505->15518 15806 7ff72f943460 15505->15806 15507 7ff72f943d2e 15509 7ff72f947b60 61 API calls 15507->15509 15508 7ff72f943c2c 15796 7ff72f946c30 15508->15796 15512 7ff72f943d3a 15509->15512 15678 7ff72f948080 15512->15678 15513 7ff72f943ce1 15516 7ff72f946840 FreeLibrary 15513->15516 15514->15490 15514->15499 15516->15518 15518->15456 15523 7ff72f95a0f4 15522->15523 15524 7ff72f95a0d3 15522->15524 18321 7ff72f95a968 15523->18321 15524->15426 15528 7ff72f94c71d 15527->15528 15528->15434 15530 7ff72f94c3f1 15529->15530 15531 7ff72f94c1a0 15530->15531 15532 7ff72f94d998 __scrt_initialize_crt 7 API calls 15530->15532 15531->15424 15532->15531 15534 7ff72f94c5a2 _wfindfirst32i64 memcpy_s 15533->15534 15535 7ff72f94c5c1 RtlCaptureContext RtlLookupFunctionEntry 15534->15535 15536 7ff72f94c5ea RtlVirtualUnwind 15535->15536 15537 7ff72f94c626 memcpy_s 15535->15537 15536->15537 15538 7ff72f94c658 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15537->15538 15539 7ff72f94c6aa _wfindfirst32i64 15538->15539 15539->15422 15541 7ff72f94c26e __scrt_dllmain_crt_thread_attach 15540->15541 15541->15440 15541->15441 15543 7ff72f94d9aa 15542->15543 15544 7ff72f94d9a0 15542->15544 15543->15440 15548 7ff72f94dd14 15544->15548 15549 7ff72f94dd23 15548->15549 15551 7ff72f94d9a5 15548->15551 15556 7ff72f94df50 15549->15556 15552 7ff72f94dd80 15551->15552 15553 7ff72f94ddab 15552->15553 15554 7ff72f94dd8e DeleteCriticalSection 15553->15554 15555 7ff72f94ddaf 15553->15555 15554->15553 15555->15543 15560 7ff72f94ddb8 15556->15560 15561 7ff72f94ded2 TlsFree 15560->15561 15562 7ff72f94ddfc __vcrt_InitializeCriticalSectionEx 15560->15562 15562->15561 15563 7ff72f94de2a LoadLibraryExW 15562->15563 15564 7ff72f94dec1 GetProcAddress 15562->15564 15568 7ff72f94de6d LoadLibraryExW 15562->15568 15565 7ff72f94de4b GetLastError 15563->15565 15566 7ff72f94dea1 15563->15566 15564->15561 15565->15562 15566->15564 15567 7ff72f94deb8 FreeLibrary 15566->15567 15567->15564 15568->15562 15568->15566 15570 7ff72f94d0c0 15569->15570 15570->15445 15570->15570 15573 7ff72f9486cf 15571->15573 15572 7ff72f948720 WideCharToMultiByte 15572->15573 15576 7ff72f9487c6 15572->15576 15573->15572 15575 7ff72f948774 WideCharToMultiByte 15573->15575 15573->15576 15577 7ff72f9486d7 __std_exception_destroy 15573->15577 15575->15573 15575->15576 15840 7ff72f9429e0 15576->15840 15577->15449 15581 7ff72f960050 15578->15581 15579 7ff72f9600a3 15580 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 15579->15580 15584 7ff72f9600cc 15580->15584 15581->15579 15582 7ff72f9600f6 15581->15582 16237 7ff72f95ff28 15582->16237 15584->15451 15586 7ff72f941ec5 15585->15586 15587 7ff72f941ee0 15586->15587 16245 7ff72f942890 15586->16245 15587->15518 15589 7ff72f943ec0 15587->15589 15590 7ff72f94bc60 15589->15590 15591 7ff72f943ecc GetModuleFileNameW 15590->15591 15592 7ff72f943efb 15591->15592 15593 7ff72f943f12 15591->15593 15595 7ff72f9429e0 57 API calls 15592->15595 16285 7ff72f948bf0 15593->16285 15597 7ff72f943f0e 15595->15597 15599 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15597->15599 15598 7ff72f942b30 59 API calls 15598->15597 15600 7ff72f943f4f 15599->15600 15600->15455 15602 7ff72f947b6a 15601->15602 15603 7ff72f948ae0 57 API calls 15602->15603 15604 7ff72f947b8c GetEnvironmentVariableW 15603->15604 15605 7ff72f947bf6 15604->15605 15606 7ff72f947ba4 ExpandEnvironmentStringsW 15604->15606 15607 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15605->15607 15608 7ff72f948bf0 59 API calls 15606->15608 15609 7ff72f947c08 15607->15609 15610 7ff72f947bcc 15608->15610 15609->15459 15610->15605 15611 7ff72f947bd6 15610->15611 16296 7ff72f95a99c 15611->16296 15614 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15615 7ff72f947bee 15614->15615 15615->15459 15617 7ff72f948ae0 57 API calls 15616->15617 15618 7ff72f948057 SetEnvironmentVariableW 15617->15618 15619 7ff72f94806f __std_exception_destroy 15618->15619 15619->15463 15621 7ff72f941cbe 15620->15621 15622 7ff72f941ef0 49 API calls 15621->15622 15623 7ff72f941cf4 15622->15623 15624 7ff72f941ef0 49 API calls 15623->15624 15634 7ff72f941dde 15623->15634 15625 7ff72f941d1a 15624->15625 15625->15634 16303 7ff72f941aa0 15625->16303 15626 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15627 7ff72f941e6c 15626->15627 15627->15466 15627->15469 15631 7ff72f941dcc 15632 7ff72f943e40 49 API calls 15631->15632 15632->15634 15633 7ff72f941d8f 15633->15631 15635 7ff72f941e34 15633->15635 15634->15626 15636 7ff72f943e40 49 API calls 15635->15636 15637 7ff72f941e41 15636->15637 16339 7ff72f944050 15637->16339 15640 7ff72f94157f 15639->15640 15641 7ff72f941506 15639->15641 15640->15468 16381 7ff72f947950 15641->16381 15644 7ff72f942b30 59 API calls 15645 7ff72f941564 15644->15645 15645->15468 15647 7ff72f948b87 MultiByteToWideChar 15646->15647 15648 7ff72f948b01 MultiByteToWideChar 15646->15648 15649 7ff72f948baa 15647->15649 15650 7ff72f948bcf 15647->15650 15651 7ff72f948b4c 15648->15651 15652 7ff72f948b27 15648->15652 15653 7ff72f9429e0 55 API calls 15649->15653 15650->15477 15651->15647 15657 7ff72f948b62 15651->15657 15654 7ff72f9429e0 55 API calls 15652->15654 15655 7ff72f948bbd 15653->15655 15656 7ff72f948b3a 15654->15656 15655->15477 15656->15477 15658 7ff72f9429e0 55 API calls 15657->15658 15659 7ff72f948b75 15658->15659 15659->15477 15661 7ff72f946df5 15660->15661 15662 7ff72f943bf4 15661->15662 15663 7ff72f942890 59 API calls 15661->15663 15662->15514 15757 7ff72f946a90 15662->15757 15663->15662 15665 7ff72f943574 15664->15665 15668 7ff72f943533 15664->15668 15666 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15665->15666 15667 7ff72f9435c5 15666->15667 15667->15518 15671 7ff72f947fd0 15667->15671 15668->15665 16914 7ff72f941710 15668->16914 16956 7ff72f942d70 15668->16956 15672 7ff72f948ae0 57 API calls 15671->15672 15673 7ff72f947fef 15672->15673 15674 7ff72f948ae0 57 API calls 15673->15674 15675 7ff72f947fff 15674->15675 15676 7ff72f957dec 38 API calls 15675->15676 15677 7ff72f94800d __std_exception_destroy 15676->15677 15677->15507 15679 7ff72f948090 15678->15679 15680 7ff72f948ae0 57 API calls 15679->15680 15681 7ff72f9480c1 SetConsoleCtrlHandler GetStartupInfoW 15680->15681 15682 7ff72f948122 15681->15682 17446 7ff72f95aa14 15682->17446 15686 7ff72f948131 15722 7ff72f942b50 15721->15722 15723 7ff72f954ac4 49 API calls 15722->15723 15724 7ff72f942b9b memcpy_s 15723->15724 15725 7ff72f948ae0 57 API calls 15724->15725 15726 7ff72f942bd0 15725->15726 15727 7ff72f942c0d MessageBoxA 15726->15727 15728 7ff72f942bd5 15726->15728 15729 7ff72f942c27 15727->15729 15730 7ff72f948ae0 57 API calls 15728->15730 15732 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15729->15732 15731 7ff72f942bef MessageBoxW 15730->15731 15731->15729 15733 7ff72f942c37 15732->15733 15733->15518 15735 7ff72f943fdc 15734->15735 15736 7ff72f948ae0 57 API calls 15735->15736 15737 7ff72f944007 15736->15737 15738 7ff72f948ae0 57 API calls 15737->15738 15739 7ff72f94401a 15738->15739 17502 7ff72f9564a8 15739->17502 15742 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15743 7ff72f943b0e 15742->15743 15743->15487 15744 7ff72f9482b0 15743->15744 15745 7ff72f9482d4 15744->15745 15746 7ff72f950814 73 API calls 15745->15746 15751 7ff72f9483ab __std_exception_destroy 15745->15751 15747 7ff72f9482ee 15746->15747 15747->15751 17881 7ff72f959070 15747->17881 15749 7ff72f950814 73 API calls 15752 7ff72f948303 15749->15752 15750 7ff72f9504dc _fread_nolock 53 API calls 15750->15752 15751->15491 15752->15749 15752->15750 15752->15751 15754 7ff72f9501bc 15753->15754 17896 7ff72f94ff68 15754->17896 15756 7ff72f9501d5 15756->15487 15758 7ff72f946aca 15757->15758 15759 7ff72f946ab3 15757->15759 15758->15488 15759->15758 17907 7ff72f9415a0 15759->17907 15761 7ff72f946ad4 15761->15758 15762 7ff72f944050 49 API calls 15761->15762 15763 7ff72f946b35 15762->15763 15764 7ff72f942b30 59 API calls 15763->15764 15765 7ff72f946ba5 memcpy_s __std_exception_destroy 15763->15765 15764->15758 15765->15488 15775 7ff72f94660a memcpy_s 15766->15775 15768 7ff72f94672f 15770 7ff72f944050 49 API calls 15768->15770 15769 7ff72f94674b 15771 7ff72f942b30 59 API calls 15769->15771 15772 7ff72f9467a8 15770->15772 15777 7ff72f946741 __std_exception_destroy 15771->15777 15776 7ff72f944050 49 API calls 15772->15776 15773 7ff72f944050 49 API calls 15773->15775 15774 7ff72f946710 15774->15768 15778 7ff72f944050 49 API calls 15774->15778 15775->15768 15775->15769 15775->15773 15775->15774 15782 7ff72f941710 144 API calls 15775->15782 15784 7ff72f946731 15775->15784 17931 7ff72f941950 15775->17931 15779 7ff72f9467d8 15776->15779 15780 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15777->15780 15778->15768 15783 7ff72f944050 49 API calls 15779->15783 15781 7ff72f943c1a 15780->15781 15781->15500 15786 7ff72f946570 15781->15786 15782->15775 15783->15777 15785 7ff72f942b30 59 API calls 15784->15785 15785->15777 17935 7ff72f948260 15786->17935 15788 7ff72f94658c 15789 7ff72f948260 58 API calls 15788->15789 15790 7ff72f94659f 15789->15790 15791 7ff72f9465d5 15790->15791 15793 7ff72f9465b7 15790->15793 15792 7ff72f942b30 59 API calls 15791->15792 15795 7ff72f943c28 15792->15795 17939 7ff72f946ef0 GetProcAddress 15793->17939 15795->15500 15795->15508 15797 7ff72f946c54 15796->15797 15798 7ff72f942b30 59 API calls 15797->15798 15801 7ff72f946cca 15797->15801 15799 7ff72f946cae 15798->15799 15800 7ff72f946840 FreeLibrary 15799->15800 15800->15801 15801->15514 15803 7ff72f941f15 15802->15803 15804 7ff72f954ac4 49 API calls 15803->15804 15805 7ff72f941f38 15804->15805 15805->15505 17998 7ff72f945bc0 15806->17998 15809 7ff72f9434ad 15809->15513 15811 7ff72f943484 15811->15809 18067 7ff72f945920 15811->18067 15813 7ff72f943490 15813->15809 15859 7ff72f94bc60 15840->15859 15843 7ff72f942a29 15861 7ff72f954ac4 15843->15861 15848 7ff72f941ef0 49 API calls 15849 7ff72f942a86 memcpy_s 15848->15849 15850 7ff72f948ae0 54 API calls 15849->15850 15851 7ff72f942abb 15850->15851 15852 7ff72f942af8 MessageBoxA 15851->15852 15853 7ff72f942ac0 15851->15853 15854 7ff72f942b12 15852->15854 15855 7ff72f948ae0 54 API calls 15853->15855 15856 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15854->15856 15857 7ff72f942ada MessageBoxW 15855->15857 15858 7ff72f942b22 15856->15858 15857->15854 15858->15577 15860 7ff72f9429fc GetLastError 15859->15860 15860->15843 15863 7ff72f954b1e 15861->15863 15862 7ff72f954b43 15864 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 15862->15864 15863->15862 15865 7ff72f954b7f 15863->15865 15867 7ff72f954b6d 15864->15867 15891 7ff72f952d50 15865->15891 15869 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15867->15869 15871 7ff72f942a57 15869->15871 15870 7ff72f95af0c __free_lconv_mon 11 API calls 15870->15867 15879 7ff72f948560 15871->15879 15872 7ff72f954c5c 15872->15870 15873 7ff72f954c80 15873->15872 15875 7ff72f954c8a 15873->15875 15874 7ff72f954c31 15876 7ff72f95af0c __free_lconv_mon 11 API calls 15874->15876 15878 7ff72f95af0c __free_lconv_mon 11 API calls 15875->15878 15876->15867 15877 7ff72f954c28 15877->15872 15877->15874 15878->15867 15880 7ff72f94856c 15879->15880 15881 7ff72f94858d FormatMessageW 15880->15881 15882 7ff72f948587 GetLastError 15880->15882 15883 7ff72f9485dc WideCharToMultiByte 15881->15883 15884 7ff72f9485c0 15881->15884 15882->15881 15886 7ff72f948616 15883->15886 15888 7ff72f9485d3 15883->15888 15885 7ff72f9429e0 54 API calls 15884->15885 15885->15888 15887 7ff72f9429e0 54 API calls 15886->15887 15887->15888 15889 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15888->15889 15890 7ff72f942a5e 15889->15890 15890->15848 15892 7ff72f952d8e 15891->15892 15893 7ff72f952d7e 15891->15893 15894 7ff72f952d97 15892->15894 15901 7ff72f952dc5 15892->15901 15897 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 15893->15897 15895 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 15894->15895 15896 7ff72f952dbd 15895->15896 15896->15872 15896->15873 15896->15874 15896->15877 15897->15896 15899 7ff72f953074 15903 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 15899->15903 15901->15893 15901->15896 15901->15899 15905 7ff72f9536e0 15901->15905 15931 7ff72f9533a8 15901->15931 15961 7ff72f952c30 15901->15961 15964 7ff72f954900 15901->15964 15903->15893 15906 7ff72f953795 15905->15906 15907 7ff72f953722 15905->15907 15910 7ff72f95379a 15906->15910 15911 7ff72f9537ef 15906->15911 15908 7ff72f953728 15907->15908 15909 7ff72f9537bf 15907->15909 15916 7ff72f95372d 15908->15916 15922 7ff72f9537fe 15908->15922 15988 7ff72f951c90 15909->15988 15912 7ff72f95379c 15910->15912 15913 7ff72f9537cf 15910->15913 15911->15909 15911->15922 15928 7ff72f953758 15911->15928 15915 7ff72f95373d 15912->15915 15921 7ff72f9537ab 15912->15921 15995 7ff72f951880 15913->15995 15930 7ff72f95382d 15915->15930 15970 7ff72f954044 15915->15970 15916->15915 15919 7ff72f953770 15916->15919 15916->15928 15919->15930 15980 7ff72f954500 15919->15980 15921->15909 15924 7ff72f9537b0 15921->15924 15922->15930 16002 7ff72f9520a0 15922->16002 15924->15930 15984 7ff72f954698 15924->15984 15925 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15927 7ff72f953ac3 15925->15927 15927->15901 15928->15930 16009 7ff72f95ee18 15928->16009 15930->15925 15932 7ff72f9533c9 15931->15932 15933 7ff72f9533b3 15931->15933 15934 7ff72f953407 15932->15934 15937 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 15932->15937 15933->15934 15935 7ff72f953795 15933->15935 15936 7ff72f953722 15933->15936 15934->15901 15940 7ff72f95379a 15935->15940 15941 7ff72f9537ef 15935->15941 15938 7ff72f953728 15936->15938 15939 7ff72f9537bf 15936->15939 15937->15934 15948 7ff72f95372d 15938->15948 15950 7ff72f9537fe 15938->15950 15944 7ff72f951c90 38 API calls 15939->15944 15942 7ff72f95379c 15940->15942 15943 7ff72f9537cf 15940->15943 15941->15939 15941->15950 15959 7ff72f953758 15941->15959 15945 7ff72f95373d 15942->15945 15952 7ff72f9537ab 15942->15952 15946 7ff72f951880 38 API calls 15943->15946 15944->15959 15947 7ff72f954044 47 API calls 15945->15947 15960 7ff72f95382d 15945->15960 15946->15959 15947->15959 15948->15945 15949 7ff72f953770 15948->15949 15948->15959 15953 7ff72f954500 47 API calls 15949->15953 15949->15960 15951 7ff72f9520a0 38 API calls 15950->15951 15950->15960 15951->15959 15952->15939 15954 7ff72f9537b0 15952->15954 15953->15959 15956 7ff72f954698 37 API calls 15954->15956 15954->15960 15955 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15957 7ff72f953ac3 15955->15957 15956->15959 15957->15901 15958 7ff72f95ee18 47 API calls 15958->15959 15959->15958 15959->15960 15960->15955 16165 7ff72f950e54 15961->16165 15965 7ff72f954917 15964->15965 16182 7ff72f95df78 15965->16182 15971 7ff72f954066 15970->15971 16019 7ff72f950cc0 15971->16019 15976 7ff72f954900 45 API calls 15977 7ff72f9541a3 15976->15977 15978 7ff72f954900 45 API calls 15977->15978 15979 7ff72f95422c 15977->15979 15978->15979 15979->15928 15981 7ff72f954580 15980->15981 15982 7ff72f954518 15980->15982 15981->15928 15982->15981 15983 7ff72f95ee18 47 API calls 15982->15983 15983->15981 15987 7ff72f9546b9 15984->15987 15985 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 15986 7ff72f9546ea 15985->15986 15986->15928 15987->15985 15987->15986 15989 7ff72f951cc3 15988->15989 15990 7ff72f951cf2 15989->15990 15992 7ff72f951daf 15989->15992 15991 7ff72f950cc0 12 API calls 15990->15991 15994 7ff72f951d2f 15990->15994 15991->15994 15993 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 15992->15993 15993->15994 15994->15928 15996 7ff72f9518b3 15995->15996 15997 7ff72f9518e2 15996->15997 15999 7ff72f95199f 15996->15999 15998 7ff72f950cc0 12 API calls 15997->15998 16001 7ff72f95191f 15997->16001 15998->16001 16000 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 15999->16000 16000->16001 16001->15928 16003 7ff72f9520d3 16002->16003 16004 7ff72f952102 16003->16004 16006 7ff72f9521bf 16003->16006 16005 7ff72f950cc0 12 API calls 16004->16005 16008 7ff72f95213f 16004->16008 16005->16008 16007 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16006->16007 16007->16008 16008->15928 16010 7ff72f95ee40 16009->16010 16011 7ff72f95ee85 16010->16011 16013 7ff72f954900 45 API calls 16010->16013 16015 7ff72f95ee45 memcpy_s 16010->16015 16018 7ff72f95ee6e memcpy_s 16010->16018 16011->16015 16011->16018 16162 7ff72f9604c8 16011->16162 16012 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16012->16015 16013->16011 16015->15928 16018->16012 16018->16015 16020 7ff72f950cf7 16019->16020 16025 7ff72f950ce6 16019->16025 16020->16025 16049 7ff72f95dbbc 16020->16049 16023 7ff72f95af0c __free_lconv_mon 11 API calls 16026 7ff72f950d38 16023->16026 16024 7ff72f95af0c __free_lconv_mon 11 API calls 16024->16025 16027 7ff72f95eb30 16025->16027 16026->16024 16028 7ff72f95eb4d 16027->16028 16029 7ff72f95eb80 16027->16029 16030 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16028->16030 16029->16028 16032 7ff72f95ebb2 16029->16032 16031 7ff72f954181 16030->16031 16031->15976 16031->15977 16038 7ff72f95ecc5 16032->16038 16044 7ff72f95ebfa 16032->16044 16033 7ff72f95edb7 16089 7ff72f95e01c 16033->16089 16035 7ff72f95ed7d 16082 7ff72f95e3b4 16035->16082 16037 7ff72f95ed4c 16075 7ff72f95e694 16037->16075 16038->16033 16038->16035 16038->16037 16040 7ff72f95ed0f 16038->16040 16041 7ff72f95ed05 16038->16041 16065 7ff72f95e8c4 16040->16065 16041->16035 16043 7ff72f95ed0a 16041->16043 16043->16037 16043->16040 16044->16031 16056 7ff72f95aa3c 16044->16056 16047 7ff72f95aec4 _wfindfirst32i64 17 API calls 16048 7ff72f95ee14 16047->16048 16050 7ff72f95dc07 16049->16050 16054 7ff72f95dbcb _get_daylight 16049->16054 16051 7ff72f9554c4 _get_daylight 11 API calls 16050->16051 16053 7ff72f950d24 16051->16053 16052 7ff72f95dbee HeapAlloc 16052->16053 16052->16054 16053->16023 16053->16026 16054->16050 16054->16052 16055 7ff72f963c00 _get_daylight 2 API calls 16054->16055 16055->16054 16057 7ff72f95aa49 16056->16057 16059 7ff72f95aa53 16056->16059 16057->16059 16063 7ff72f95aa6e 16057->16063 16058 7ff72f9554c4 _get_daylight 11 API calls 16060 7ff72f95aa5a 16058->16060 16059->16058 16061 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16060->16061 16062 7ff72f95aa66 16061->16062 16062->16031 16062->16047 16063->16062 16064 7ff72f9554c4 _get_daylight 11 API calls 16063->16064 16064->16060 16098 7ff72f96471c 16065->16098 16069 7ff72f95e96c 16070 7ff72f95e970 16069->16070 16071 7ff72f95e9c1 16069->16071 16072 7ff72f95e98c 16069->16072 16070->16031 16151 7ff72f95e4b0 16071->16151 16147 7ff72f95e76c 16072->16147 16076 7ff72f96471c 38 API calls 16075->16076 16077 7ff72f95e6de 16076->16077 16078 7ff72f964164 37 API calls 16077->16078 16079 7ff72f95e72e 16078->16079 16080 7ff72f95e732 16079->16080 16081 7ff72f95e76c 45 API calls 16079->16081 16080->16031 16081->16080 16083 7ff72f96471c 38 API calls 16082->16083 16084 7ff72f95e3ff 16083->16084 16085 7ff72f964164 37 API calls 16084->16085 16086 7ff72f95e457 16085->16086 16087 7ff72f95e45b 16086->16087 16088 7ff72f95e4b0 45 API calls 16086->16088 16087->16031 16088->16087 16090 7ff72f95e094 16089->16090 16091 7ff72f95e061 16089->16091 16092 7ff72f95e0ac 16090->16092 16095 7ff72f95e12d 16090->16095 16093 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16091->16093 16094 7ff72f95e3b4 46 API calls 16092->16094 16097 7ff72f95e08d memcpy_s 16093->16097 16094->16097 16096 7ff72f954900 45 API calls 16095->16096 16095->16097 16096->16097 16097->16031 16099 7ff72f96476f fegetenv 16098->16099 16100 7ff72f96867c 37 API calls 16099->16100 16103 7ff72f9647c2 16100->16103 16101 7ff72f9647ef 16105 7ff72f95aa3c __std_exception_copy 37 API calls 16101->16105 16102 7ff72f9648b2 16104 7ff72f96867c 37 API calls 16102->16104 16103->16102 16109 7ff72f96488c 16103->16109 16110 7ff72f9647dd 16103->16110 16106 7ff72f9648dc 16104->16106 16108 7ff72f96486d 16105->16108 16107 7ff72f96867c 37 API calls 16106->16107 16111 7ff72f9648ed 16107->16111 16112 7ff72f965994 16108->16112 16117 7ff72f964875 16108->16117 16113 7ff72f95aa3c __std_exception_copy 37 API calls 16109->16113 16110->16101 16110->16102 16114 7ff72f968870 20 API calls 16111->16114 16115 7ff72f95aec4 _wfindfirst32i64 17 API calls 16112->16115 16113->16108 16125 7ff72f964956 memcpy_s 16114->16125 16116 7ff72f9659a9 16115->16116 16118 7ff72f94bcc0 _wfindfirst32i64 8 API calls 16117->16118 16119 7ff72f95e911 16118->16119 16143 7ff72f964164 16119->16143 16120 7ff72f964cff memcpy_s 16121 7ff72f96503f 16122 7ff72f964280 37 API calls 16121->16122 16130 7ff72f965757 16122->16130 16123 7ff72f964feb 16123->16121 16126 7ff72f9659ac memcpy_s 37 API calls 16123->16126 16124 7ff72f964997 memcpy_s 16136 7ff72f9652db memcpy_s 16124->16136 16138 7ff72f964df3 memcpy_s 16124->16138 16125->16120 16125->16124 16127 7ff72f9554c4 _get_daylight 11 API calls 16125->16127 16126->16121 16128 7ff72f964dd0 16127->16128 16129 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16128->16129 16129->16124 16131 7ff72f9659ac memcpy_s 37 API calls 16130->16131 16141 7ff72f9657b2 16130->16141 16131->16141 16132 7ff72f965938 16133 7ff72f96867c 37 API calls 16132->16133 16133->16117 16134 7ff72f9554c4 11 API calls _get_daylight 16134->16136 16135 7ff72f9554c4 11 API calls _get_daylight 16135->16138 16136->16121 16136->16123 16136->16134 16142 7ff72f95aea4 37 API calls _invalid_parameter_noinfo 16136->16142 16137 7ff72f964280 37 API calls 16137->16141 16138->16123 16138->16135 16139 7ff72f95aea4 37 API calls _invalid_parameter_noinfo 16138->16139 16139->16138 16140 7ff72f9659ac memcpy_s 37 API calls 16140->16141 16141->16132 16141->16137 16141->16140 16142->16136 16144 7ff72f964183 16143->16144 16145 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16144->16145 16146 7ff72f9641ae memcpy_s 16144->16146 16145->16146 16146->16069 16148 7ff72f95e798 memcpy_s 16147->16148 16149 7ff72f954900 45 API calls 16148->16149 16150 7ff72f95e852 memcpy_s 16148->16150 16149->16150 16150->16070 16152 7ff72f95e4eb 16151->16152 16153 7ff72f95e538 memcpy_s 16151->16153 16154 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16152->16154 16156 7ff72f95e5a3 16153->16156 16158 7ff72f954900 45 API calls 16153->16158 16155 7ff72f95e517 16154->16155 16155->16070 16157 7ff72f95aa3c __std_exception_copy 37 API calls 16156->16157 16161 7ff72f95e5e5 memcpy_s 16157->16161 16158->16156 16159 7ff72f95aec4 _wfindfirst32i64 17 API calls 16160 7ff72f95e690 16159->16160 16161->16159 16164 7ff72f9604ec WideCharToMultiByte 16162->16164 16166 7ff72f950e93 16165->16166 16167 7ff72f950e81 16165->16167 16169 7ff72f950ea0 16166->16169 16173 7ff72f950edd 16166->16173 16168 7ff72f9554c4 _get_daylight 11 API calls 16167->16168 16170 7ff72f950e86 16168->16170 16171 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16169->16171 16172 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16170->16172 16179 7ff72f950e91 16171->16179 16172->16179 16174 7ff72f950f86 16173->16174 16175 7ff72f9554c4 _get_daylight 11 API calls 16173->16175 16176 7ff72f9554c4 _get_daylight 11 API calls 16174->16176 16174->16179 16177 7ff72f950f7b 16175->16177 16178 7ff72f951030 16176->16178 16180 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16177->16180 16181 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16178->16181 16179->15901 16180->16174 16181->16179 16183 7ff72f95493f 16182->16183 16184 7ff72f95df91 16182->16184 16186 7ff72f95dfe4 16183->16186 16184->16183 16190 7ff72f963974 16184->16190 16187 7ff72f95dffd 16186->16187 16189 7ff72f95494f 16186->16189 16187->16189 16234 7ff72f962cc0 16187->16234 16189->15901 16202 7ff72f95b710 GetLastError 16190->16202 16193 7ff72f9639ce 16193->16183 16203 7ff72f95b734 FlsGetValue 16202->16203 16204 7ff72f95b751 FlsSetValue 16202->16204 16205 7ff72f95b74b 16203->16205 16222 7ff72f95b741 16203->16222 16206 7ff72f95b763 16204->16206 16204->16222 16205->16204 16208 7ff72f95f158 _get_daylight 11 API calls 16206->16208 16207 7ff72f95b7bd SetLastError 16209 7ff72f95b7dd 16207->16209 16210 7ff72f95b7ca 16207->16210 16211 7ff72f95b772 16208->16211 16225 7ff72f95aa9c 16209->16225 16210->16193 16224 7ff72f960cb8 EnterCriticalSection 16210->16224 16213 7ff72f95b790 FlsSetValue 16211->16213 16214 7ff72f95b780 FlsSetValue 16211->16214 16215 7ff72f95b79c FlsSetValue 16213->16215 16216 7ff72f95b7ae 16213->16216 16218 7ff72f95b789 16214->16218 16215->16218 16219 7ff72f95b4b8 _get_daylight 11 API calls 16216->16219 16220 7ff72f95af0c __free_lconv_mon 11 API calls 16218->16220 16221 7ff72f95b7b6 16219->16221 16220->16222 16223 7ff72f95af0c __free_lconv_mon 11 API calls 16221->16223 16222->16207 16223->16207 16226 7ff72f963cc0 __FrameHandler3::FrameUnwindToEmptyState EnterCriticalSection LeaveCriticalSection 16225->16226 16227 7ff72f95aaa5 16226->16227 16228 7ff72f95aab4 16227->16228 16229 7ff72f963d10 __FrameHandler3::FrameUnwindToEmptyState 44 API calls 16227->16229 16230 7ff72f95aabd IsProcessorFeaturePresent 16228->16230 16231 7ff72f95aae7 __FrameHandler3::FrameUnwindToEmptyState 16228->16231 16229->16228 16232 7ff72f95aacc 16230->16232 16233 7ff72f95abd8 _wfindfirst32i64 14 API calls 16232->16233 16233->16231 16235 7ff72f95b710 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 16234->16235 16236 7ff72f962cc9 16235->16236 16244 7ff72f95536c EnterCriticalSection 16237->16244 16246 7ff72f9428ac 16245->16246 16247 7ff72f954ac4 49 API calls 16246->16247 16248 7ff72f9428fd 16247->16248 16249 7ff72f9554c4 _get_daylight 11 API calls 16248->16249 16250 7ff72f942902 16249->16250 16264 7ff72f9554e4 16250->16264 16253 7ff72f941ef0 49 API calls 16254 7ff72f942931 memcpy_s 16253->16254 16255 7ff72f948ae0 57 API calls 16254->16255 16256 7ff72f942966 16255->16256 16257 7ff72f94296b 16256->16257 16258 7ff72f9429a3 MessageBoxA 16256->16258 16259 7ff72f948ae0 57 API calls 16257->16259 16260 7ff72f9429bd 16258->16260 16261 7ff72f942985 MessageBoxW 16259->16261 16262 7ff72f94bcc0 _wfindfirst32i64 8 API calls 16260->16262 16261->16260 16263 7ff72f9429cd 16262->16263 16263->15587 16265 7ff72f95b888 _get_daylight 11 API calls 16264->16265 16267 7ff72f9554fb 16265->16267 16266 7ff72f942909 16266->16253 16267->16266 16268 7ff72f95f158 _get_daylight 11 API calls 16267->16268 16271 7ff72f95553b 16267->16271 16269 7ff72f955530 16268->16269 16270 7ff72f95af0c __free_lconv_mon 11 API calls 16269->16270 16270->16271 16271->16266 16276 7ff72f95f828 16271->16276 16274 7ff72f95aec4 _wfindfirst32i64 17 API calls 16275 7ff72f955580 16274->16275 16280 7ff72f95f845 16276->16280 16277 7ff72f95f84a 16278 7ff72f955561 16277->16278 16279 7ff72f9554c4 _get_daylight 11 API calls 16277->16279 16278->16266 16278->16274 16281 7ff72f95f854 16279->16281 16280->16277 16280->16278 16283 7ff72f95f894 16280->16283 16282 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16281->16282 16282->16278 16283->16278 16284 7ff72f9554c4 _get_daylight 11 API calls 16283->16284 16284->16281 16286 7ff72f948c14 WideCharToMultiByte 16285->16286 16287 7ff72f948c82 WideCharToMultiByte 16285->16287 16289 7ff72f948c3e 16286->16289 16292 7ff72f948c55 16286->16292 16288 7ff72f948caf 16287->16288 16293 7ff72f943f25 16287->16293 16290 7ff72f9429e0 57 API calls 16288->16290 16291 7ff72f9429e0 57 API calls 16289->16291 16290->16293 16291->16293 16292->16287 16294 7ff72f948c6b 16292->16294 16293->15597 16293->15598 16295 7ff72f9429e0 57 API calls 16294->16295 16295->16293 16297 7ff72f947bde 16296->16297 16298 7ff72f95a9b3 16296->16298 16297->15614 16298->16297 16299 7ff72f95aa3c __std_exception_copy 37 API calls 16298->16299 16300 7ff72f95a9e0 16299->16300 16300->16297 16301 7ff72f95aec4 _wfindfirst32i64 17 API calls 16300->16301 16302 7ff72f95aa10 16301->16302 16304 7ff72f943fd0 116 API calls 16303->16304 16305 7ff72f941ad6 16304->16305 16306 7ff72f941c84 16305->16306 16307 7ff72f9482b0 83 API calls 16305->16307 16308 7ff72f94bcc0 _wfindfirst32i64 8 API calls 16306->16308 16309 7ff72f941b0e 16307->16309 16310 7ff72f941c98 16308->16310 16334 7ff72f941b3f 16309->16334 16342 7ff72f950814 16309->16342 16310->15634 16336 7ff72f943e40 16310->16336 16312 7ff72f95018c 74 API calls 16312->16306 16313 7ff72f941b28 16314 7ff72f941b2c 16313->16314 16315 7ff72f941b44 16313->16315 16316 7ff72f942890 59 API calls 16314->16316 16346 7ff72f9504dc 16315->16346 16316->16334 16319 7ff72f941b77 16321 7ff72f950814 73 API calls 16319->16321 16320 7ff72f941b5f 16322 7ff72f942890 59 API calls 16320->16322 16323 7ff72f941bc4 16321->16323 16322->16334 16324 7ff72f941bee 16323->16324 16325 7ff72f941bd6 16323->16325 16327 7ff72f9504dc _fread_nolock 53 API calls 16324->16327 16326 7ff72f942890 59 API calls 16325->16326 16326->16334 16328 7ff72f941c03 16327->16328 16329 7ff72f941c09 16328->16329 16330 7ff72f941c1e 16328->16330 16332 7ff72f942890 59 API calls 16329->16332 16349 7ff72f950250 16330->16349 16332->16334 16334->16312 16335 7ff72f942b30 59 API calls 16335->16334 16337 7ff72f941ef0 49 API calls 16336->16337 16338 7ff72f943e5d 16337->16338 16338->15633 16340 7ff72f941ef0 49 API calls 16339->16340 16341 7ff72f944080 16340->16341 16341->15634 16343 7ff72f950844 16342->16343 16355 7ff72f9505a4 16343->16355 16345 7ff72f95085d 16345->16313 16367 7ff72f9504fc 16346->16367 16350 7ff72f941c32 16349->16350 16351 7ff72f950259 16349->16351 16350->16334 16350->16335 16352 7ff72f9554c4 _get_daylight 11 API calls 16351->16352 16353 7ff72f95025e 16352->16353 16354 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16353->16354 16354->16350 16356 7ff72f95060e 16355->16356 16357 7ff72f9505ce 16355->16357 16356->16357 16359 7ff72f95061a 16356->16359 16358 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16357->16358 16360 7ff72f9505f5 16358->16360 16366 7ff72f95536c EnterCriticalSection 16359->16366 16360->16345 16368 7ff72f941b59 16367->16368 16369 7ff72f950526 16367->16369 16368->16319 16368->16320 16369->16368 16370 7ff72f950535 memcpy_s 16369->16370 16371 7ff72f950572 16369->16371 16373 7ff72f9554c4 _get_daylight 11 API calls 16370->16373 16380 7ff72f95536c EnterCriticalSection 16371->16380 16375 7ff72f95054a 16373->16375 16377 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16375->16377 16377->16368 16382 7ff72f947966 16381->16382 16383 7ff72f94798a 16382->16383 16384 7ff72f9479dd GetTempPathW 16382->16384 16386 7ff72f947b60 61 API calls 16383->16386 16385 7ff72f9479f2 16384->16385 16420 7ff72f942830 16385->16420 16387 7ff72f947996 16386->16387 16444 7ff72f947420 16387->16444 16393 7ff72f9479bc __std_exception_destroy 16393->16384 16399 7ff72f9479ca 16393->16399 16394 7ff72f94bcc0 _wfindfirst32i64 8 API calls 16395 7ff72f94154f 16394->16395 16395->15640 16395->15644 16397 7ff72f947a0b __std_exception_destroy 16398 7ff72f947ab6 16397->16398 16403 7ff72f947a41 16397->16403 16424 7ff72f958aa4 16397->16424 16427 7ff72f948950 16397->16427 16401 7ff72f948bf0 59 API calls 16398->16401 16400 7ff72f942b30 59 API calls 16399->16400 16402 7ff72f9479d6 16400->16402 16405 7ff72f947ac7 __std_exception_destroy 16401->16405 16419 7ff72f947a7a __std_exception_destroy 16402->16419 16404 7ff72f948ae0 57 API calls 16403->16404 16403->16419 16406 7ff72f947a57 16404->16406 16407 7ff72f948ae0 57 API calls 16405->16407 16405->16419 16408 7ff72f947a99 SetEnvironmentVariableW 16406->16408 16409 7ff72f947a5c 16406->16409 16410 7ff72f947ae5 16407->16410 16408->16419 16411 7ff72f948ae0 57 API calls 16409->16411 16412 7ff72f947aea 16410->16412 16413 7ff72f947b1d SetEnvironmentVariableW 16410->16413 16414 7ff72f947a6c 16411->16414 16415 7ff72f948ae0 57 API calls 16412->16415 16413->16419 16416 7ff72f957dec 38 API calls 16414->16416 16417 7ff72f947afa 16415->16417 16416->16419 16418 7ff72f957dec 38 API calls 16417->16418 16418->16419 16419->16394 16421 7ff72f942855 16420->16421 16478 7ff72f954d18 16421->16478 16672 7ff72f9586d0 16424->16672 16428 7ff72f94bc60 16427->16428 16429 7ff72f948960 GetCurrentProcess OpenProcessToken 16428->16429 16430 7ff72f9489ab GetTokenInformation 16429->16430 16431 7ff72f948a21 __std_exception_destroy 16429->16431 16432 7ff72f9489cd GetLastError 16430->16432 16433 7ff72f9489d8 16430->16433 16434 7ff72f948a3a 16431->16434 16435 7ff72f948a34 CloseHandle 16431->16435 16432->16431 16432->16433 16433->16431 16437 7ff72f9489ee GetTokenInformation 16433->16437 16803 7ff72f948650 16434->16803 16435->16434 16437->16431 16439 7ff72f948a14 ConvertSidToStringSidW 16437->16439 16439->16431 16440 7ff72f948aae 16442 7ff72f94bcc0 _wfindfirst32i64 8 API calls 16440->16442 16441 7ff72f948a96 CreateDirectoryW 16441->16440 16443 7ff72f948ac3 16442->16443 16443->16397 16445 7ff72f94742c 16444->16445 16446 7ff72f948ae0 57 API calls 16445->16446 16447 7ff72f94744e 16446->16447 16448 7ff72f947469 ExpandEnvironmentStringsW 16447->16448 16449 7ff72f947456 16447->16449 16450 7ff72f94748f __std_exception_destroy 16448->16450 16451 7ff72f942b30 59 API calls 16449->16451 16452 7ff72f9474a6 16450->16452 16453 7ff72f947493 16450->16453 16457 7ff72f947462 16451->16457 16458 7ff72f9474c0 16452->16458 16459 7ff72f9474b4 16452->16459 16454 7ff72f942b30 59 API calls 16453->16454 16454->16457 16455 7ff72f94bcc0 _wfindfirst32i64 8 API calls 16456 7ff72f947588 16455->16456 16456->16419 16468 7ff72f957dec 16456->16468 16457->16455 16814 7ff72f956328 16458->16814 16807 7ff72f9579a4 16459->16807 16462 7ff72f9474be 16463 7ff72f9474da 16462->16463 16466 7ff72f9474ed memcpy_s 16462->16466 16464 7ff72f942b30 59 API calls 16463->16464 16464->16457 16465 7ff72f947562 CreateDirectoryW 16465->16457 16466->16465 16467 7ff72f94753c CreateDirectoryW 16466->16467 16467->16466 16469 7ff72f957e0c 16468->16469 16470 7ff72f957df9 16468->16470 16906 7ff72f957a70 16469->16906 16472 7ff72f9554c4 _get_daylight 11 API calls 16470->16472 16473 7ff72f957dfe 16472->16473 16476 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16473->16476 16474 7ff72f957e0a 16474->16393 16476->16474 16480 7ff72f954d72 16478->16480 16479 7ff72f954d97 16482 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16479->16482 16480->16479 16481 7ff72f954dd3 16480->16481 16496 7ff72f9530d0 16481->16496 16495 7ff72f954dc1 16482->16495 16485 7ff72f954eb4 16487 7ff72f95af0c __free_lconv_mon 11 API calls 16485->16487 16486 7ff72f94bcc0 _wfindfirst32i64 8 API calls 16488 7ff72f942874 16486->16488 16487->16495 16488->16397 16489 7ff72f954e89 16493 7ff72f95af0c __free_lconv_mon 11 API calls 16489->16493 16490 7ff72f954eda 16490->16485 16492 7ff72f954ee4 16490->16492 16491 7ff72f954e80 16491->16485 16491->16489 16494 7ff72f95af0c __free_lconv_mon 11 API calls 16492->16494 16493->16495 16494->16495 16495->16486 16497 7ff72f95310e 16496->16497 16498 7ff72f9530fe 16496->16498 16499 7ff72f953117 16497->16499 16504 7ff72f953145 16497->16504 16500 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16498->16500 16501 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16499->16501 16502 7ff72f95313d 16500->16502 16501->16502 16502->16485 16502->16489 16502->16490 16502->16491 16504->16498 16504->16502 16507 7ff72f953ae4 16504->16507 16540 7ff72f953530 16504->16540 16577 7ff72f952cc0 16504->16577 16508 7ff72f953b97 16507->16508 16509 7ff72f953b26 16507->16509 16510 7ff72f953b9c 16508->16510 16511 7ff72f953bf0 16508->16511 16512 7ff72f953b2c 16509->16512 16513 7ff72f953bc1 16509->16513 16516 7ff72f953b9e 16510->16516 16517 7ff72f953bd1 16510->16517 16518 7ff72f953c07 16511->16518 16520 7ff72f953bfa 16511->16520 16525 7ff72f953bff 16511->16525 16514 7ff72f953b60 16512->16514 16515 7ff72f953b31 16512->16515 16596 7ff72f951e94 16513->16596 16521 7ff72f953b37 16514->16521 16514->16525 16515->16518 16515->16521 16519 7ff72f953b40 16516->16519 16529 7ff72f953bad 16516->16529 16603 7ff72f951a84 16517->16603 16610 7ff72f9547ec 16518->16610 16538 7ff72f953c30 16519->16538 16580 7ff72f954298 16519->16580 16520->16513 16520->16525 16521->16519 16528 7ff72f953b72 16521->16528 16536 7ff72f953b5b 16521->16536 16525->16538 16614 7ff72f9522a4 16525->16614 16528->16538 16590 7ff72f9545d4 16528->16590 16529->16513 16530 7ff72f953bb2 16529->16530 16534 7ff72f954698 37 API calls 16530->16534 16530->16538 16532 7ff72f94bcc0 _wfindfirst32i64 8 API calls 16533 7ff72f953f2a 16532->16533 16533->16504 16534->16536 16535 7ff72f954900 45 API calls 16539 7ff72f953e1c 16535->16539 16536->16535 16536->16538 16536->16539 16538->16532 16539->16538 16621 7ff72f95efc8 16539->16621 16541 7ff72f95353e 16540->16541 16542 7ff72f953554 16540->16542 16544 7ff72f953594 16541->16544 16545 7ff72f953b97 16541->16545 16546 7ff72f953b26 16541->16546 16543 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16542->16543 16542->16544 16543->16544 16544->16504 16547 7ff72f953b9c 16545->16547 16548 7ff72f953bf0 16545->16548 16549 7ff72f953b2c 16546->16549 16550 7ff72f953bc1 16546->16550 16553 7ff72f953b9e 16547->16553 16554 7ff72f953bd1 16547->16554 16555 7ff72f953c07 16548->16555 16557 7ff72f953bfa 16548->16557 16562 7ff72f953bff 16548->16562 16551 7ff72f953b60 16549->16551 16552 7ff72f953b31 16549->16552 16559 7ff72f951e94 38 API calls 16550->16559 16558 7ff72f953b37 16551->16558 16551->16562 16552->16555 16552->16558 16556 7ff72f953b40 16553->16556 16565 7ff72f953bad 16553->16565 16560 7ff72f951a84 38 API calls 16554->16560 16563 7ff72f9547ec 45 API calls 16555->16563 16561 7ff72f954298 47 API calls 16556->16561 16575 7ff72f953c30 16556->16575 16557->16550 16557->16562 16558->16556 16566 7ff72f953b72 16558->16566 16572 7ff72f953b5b 16558->16572 16559->16572 16560->16572 16561->16572 16564 7ff72f9522a4 38 API calls 16562->16564 16562->16575 16563->16572 16564->16572 16565->16550 16567 7ff72f953bb2 16565->16567 16568 7ff72f9545d4 46 API calls 16566->16568 16566->16575 16570 7ff72f954698 37 API calls 16567->16570 16567->16575 16568->16572 16569 7ff72f94bcc0 _wfindfirst32i64 8 API calls 16571 7ff72f953f2a 16569->16571 16570->16572 16571->16504 16573 7ff72f954900 45 API calls 16572->16573 16572->16575 16576 7ff72f953e1c 16572->16576 16573->16576 16574 7ff72f95efc8 46 API calls 16574->16576 16575->16569 16576->16574 16576->16575 16655 7ff72f951108 16577->16655 16581 7ff72f9542be 16580->16581 16582 7ff72f950cc0 12 API calls 16581->16582 16583 7ff72f95430e 16582->16583 16584 7ff72f95eb30 46 API calls 16583->16584 16585 7ff72f9543e1 16584->16585 16586 7ff72f954900 45 API calls 16585->16586 16587 7ff72f954403 16585->16587 16586->16587 16588 7ff72f954900 45 API calls 16587->16588 16589 7ff72f954491 16587->16589 16588->16589 16589->16536 16591 7ff72f954609 16590->16591 16592 7ff72f95464e 16591->16592 16593 7ff72f954627 16591->16593 16594 7ff72f954900 45 API calls 16591->16594 16592->16536 16595 7ff72f95efc8 46 API calls 16593->16595 16594->16593 16595->16592 16597 7ff72f951ec7 16596->16597 16598 7ff72f951ef6 16597->16598 16600 7ff72f951fb3 16597->16600 16602 7ff72f951f33 16598->16602 16633 7ff72f950d68 16598->16633 16601 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16600->16601 16601->16602 16602->16536 16604 7ff72f951ab7 16603->16604 16605 7ff72f951ae6 16604->16605 16607 7ff72f951ba3 16604->16607 16606 7ff72f950d68 12 API calls 16605->16606 16609 7ff72f951b23 16605->16609 16606->16609 16608 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16607->16608 16608->16609 16609->16536 16611 7ff72f95482f 16610->16611 16613 7ff72f954833 __crtLCMapStringW 16611->16613 16641 7ff72f954888 16611->16641 16613->16536 16615 7ff72f9522d7 16614->16615 16616 7ff72f952306 16615->16616 16618 7ff72f9523c3 16615->16618 16617 7ff72f950d68 12 API calls 16616->16617 16620 7ff72f952343 16616->16620 16617->16620 16619 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16618->16619 16619->16620 16620->16536 16623 7ff72f95eff9 16621->16623 16631 7ff72f95f007 16621->16631 16622 7ff72f95f027 16625 7ff72f95f038 16622->16625 16626 7ff72f95f05f 16622->16626 16623->16622 16624 7ff72f954900 45 API calls 16623->16624 16623->16631 16624->16622 16645 7ff72f960a80 16625->16645 16628 7ff72f95f0ea 16626->16628 16629 7ff72f95f089 16626->16629 16626->16631 16630 7ff72f95fc00 _fread_nolock MultiByteToWideChar 16628->16630 16629->16631 16648 7ff72f95fc00 16629->16648 16630->16631 16631->16539 16634 7ff72f950d9f 16633->16634 16635 7ff72f950d8e 16633->16635 16634->16635 16636 7ff72f95dbbc _fread_nolock 12 API calls 16634->16636 16635->16602 16637 7ff72f950dd0 16636->16637 16638 7ff72f950de4 16637->16638 16639 7ff72f95af0c __free_lconv_mon 11 API calls 16637->16639 16640 7ff72f95af0c __free_lconv_mon 11 API calls 16638->16640 16639->16638 16640->16635 16642 7ff72f9548a6 16641->16642 16644 7ff72f9548ae 16641->16644 16643 7ff72f954900 45 API calls 16642->16643 16643->16644 16644->16613 16651 7ff72f9676e0 16645->16651 16650 7ff72f95fc09 MultiByteToWideChar 16648->16650 16654 7ff72f967744 16651->16654 16652 7ff72f94bcc0 _wfindfirst32i64 8 API calls 16653 7ff72f960a9d 16652->16653 16653->16631 16654->16652 16656 7ff72f95113d 16655->16656 16657 7ff72f95114f 16655->16657 16658 7ff72f9554c4 _get_daylight 11 API calls 16656->16658 16660 7ff72f95115d 16657->16660 16663 7ff72f951199 16657->16663 16659 7ff72f951142 16658->16659 16661 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16659->16661 16662 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 16660->16662 16664 7ff72f95114d 16661->16664 16662->16664 16665 7ff72f951515 16663->16665 16667 7ff72f9554c4 _get_daylight 11 API calls 16663->16667 16664->16504 16665->16664 16666 7ff72f9554c4 _get_daylight 11 API calls 16665->16666 16668 7ff72f9517a9 16666->16668 16669 7ff72f95150a 16667->16669 16670 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16668->16670 16671 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16669->16671 16670->16664 16671->16665 16713 7ff72f961bc8 16672->16713 16772 7ff72f961940 16713->16772 16793 7ff72f960cb8 EnterCriticalSection 16772->16793 16804 7ff72f948675 16803->16804 16805 7ff72f954d18 48 API calls 16804->16805 16806 7ff72f948698 LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 16805->16806 16806->16440 16806->16441 16808 7ff72f9579c2 16807->16808 16811 7ff72f9579f5 16807->16811 16809 7ff72f960e54 _wfindfirst32i64 37 API calls 16808->16809 16808->16811 16810 7ff72f9579f1 16809->16810 16810->16811 16812 7ff72f95aec4 _wfindfirst32i64 17 API calls 16810->16812 16811->16462 16813 7ff72f957a25 16812->16813 16815 7ff72f956344 16814->16815 16816 7ff72f9563b2 16814->16816 16815->16816 16818 7ff72f956349 16815->16818 16851 7ff72f9604a0 16816->16851 16819 7ff72f95637e 16818->16819 16820 7ff72f956361 16818->16820 16834 7ff72f95616c GetFullPathNameW 16819->16834 16826 7ff72f9560f8 GetFullPathNameW 16820->16826 16825 7ff72f956376 __std_exception_destroy 16825->16462 16827 7ff72f95611e GetLastError 16826->16827 16831 7ff72f956134 16826->16831 16828 7ff72f955438 _fread_nolock 11 API calls 16827->16828 16829 7ff72f95612b 16828->16829 16832 7ff72f9554c4 _get_daylight 11 API calls 16829->16832 16830 7ff72f956130 16830->16825 16831->16830 16833 7ff72f9554c4 _get_daylight 11 API calls 16831->16833 16832->16830 16833->16830 16835 7ff72f95619f GetLastError 16834->16835 16840 7ff72f9561b5 __std_exception_destroy 16834->16840 16836 7ff72f955438 _fread_nolock 11 API calls 16835->16836 16837 7ff72f9561ac 16836->16837 16839 7ff72f9554c4 _get_daylight 11 API calls 16837->16839 16838 7ff72f9561b1 16842 7ff72f956244 16838->16842 16839->16838 16840->16838 16841 7ff72f95620f GetFullPathNameW 16840->16841 16841->16835 16841->16838 16843 7ff72f95626d memcpy_s 16842->16843 16846 7ff72f9562b8 memcpy_s 16842->16846 16844 7ff72f9562a1 16843->16844 16843->16846 16848 7ff72f9562da 16843->16848 16845 7ff72f9554c4 _get_daylight 11 API calls 16844->16845 16847 7ff72f9562a6 16845->16847 16846->16825 16849 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16847->16849 16848->16846 16850 7ff72f9554c4 _get_daylight 11 API calls 16848->16850 16849->16846 16850->16847 16854 7ff72f9602b0 16851->16854 16855 7ff72f9602db 16854->16855 16856 7ff72f9602f2 16854->16856 16859 7ff72f9554c4 _get_daylight 11 API calls 16855->16859 16857 7ff72f960317 16856->16857 16858 7ff72f9602f6 16856->16858 16892 7ff72f95f918 16857->16892 16880 7ff72f96041c 16858->16880 16875 7ff72f9602e0 16859->16875 16863 7ff72f96031c 16868 7ff72f960343 16863->16868 16869 7ff72f9603c1 16863->16869 16864 7ff72f9602ff 16866 7ff72f9554a4 _fread_nolock 11 API calls 16864->16866 16865 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16879 7ff72f9602eb __std_exception_destroy 16865->16879 16867 7ff72f960304 16866->16867 16872 7ff72f9554c4 _get_daylight 11 API calls 16867->16872 16876 7ff72f95616c 14 API calls 16868->16876 16869->16855 16870 7ff72f9603c9 16869->16870 16873 7ff72f9560f8 13 API calls 16870->16873 16871 7ff72f94bcc0 _wfindfirst32i64 8 API calls 16874 7ff72f960411 16871->16874 16872->16875 16873->16879 16874->16825 16875->16865 16877 7ff72f960387 16876->16877 16878 7ff72f956244 37 API calls 16877->16878 16877->16879 16878->16879 16879->16871 16881 7ff72f960466 16880->16881 16882 7ff72f960436 16880->16882 16883 7ff72f960451 16881->16883 16884 7ff72f960471 GetDriveTypeW 16881->16884 16885 7ff72f9554a4 _fread_nolock 11 API calls 16882->16885 16888 7ff72f94bcc0 _wfindfirst32i64 8 API calls 16883->16888 16884->16883 16886 7ff72f96043b 16885->16886 16887 7ff72f9554c4 _get_daylight 11 API calls 16886->16887 16889 7ff72f960446 16887->16889 16890 7ff72f9602fb 16888->16890 16891 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 16889->16891 16890->16863 16890->16864 16891->16883 16893 7ff72f94d0e0 memcpy_s 16892->16893 16894 7ff72f95f94e GetCurrentDirectoryW 16893->16894 16895 7ff72f95f98c 16894->16895 16896 7ff72f95f965 16894->16896 16897 7ff72f95f158 _get_daylight 11 API calls 16895->16897 16898 7ff72f94bcc0 _wfindfirst32i64 8 API calls 16896->16898 16899 7ff72f95f99b 16897->16899 16900 7ff72f95f9f9 16898->16900 16901 7ff72f95f9b4 16899->16901 16902 7ff72f95f9a5 GetCurrentDirectoryW 16899->16902 16900->16863 16903 7ff72f9554c4 _get_daylight 11 API calls 16901->16903 16902->16901 16904 7ff72f95f9b9 16902->16904 16903->16904 16905 7ff72f95af0c __free_lconv_mon 11 API calls 16904->16905 16905->16896 16913 7ff72f960cb8 EnterCriticalSection 16906->16913 16915 7ff72f94173e 16914->16915 16916 7ff72f941726 16914->16916 16918 7ff72f941768 16915->16918 16919 7ff72f941744 16915->16919 16917 7ff72f942b30 59 API calls 16916->16917 16920 7ff72f941732 16917->16920 17007 7ff72f947c10 16918->17007 17044 7ff72f9412b0 16919->17044 16920->15668 16925 7ff72f94175f 16925->15668 16926 7ff72f9417b9 16929 7ff72f943fd0 116 API calls 16926->16929 16927 7ff72f94178d 16928 7ff72f942890 59 API calls 16927->16928 16931 7ff72f9417a3 16928->16931 16932 7ff72f9417ce 16929->16932 16930 7ff72f942b30 59 API calls 16930->16925 16931->15668 16933 7ff72f9417ee 16932->16933 16934 7ff72f9417d6 16932->16934 16936 7ff72f950814 73 API calls 16933->16936 16935 7ff72f942b30 59 API calls 16934->16935 16937 7ff72f9417e5 16935->16937 16938 7ff72f9417ff 16936->16938 16942 7ff72f95018c 74 API calls 16937->16942 16939 7ff72f941823 16938->16939 16940 7ff72f941803 16938->16940 16943 7ff72f941829 16939->16943 16944 7ff72f941841 16939->16944 16941 7ff72f942890 59 API calls 16940->16941 16950 7ff72f941819 __std_exception_destroy 16941->16950 16946 7ff72f941937 16942->16946 17026 7ff72f941050 16943->17026 16947 7ff72f941863 16944->16947 16955 7ff72f941882 16944->16955 16946->15668 16949 7ff72f942890 59 API calls 16947->16949 16948 7ff72f95018c 74 API calls 16948->16937 16949->16950 16950->16948 16951 7ff72f9504dc _fread_nolock 53 API calls 16951->16955 16952 7ff72f9418e5 16954 7ff72f942890 59 API calls 16952->16954 16954->16950 16955->16950 16955->16951 16955->16952 17083 7ff72f950c1c 16955->17083 16957 7ff72f942d86 16956->16957 16958 7ff72f941ef0 49 API calls 16957->16958 16959 7ff72f942db9 16958->16959 16960 7ff72f943e40 49 API calls 16959->16960 16987 7ff72f9430ea 16959->16987 16961 7ff72f942e27 16960->16961 16962 7ff72f943e40 49 API calls 16961->16962 16963 7ff72f942e38 16962->16963 16964 7ff72f942e59 16963->16964 16965 7ff72f942e95 16963->16965 17179 7ff72f9431b0 16964->17179 16967 7ff72f9431b0 75 API calls 16965->16967 16968 7ff72f942e93 16967->16968 16969 7ff72f942f16 16968->16969 16970 7ff72f942ed4 16968->16970 16971 7ff72f9431b0 75 API calls 16969->16971 17187 7ff72f9475a0 16970->17187 16973 7ff72f942f40 16971->16973 16977 7ff72f9431b0 75 API calls 16973->16977 16982 7ff72f942fdc 16973->16982 16976 7ff72f943171 16984 7ff72f942b30 59 API calls 16976->16984 16980 7ff72f942f72 16977->16980 16979 7ff72f942f11 16986 7ff72f94bcc0 _wfindfirst32i64 8 API calls 16979->16986 16980->16982 16985 7ff72f9431b0 75 API calls 16980->16985 16981 7ff72f941eb0 59 API calls 16983 7ff72f94302f 16981->16983 16982->16981 16999 7ff72f9430ef 16982->16999 16983->16987 16989 7ff72f941ef0 49 API calls 16983->16989 16984->16987 16988 7ff72f942fa0 16985->16988 16988->16982 16991 7ff72f942fa4 16988->16991 16992 7ff72f943057 16989->16992 16993 7ff72f942b30 59 API calls 16991->16993 16992->16976 16995 7ff72f941ef0 49 API calls 16992->16995 16993->16979 16994 7ff72f942b30 59 API calls 17000 7ff72f943148 16994->17000 16996 7ff72f943084 16995->16996 16996->16976 16998 7ff72f941ef0 49 API calls 16996->16998 16999->17000 17224 7ff72f955070 16999->17224 17000->16976 17000->16994 17002 7ff72f941710 144 API calls 17000->17002 17002->17000 17008 7ff72f947c20 17007->17008 17009 7ff72f941ef0 49 API calls 17008->17009 17010 7ff72f947c61 17009->17010 17025 7ff72f947ce1 17010->17025 17087 7ff72f943f60 17010->17087 17012 7ff72f94bcc0 _wfindfirst32i64 8 API calls 17013 7ff72f941785 17012->17013 17013->16926 17013->16927 17014 7ff72f947d1b 17093 7ff72f9477c0 17014->17093 17017 7ff72f947b60 61 API calls 17022 7ff72f947c92 __std_exception_destroy 17017->17022 17019 7ff72f947d04 17021 7ff72f942c50 59 API calls 17019->17021 17020 7ff72f947cd0 17107 7ff72f942c50 17020->17107 17021->17014 17022->17019 17022->17020 17024 7ff72f943fd0 116 API calls 17024->17025 17025->17012 17027 7ff72f9410a6 17026->17027 17028 7ff72f9410ad 17027->17028 17029 7ff72f9410d3 17027->17029 17030 7ff72f942b30 59 API calls 17028->17030 17032 7ff72f941109 17029->17032 17033 7ff72f9410ed 17029->17033 17031 7ff72f9410c0 17030->17031 17031->16950 17035 7ff72f94111b 17032->17035 17043 7ff72f941137 memcpy_s 17032->17043 17034 7ff72f942890 59 API calls 17033->17034 17045 7ff72f9412c2 17044->17045 17046 7ff72f943fd0 116 API calls 17045->17046 17047 7ff72f9412f2 17046->17047 17048 7ff72f9412fa 17047->17048 17049 7ff72f941311 17047->17049 17050 7ff72f942b30 59 API calls 17048->17050 17051 7ff72f950814 73 API calls 17049->17051 17079 7ff72f94130a __std_exception_destroy 17050->17079 17052 7ff72f941323 17051->17052 17053 7ff72f941327 17052->17053 17054 7ff72f94134d 17052->17054 17055 7ff72f942890 59 API calls 17053->17055 17059 7ff72f941368 17054->17059 17060 7ff72f941390 17054->17060 17056 7ff72f94133e 17055->17056 17058 7ff72f95018c 74 API calls 17056->17058 17057 7ff72f94bcc0 _wfindfirst32i64 8 API calls 17062 7ff72f941454 17057->17062 17058->17079 17063 7ff72f942890 59 API calls 17059->17063 17061 7ff72f9413aa 17060->17061 17074 7ff72f941463 17060->17074 17065 7ff72f941050 98 API calls 17061->17065 17062->16925 17062->16930 17064 7ff72f941383 17063->17064 17067 7ff72f95018c 74 API calls 17064->17067 17068 7ff72f9413bb 17065->17068 17066 7ff72f9413c3 17069 7ff72f95018c 74 API calls 17066->17069 17067->17079 17068->17066 17070 7ff72f9414d2 __std_exception_destroy 17068->17070 17071 7ff72f9413cf 17069->17071 17078 7ff72f95018c 74 API calls 17070->17078 17073 7ff72f9477c0 72 API calls 17071->17073 17072 7ff72f9504dc _fread_nolock 53 API calls 17072->17074 17075 7ff72f9413de 17073->17075 17074->17066 17074->17072 17076 7ff72f9414bb 17074->17076 17075->17079 17080 7ff72f941ef0 49 API calls 17075->17080 17077 7ff72f942890 59 API calls 17076->17077 17077->17070 17078->17079 17079->17057 17081 7ff72f94140c 17080->17081 17081->17079 17150 7ff72f944170 17081->17150 17084 7ff72f950c4c 17083->17084 17164 7ff72f95096c 17084->17164 17088 7ff72f943f6a 17087->17088 17089 7ff72f948ae0 57 API calls 17088->17089 17090 7ff72f943f92 17089->17090 17091 7ff72f94bcc0 _wfindfirst32i64 8 API calls 17090->17091 17092 7ff72f943fba 17091->17092 17092->17014 17092->17017 17092->17022 17094 7ff72f9477d0 17093->17094 17095 7ff72f941ef0 49 API calls 17094->17095 17096 7ff72f947801 17095->17096 17097 7ff72f941ef0 49 API calls 17096->17097 17102 7ff72f947919 17096->17102 17100 7ff72f947828 17097->17100 17098 7ff72f94bcc0 _wfindfirst32i64 8 API calls 17099 7ff72f94792e 17098->17099 17099->17024 17099->17025 17100->17102 17120 7ff72f9560c8 17100->17120 17102->17098 17108 7ff72f942c70 17107->17108 17109 7ff72f954ac4 49 API calls 17108->17109 17110 7ff72f942cbb memcpy_s 17109->17110 17111 7ff72f948ae0 57 API calls 17110->17111 17112 7ff72f942cf0 17111->17112 17113 7ff72f942d2d MessageBoxA 17112->17113 17114 7ff72f942cf5 17112->17114 17121 7ff72f95b710 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 17120->17121 17151 7ff72f944180 17150->17151 17165 7ff72f95098c 17164->17165 17170 7ff72f9509b9 17164->17170 17165->17170 17180 7ff72f9431e4 17179->17180 17181 7ff72f954ac4 49 API calls 17180->17181 17182 7ff72f94320a 17181->17182 17183 7ff72f94321b 17182->17183 17239 7ff72f955dec 17182->17239 17185 7ff72f94bcc0 _wfindfirst32i64 8 API calls 17183->17185 17186 7ff72f943239 17185->17186 17186->16968 17188 7ff72f9475ae 17187->17188 17189 7ff72f943fd0 116 API calls 17188->17189 17190 7ff72f9475dd 17189->17190 17191 7ff72f941ef0 49 API calls 17190->17191 17192 7ff72f947606 17191->17192 17193 7ff72f943f60 57 API calls 17192->17193 17205 7ff72f94760d 17192->17205 17195 7ff72f947620 17193->17195 17194 7ff72f947789 17199 7ff72f95018c 74 API calls 17194->17199 17216 7ff72f947785 17194->17216 17197 7ff72f9476a4 17195->17197 17203 7ff72f947b60 61 API calls 17195->17203 17217 7ff72f94763e __std_exception_destroy 17195->17217 17196 7ff72f9476e9 17420 7ff72f950224 17196->17420 17200 7ff72f9477c0 72 API calls 17197->17200 17199->17216 17204 7ff72f9476af 17200->17204 17201 7ff72f947677 17206 7ff72f942c50 59 API calls 17201->17206 17202 7ff72f94bcc0 _wfindfirst32i64 8 API calls 17208 7ff72f942eee 17202->17208 17203->17217 17204->17205 17205->17194 17205->17196 17206->17205 17208->16976 17209 7ff72f942c50 59 API calls 17209->17197 17211 7ff72f94768d 17211->17209 17216->17202 17217->17201 17217->17211 17219 7ff72f9476ee 17225 7ff72f95507d 17224->17225 17226 7ff72f9550aa 17224->17226 17228 7ff72f9554c4 _get_daylight 11 API calls 17225->17228 17235 7ff72f955034 17225->17235 17227 7ff72f9550cd 17226->17227 17230 7ff72f9550e9 17226->17230 17229 7ff72f9554c4 _get_daylight 11 API calls 17227->17229 17231 7ff72f955087 17228->17231 17232 7ff72f9550d2 17229->17232 17233 7ff72f954f98 45 API calls 17230->17233 17234 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 17231->17234 17236 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 17232->17236 17238 7ff72f9550dd 17233->17238 17237 7ff72f955092 17234->17237 17235->16999 17236->17238 17237->16999 17238->16999 17240 7ff72f955e09 17239->17240 17241 7ff72f955e15 17239->17241 17256 7ff72f955700 17240->17256 17281 7ff72f954f98 17241->17281 17247 7ff72f955e4d 17292 7ff72f955584 17247->17292 17250 7ff72f955ebd 17251 7ff72f955ea9 17257 7ff72f955737 17256->17257 17258 7ff72f95571a 17256->17258 17257->17258 17259 7ff72f95574a CreateFileW 17257->17259 17260 7ff72f9554a4 _fread_nolock 11 API calls 17258->17260 17261 7ff72f95577e 17259->17261 17262 7ff72f9557b4 17259->17262 17263 7ff72f95571f 17260->17263 17314 7ff72f955854 GetFileType 17261->17314 17340 7ff72f955cdc 17262->17340 17266 7ff72f9554c4 _get_daylight 11 API calls 17263->17266 17267 7ff72f955727 17266->17267 17270 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 17267->17270 17282 7ff72f954fbc 17281->17282 17283 7ff72f954fb7 17281->17283 17282->17283 17284 7ff72f95b710 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 17282->17284 17283->17247 17289 7ff72f95f3e4 17283->17289 17285 7ff72f954fd7 17284->17285 17402 7ff72f95df44 17285->17402 17410 7ff72f95f1d0 17289->17410 17293 7ff72f9555ae 17292->17293 17294 7ff72f9555d2 17292->17294 17298 7ff72f95af0c __free_lconv_mon 11 API calls 17293->17298 17303 7ff72f9555bd 17293->17303 17295 7ff72f95562c 17294->17295 17296 7ff72f9555d7 17294->17296 17297 7ff72f95fc00 _fread_nolock MultiByteToWideChar 17295->17297 17299 7ff72f9555ec 17296->17299 17300 7ff72f95af0c __free_lconv_mon 11 API calls 17296->17300 17296->17303 17306 7ff72f955648 17297->17306 17298->17303 17301 7ff72f95dbbc _fread_nolock 12 API calls 17299->17301 17300->17299 17301->17303 17303->17250 17303->17251 17315 7ff72f95595f 17314->17315 17316 7ff72f9558a2 17314->17316 17318 7ff72f955967 17315->17318 17319 7ff72f955989 17315->17319 17317 7ff72f9558ce GetFileInformationByHandle 17316->17317 17320 7ff72f955bd8 21 API calls 17316->17320 17321 7ff72f9558f7 17317->17321 17322 7ff72f95597a GetLastError 17317->17322 17318->17322 17323 7ff72f95596b 17318->17323 17324 7ff72f9559ac PeekNamedPipe 17319->17324 17331 7ff72f95594a 17319->17331 17325 7ff72f9558bc 17320->17325 17324->17331 17325->17317 17325->17331 17341 7ff72f955d12 17340->17341 17342 7ff72f9554c4 _get_daylight 11 API calls 17341->17342 17360 7ff72f955daa __std_exception_destroy 17341->17360 17344 7ff72f955d24 17342->17344 17403 7ff72f95df59 17402->17403 17405 7ff72f954ffa 17402->17405 17404 7ff72f963974 45 API calls 17403->17404 17403->17405 17404->17405 17406 7ff72f95dfb0 17405->17406 17411 7ff72f95f22d 17410->17411 17418 7ff72f95f228 __vcrt_InitializeCriticalSectionEx 17410->17418 17411->17247 17412 7ff72f95f25d LoadLibraryExW 17414 7ff72f95f332 17412->17414 17415 7ff72f95f282 GetLastError 17412->17415 17413 7ff72f95f352 GetProcAddress 17413->17411 17417 7ff72f95f363 17413->17417 17414->17413 17416 7ff72f95f349 FreeLibrary 17414->17416 17415->17418 17416->17413 17417->17411 17418->17411 17418->17412 17418->17413 17419 7ff72f95f2bc LoadLibraryExW 17418->17419 17419->17414 17419->17418 17421 7ff72f95022d 17420->17421 17422 7ff72f95023d 17420->17422 17423 7ff72f9554c4 _get_daylight 11 API calls 17421->17423 17422->17219 17447 7ff72f95aa1d 17446->17447 17448 7ff72f94812a 17446->17448 17449 7ff72f9554c4 _get_daylight 11 API calls 17447->17449 17452 7ff72f958630 17448->17452 17450 7ff72f95aa22 17449->17450 17451 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 17450->17451 17451->17448 17453 7ff72f95864e 17452->17453 17454 7ff72f958639 17452->17454 17456 7ff72f9554a4 _fread_nolock 11 API calls 17453->17456 17461 7ff72f958646 17453->17461 17455 7ff72f9554a4 _fread_nolock 11 API calls 17454->17455 17457 7ff72f95863e 17455->17457 17458 7ff72f958689 17456->17458 17461->15686 17503 7ff72f9563dc 17502->17503 17504 7ff72f956402 17503->17504 17507 7ff72f956435 17503->17507 17505 7ff72f9554c4 _get_daylight 11 API calls 17504->17505 17506 7ff72f956407 17505->17506 17508 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 17506->17508 17509 7ff72f95643b 17507->17509 17510 7ff72f956448 17507->17510 17520 7ff72f944029 17508->17520 17511 7ff72f9554c4 _get_daylight 11 API calls 17509->17511 17521 7ff72f95b1ec 17510->17521 17511->17520 17520->15742 17534 7ff72f960cb8 EnterCriticalSection 17521->17534 17882 7ff72f9590a0 17881->17882 17885 7ff72f958b7c 17882->17885 17884 7ff72f9590b9 17884->15752 17886 7ff72f958b97 17885->17886 17887 7ff72f958bc6 17885->17887 17888 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 17886->17888 17895 7ff72f95536c EnterCriticalSection 17887->17895 17891 7ff72f958bb7 17888->17891 17891->17884 17897 7ff72f94ff83 17896->17897 17898 7ff72f94ffb1 17896->17898 17899 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 17897->17899 17900 7ff72f94ffa3 17898->17900 17906 7ff72f95536c EnterCriticalSection 17898->17906 17899->17900 17900->15756 17908 7ff72f943fd0 116 API calls 17907->17908 17909 7ff72f9415c7 17908->17909 17910 7ff72f9415f0 17909->17910 17911 7ff72f9415cf 17909->17911 17913 7ff72f950814 73 API calls 17910->17913 17912 7ff72f942b30 59 API calls 17911->17912 17914 7ff72f9415df 17912->17914 17915 7ff72f941601 17913->17915 17914->15761 17916 7ff72f941621 17915->17916 17917 7ff72f941605 17915->17917 17919 7ff72f941651 17916->17919 17920 7ff72f941631 17916->17920 17918 7ff72f942890 59 API calls 17917->17918 17927 7ff72f94161c __std_exception_destroy 17918->17927 17923 7ff72f941666 17919->17923 17928 7ff72f94167d 17919->17928 17922 7ff72f942890 59 API calls 17920->17922 17921 7ff72f95018c 74 API calls 17925 7ff72f9416f7 17921->17925 17922->17927 17924 7ff72f941050 98 API calls 17923->17924 17924->17927 17925->15761 17926 7ff72f9504dc _fread_nolock 53 API calls 17926->17928 17927->17921 17928->17926 17928->17927 17929 7ff72f9416be 17928->17929 17930 7ff72f942890 59 API calls 17929->17930 17930->17927 17932 7ff72f9419d3 17931->17932 17933 7ff72f94196f 17931->17933 17932->15775 17933->17932 17934 7ff72f955070 45 API calls 17933->17934 17934->17933 17936 7ff72f948ae0 57 API calls 17935->17936 17937 7ff72f948277 LoadLibraryExW 17936->17937 17938 7ff72f948294 __std_exception_destroy 17937->17938 17938->15788 17940 7ff72f946f3c GetProcAddress 17939->17940 17945 7ff72f946f19 17939->17945 17941 7ff72f946f61 GetProcAddress 17940->17941 17940->17945 17942 7ff72f946f86 GetProcAddress 17941->17942 17941->17945 17944 7ff72f946fae GetProcAddress 17942->17944 17942->17945 17943 7ff72f9429e0 57 API calls 17946 7ff72f946f2c 17943->17946 17944->17945 17947 7ff72f946fd6 GetProcAddress 17944->17947 17945->17943 17946->15795 17947->17945 17948 7ff72f946ffe GetProcAddress 17947->17948 17949 7ff72f94701a 17948->17949 17950 7ff72f947026 GetProcAddress 17948->17950 17949->17950 17999 7ff72f945bd0 17998->17999 18000 7ff72f941ef0 49 API calls 17999->18000 18001 7ff72f945c02 18000->18001 18002 7ff72f945c0b 18001->18002 18005 7ff72f945c2b 18001->18005 18003 7ff72f942b30 59 API calls 18002->18003 18007 7ff72f945c21 18003->18007 18004 7ff72f945c82 18006 7ff72f944050 49 API calls 18004->18006 18005->18004 18008 7ff72f944050 49 API calls 18005->18008 18009 7ff72f945c9b 18006->18009 18012 7ff72f94bcc0 _wfindfirst32i64 8 API calls 18007->18012 18010 7ff72f945c4c 18008->18010 18013 7ff72f945cb9 18009->18013 18017 7ff72f942b30 59 API calls 18009->18017 18011 7ff72f945c6a 18010->18011 18014 7ff72f942b30 59 API calls 18010->18014 18015 7ff72f943f60 57 API calls 18011->18015 18016 7ff72f94346e 18012->18016 18018 7ff72f948260 58 API calls 18013->18018 18014->18011 18019 7ff72f945c74 18015->18019 18016->15809 18026 7ff72f945d20 18016->18026 18017->18013 18020 7ff72f945cc6 18018->18020 18019->18004 18025 7ff72f948260 58 API calls 18019->18025 18021 7ff72f945ced 18020->18021 18022 7ff72f945ccb 18020->18022 18096 7ff72f9451e0 GetProcAddress 18021->18096 18023 7ff72f9429e0 57 API calls 18022->18023 18023->18007 18025->18004 18180 7ff72f944de0 18026->18180 18028 7ff72f945d44 18029 7ff72f945d5d 18028->18029 18030 7ff72f945d4c 18028->18030 18187 7ff72f944530 18029->18187 18031 7ff72f942b30 59 API calls 18030->18031 18037 7ff72f945d58 18031->18037 18034 7ff72f945d7a 18038 7ff72f945d98 18034->18038 18039 7ff72f945d87 18034->18039 18035 7ff72f945d69 18036 7ff72f942b30 59 API calls 18035->18036 18036->18037 18037->15811 18191 7ff72f944870 18038->18191 18040 7ff72f942b30 59 API calls 18039->18040 18040->18037 18068 7ff72f945937 18067->18068 18068->18068 18069 7ff72f945960 18068->18069 18073 7ff72f945977 __std_exception_destroy 18068->18073 18070 7ff72f942b30 59 API calls 18069->18070 18071 7ff72f94596c 18070->18071 18071->15813 18072 7ff72f9415a0 122 API calls 18072->18073 18073->18072 18074 7ff72f942b30 59 API calls 18073->18074 18075 7ff72f945a67 18073->18075 18074->18073 18075->15813 18097 7ff72f945202 18096->18097 18098 7ff72f945220 GetProcAddress 18096->18098 18101 7ff72f9429e0 57 API calls 18097->18101 18098->18097 18099 7ff72f945245 GetProcAddress 18098->18099 18099->18097 18100 7ff72f94526a GetProcAddress 18099->18100 18100->18097 18103 7ff72f945292 GetProcAddress 18100->18103 18102 7ff72f945215 18101->18102 18102->18007 18103->18097 18104 7ff72f9452ba GetProcAddress 18103->18104 18104->18097 18105 7ff72f9452e2 GetProcAddress 18104->18105 18105->18097 18106 7ff72f94530a GetProcAddress 18105->18106 18107 7ff72f945332 GetProcAddress 18106->18107 18108 7ff72f945326 18106->18108 18109 7ff72f94535a GetProcAddress 18107->18109 18110 7ff72f94534e 18107->18110 18108->18107 18111 7ff72f945382 GetProcAddress 18109->18111 18112 7ff72f945376 18109->18112 18110->18109 18112->18111 18182 7ff72f944e05 18180->18182 18181 7ff72f944e0d 18181->18028 18182->18181 18185 7ff72f944f9f 18182->18185 18222 7ff72f956fb8 18182->18222 18183 7ff72f94514a __std_exception_destroy 18183->18028 18184 7ff72f944250 47 API calls 18184->18185 18185->18183 18185->18184 18188 7ff72f944560 18187->18188 18189 7ff72f94bcc0 _wfindfirst32i64 8 API calls 18188->18189 18190 7ff72f9445c2 18189->18190 18190->18034 18190->18035 18192 7ff72f9448e1 18191->18192 18195 7ff72f944884 18191->18195 18223 7ff72f956fe8 18222->18223 18226 7ff72f9564b4 18223->18226 18225 7ff72f957018 18225->18182 18227 7ff72f9564f7 18226->18227 18228 7ff72f9564e5 18226->18228 18230 7ff72f956541 18227->18230 18233 7ff72f956504 18227->18233 18229 7ff72f9554c4 _get_daylight 11 API calls 18228->18229 18232 7ff72f9564ea 18229->18232 18231 7ff72f95655c 18230->18231 18235 7ff72f954900 45 API calls 18230->18235 18239 7ff72f95657e 18231->18239 18247 7ff72f956f40 18231->18247 18237 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 18232->18237 18234 7ff72f95add8 _invalid_parameter_noinfo 37 API calls 18233->18234 18240 7ff72f9564f5 18234->18240 18235->18231 18237->18240 18238 7ff72f95661f 18238->18240 18242 7ff72f9554c4 _get_daylight 11 API calls 18238->18242 18239->18238 18241 7ff72f9554c4 _get_daylight 11 API calls 18239->18241 18240->18225 18243 7ff72f956614 18241->18243 18244 7ff72f9566ca 18242->18244 18245 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 18243->18245 18245->18238 18248 7ff72f956f63 18247->18248 18251 7ff72f956f7a 18247->18251 18253 7ff72f960948 18248->18253 18250 7ff72f956f68 18250->18231 18251->18250 18258 7ff72f960978 18251->18258 18254 7ff72f95b710 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18253->18254 18259 7ff72f954f98 45 API calls 18258->18259 18322 7ff72f95b710 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18321->18322 18323 7ff72f95a971 18322->18323 18324 7ff72f95aa9c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18323->18324 18325 7ff72f95a991 18324->18325 19647 7ff72f96ab89 19648 7ff72f96ab98 19647->19648 19650 7ff72f96aba2 19647->19650 19651 7ff72f960d18 LeaveCriticalSection 19648->19651 19652 7ff72f95b590 19653 7ff72f95b595 19652->19653 19657 7ff72f95b5aa 19652->19657 19658 7ff72f95b5b0 19653->19658 19659 7ff72f95b5fa 19658->19659 19660 7ff72f95b5f2 19658->19660 19662 7ff72f95af0c __free_lconv_mon 11 API calls 19659->19662 19661 7ff72f95af0c __free_lconv_mon 11 API calls 19660->19661 19661->19659 19663 7ff72f95b607 19662->19663 19664 7ff72f95af0c __free_lconv_mon 11 API calls 19663->19664 19665 7ff72f95b614 19664->19665 19666 7ff72f95af0c __free_lconv_mon 11 API calls 19665->19666 19667 7ff72f95b621 19666->19667 19668 7ff72f95af0c __free_lconv_mon 11 API calls 19667->19668 19669 7ff72f95b62e 19668->19669 19670 7ff72f95af0c __free_lconv_mon 11 API calls 19669->19670 19671 7ff72f95b63b 19670->19671 19672 7ff72f95af0c __free_lconv_mon 11 API calls 19671->19672 19673 7ff72f95b648 19672->19673 19674 7ff72f95af0c __free_lconv_mon 11 API calls 19673->19674 19675 7ff72f95b655 19674->19675 19676 7ff72f95af0c __free_lconv_mon 11 API calls 19675->19676 19677 7ff72f95b665 19676->19677 19678 7ff72f95af0c __free_lconv_mon 11 API calls 19677->19678 19679 7ff72f95b675 19678->19679 19684 7ff72f95b458 19679->19684 19698 7ff72f960cb8 EnterCriticalSection 19684->19698 18536 7ff72f955310 18537 7ff72f95531b 18536->18537 18545 7ff72f95f764 18537->18545 18558 7ff72f960cb8 EnterCriticalSection 18545->18558 19700 7ff72f94bf90 19701 7ff72f94bfa0 19700->19701 19717 7ff72f95a138 19701->19717 19703 7ff72f94bfac 19723 7ff72f94c298 19703->19723 19705 7ff72f94c57c 7 API calls 19708 7ff72f94c045 19705->19708 19706 7ff72f94bfc4 _RTC_Initialize 19715 7ff72f94c019 19706->19715 19728 7ff72f94c448 19706->19728 19709 7ff72f94bfd9 19731 7ff72f9595a4 19709->19731 19715->19705 19716 7ff72f94c035 19715->19716 19718 7ff72f95a149 19717->19718 19719 7ff72f9554c4 _get_daylight 11 API calls 19718->19719 19722 7ff72f95a151 19718->19722 19720 7ff72f95a160 19719->19720 19721 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 19720->19721 19721->19722 19722->19703 19724 7ff72f94c2a9 19723->19724 19727 7ff72f94c2ae __scrt_acquire_startup_lock 19723->19727 19725 7ff72f94c57c 7 API calls 19724->19725 19724->19727 19726 7ff72f94c322 19725->19726 19727->19706 19756 7ff72f94c40c 19728->19756 19730 7ff72f94c451 19730->19709 19732 7ff72f9595c4 19731->19732 19746 7ff72f94bfe5 19731->19746 19733 7ff72f9595cc 19732->19733 19734 7ff72f9595e2 GetModuleFileNameW 19732->19734 19735 7ff72f9554c4 _get_daylight 11 API calls 19733->19735 19738 7ff72f95960d 19734->19738 19736 7ff72f9595d1 19735->19736 19737 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 19736->19737 19737->19746 19739 7ff72f959544 11 API calls 19738->19739 19740 7ff72f95964d 19739->19740 19741 7ff72f959655 19740->19741 19745 7ff72f95966d 19740->19745 19742 7ff72f9554c4 _get_daylight 11 API calls 19741->19742 19743 7ff72f95965a 19742->19743 19744 7ff72f95af0c __free_lconv_mon 11 API calls 19743->19744 19744->19746 19748 7ff72f9596bb 19745->19748 19749 7ff72f9596d4 19745->19749 19754 7ff72f95968f 19745->19754 19746->19715 19755 7ff72f94c51c InitializeSListHead 19746->19755 19747 7ff72f95af0c __free_lconv_mon 11 API calls 19747->19746 19750 7ff72f95af0c __free_lconv_mon 11 API calls 19748->19750 19752 7ff72f95af0c __free_lconv_mon 11 API calls 19749->19752 19751 7ff72f9596c4 19750->19751 19753 7ff72f95af0c __free_lconv_mon 11 API calls 19751->19753 19752->19754 19753->19746 19754->19747 19757 7ff72f94c426 19756->19757 19759 7ff72f94c41f 19756->19759 19760 7ff72f95a77c 19757->19760 19759->19730 19763 7ff72f95a3b8 19760->19763 19770 7ff72f960cb8 EnterCriticalSection 19763->19770 18631 7ff72f95a2e0 18634 7ff72f95a25c 18631->18634 18641 7ff72f960cb8 EnterCriticalSection 18634->18641 18642 7ff72f95cae0 18653 7ff72f960cb8 EnterCriticalSection 18642->18653 15159 7ff72f95fcec 15160 7ff72f95fede 15159->15160 15162 7ff72f95fd2e _isindst 15159->15162 15211 7ff72f9554c4 15160->15211 15162->15160 15165 7ff72f95fdae _isindst 15162->15165 15180 7ff72f966904 15165->15180 15170 7ff72f95ff0a 15223 7ff72f95aec4 IsProcessorFeaturePresent 15170->15223 15177 7ff72f95fe0b 15179 7ff72f95fece 15177->15179 15204 7ff72f966948 15177->15204 15214 7ff72f94bcc0 15179->15214 15181 7ff72f966913 15180->15181 15182 7ff72f95fdcc 15180->15182 15227 7ff72f960cb8 EnterCriticalSection 15181->15227 15186 7ff72f965d08 15182->15186 15187 7ff72f95fde1 15186->15187 15188 7ff72f965d11 15186->15188 15187->15170 15192 7ff72f965d38 15187->15192 15189 7ff72f9554c4 _get_daylight 11 API calls 15188->15189 15190 7ff72f965d16 15189->15190 15228 7ff72f95aea4 15190->15228 15193 7ff72f965d41 15192->15193 15197 7ff72f95fdf2 15192->15197 15194 7ff72f9554c4 _get_daylight 11 API calls 15193->15194 15195 7ff72f965d46 15194->15195 15196 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 15195->15196 15196->15197 15197->15170 15198 7ff72f965d68 15197->15198 15199 7ff72f95fe03 15198->15199 15200 7ff72f965d71 15198->15200 15199->15170 15199->15177 15201 7ff72f9554c4 _get_daylight 11 API calls 15200->15201 15202 7ff72f965d76 15201->15202 15203 7ff72f95aea4 _invalid_parameter_noinfo 37 API calls 15202->15203 15203->15199 15309 7ff72f960cb8 EnterCriticalSection 15204->15309 15310 7ff72f95b888 GetLastError 15211->15310 15213 7ff72f9554cd 15213->15179 15215 7ff72f94bcc9 15214->15215 15216 7ff72f94bcd4 15215->15216 15217 7ff72f94bd20 IsProcessorFeaturePresent 15215->15217 15218 7ff72f94bd38 15217->15218 15327 7ff72f94bf14 RtlCaptureContext 15218->15327 15224 7ff72f95aed7 15223->15224 15332 7ff72f95abd8 15224->15332 15230 7ff72f95ad3c 15228->15230 15231 7ff72f95ad67 15230->15231 15234 7ff72f95add8 15231->15234 15233 7ff72f95ad8e 15242 7ff72f95ab20 15234->15242 15239 7ff72f95aec4 _wfindfirst32i64 17 API calls 15241 7ff72f95aea3 15239->15241 15240 7ff72f95ae13 15240->15233 15243 7ff72f95ab3c GetLastError 15242->15243 15244 7ff72f95ab77 15242->15244 15245 7ff72f95ab4c 15243->15245 15244->15240 15248 7ff72f95ab8c 15244->15248 15251 7ff72f95b950 15245->15251 15249 7ff72f95aba8 GetLastError SetLastError 15248->15249 15250 7ff72f95abc0 15248->15250 15249->15250 15250->15239 15250->15240 15252 7ff72f95b98a FlsSetValue 15251->15252 15253 7ff72f95b96f FlsGetValue 15251->15253 15254 7ff72f95ab67 SetLastError 15252->15254 15256 7ff72f95b997 15252->15256 15253->15254 15255 7ff72f95b984 15253->15255 15254->15244 15255->15252 15268 7ff72f95f158 15256->15268 15259 7ff72f95b9c4 FlsSetValue 15262 7ff72f95b9d0 FlsSetValue 15259->15262 15263 7ff72f95b9e2 15259->15263 15260 7ff72f95b9b4 FlsSetValue 15261 7ff72f95b9bd 15260->15261 15275 7ff72f95af0c 15261->15275 15262->15261 15281 7ff72f95b4b8 15263->15281 15273 7ff72f95f169 _get_daylight 15268->15273 15269 7ff72f95f1ba 15272 7ff72f9554c4 _get_daylight 10 API calls 15269->15272 15270 7ff72f95f19e HeapAlloc 15271 7ff72f95b9a6 15270->15271 15270->15273 15271->15259 15271->15260 15272->15271 15273->15269 15273->15270 15286 7ff72f963c00 15273->15286 15276 7ff72f95af40 15275->15276 15277 7ff72f95af11 RtlFreeHeap 15275->15277 15276->15254 15277->15276 15278 7ff72f95af2c GetLastError 15277->15278 15279 7ff72f95af39 __free_lconv_mon 15278->15279 15280 7ff72f9554c4 _get_daylight 9 API calls 15279->15280 15280->15276 15295 7ff72f95b390 15281->15295 15289 7ff72f963c40 15286->15289 15294 7ff72f960cb8 EnterCriticalSection 15289->15294 15307 7ff72f960cb8 EnterCriticalSection 15295->15307 15311 7ff72f95b8ac 15310->15311 15312 7ff72f95b8c9 FlsSetValue 15310->15312 15311->15312 15317 7ff72f95b8b9 15311->15317 15313 7ff72f95b8db 15312->15313 15312->15317 15315 7ff72f95f158 _get_daylight 5 API calls 15313->15315 15314 7ff72f95b935 SetLastError 15314->15213 15316 7ff72f95b8ea 15315->15316 15318 7ff72f95b908 FlsSetValue 15316->15318 15319 7ff72f95b8f8 FlsSetValue 15316->15319 15317->15314 15321 7ff72f95b914 FlsSetValue 15318->15321 15322 7ff72f95b926 15318->15322 15320 7ff72f95b901 15319->15320 15323 7ff72f95af0c __free_lconv_mon 5 API calls 15320->15323 15321->15320 15324 7ff72f95b4b8 _get_daylight 5 API calls 15322->15324 15323->15317 15325 7ff72f95b92e 15324->15325 15326 7ff72f95af0c __free_lconv_mon 5 API calls 15325->15326 15326->15314 15328 7ff72f94bf2e RtlLookupFunctionEntry 15327->15328 15329 7ff72f94bd4b 15328->15329 15330 7ff72f94bf44 RtlVirtualUnwind 15328->15330 15331 7ff72f94bce0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15329->15331 15330->15328 15330->15329 15333 7ff72f95ac12 _wfindfirst32i64 memcpy_s 15332->15333 15334 7ff72f95ac3a RtlCaptureContext RtlLookupFunctionEntry 15333->15334 15335 7ff72f95acaa IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15334->15335 15336 7ff72f95ac74 RtlVirtualUnwind 15334->15336 15337 7ff72f95acfc _wfindfirst32i64 15335->15337 15336->15335 15338 7ff72f94bcc0 _wfindfirst32i64 8 API calls 15337->15338 15339 7ff72f95ad1b GetCurrentProcess TerminateProcess 15338->15339 19802 7ff72f96a96e 19805 7ff72f96a97e 19802->19805 19806 7ff72f955378 LeaveCriticalSection 19805->19806 18671 7ff72f96aaf4 18674 7ff72f955378 LeaveCriticalSection 18671->18674 18331 7ff72f959ef1 18332 7ff72f95a968 45 API calls 18331->18332 18333 7ff72f959ef6 18332->18333 18334 7ff72f959f1d GetModuleHandleW 18333->18334 18335 7ff72f959f67 18333->18335 18334->18335 18341 7ff72f959f2a 18334->18341 18343 7ff72f959df4 18335->18343 18341->18335 18357 7ff72f95a018 GetModuleHandleExW 18341->18357 18363 7ff72f960cb8 EnterCriticalSection 18343->18363 18358 7ff72f95a04c GetProcAddress 18357->18358 18359 7ff72f95a075 18357->18359 18360 7ff72f95a05e 18358->18360 18361 7ff72f95a07a FreeLibrary 18359->18361 18362 7ff72f95a081 18359->18362 18360->18359 18361->18362 18362->18335 18682 7ff72f9684f0 18685 7ff72f962c60 18682->18685 18686 7ff72f962c6d 18685->18686 18687 7ff72f962cb2 18685->18687 18691 7ff72f95b7e4 18686->18691 18692 7ff72f95b7f5 FlsGetValue 18691->18692 18693 7ff72f95b810 FlsSetValue 18691->18693 18694 7ff72f95b80a 18692->18694 18695 7ff72f95b802 18692->18695 18693->18695 18696 7ff72f95b81d 18693->18696 18694->18693 18697 7ff72f95b808 18695->18697 18698 7ff72f95aa9c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18695->18698 18699 7ff72f95f158 _get_daylight 11 API calls 18696->18699 18711 7ff72f962934 18697->18711 18700 7ff72f95b885 18698->18700 18701 7ff72f95b82c 18699->18701 18702 7ff72f95b84a FlsSetValue 18701->18702 18703 7ff72f95b83a FlsSetValue 18701->18703 18705 7ff72f95b868 18702->18705 18706 7ff72f95b856 FlsSetValue 18702->18706 18704 7ff72f95b843 18703->18704 18708 7ff72f95af0c __free_lconv_mon 11 API calls 18704->18708 18707 7ff72f95b4b8 _get_daylight 11 API calls 18705->18707 18706->18704 18709 7ff72f95b870 18707->18709 18708->18695 18710 7ff72f95af0c __free_lconv_mon 11 API calls 18709->18710 18710->18697 18734 7ff72f962ba4 18711->18734 18713 7ff72f962969 18749 7ff72f962634 18713->18749 18716 7ff72f95dbbc _fread_nolock 12 API calls 18717 7ff72f962997 18716->18717 18718 7ff72f96299f 18717->18718 18720 7ff72f9629ae 18717->18720 18719 7ff72f95af0c __free_lconv_mon 11 API calls 18718->18719 18732 7ff72f962986 18719->18732 18720->18720 18756 7ff72f962cdc 18720->18756 18723 7ff72f962aaa 18724 7ff72f9554c4 _get_daylight 11 API calls 18723->18724 18725 7ff72f962aaf 18724->18725 18729 7ff72f95af0c __free_lconv_mon 11 API calls 18725->18729 18726 7ff72f962ac4 18727 7ff72f962b05 18726->18727 18733 7ff72f95af0c __free_lconv_mon 11 API calls 18726->18733 18728 7ff72f962b6c 18727->18728 18767 7ff72f962464 18727->18767 18731 7ff72f95af0c __free_lconv_mon 11 API calls 18728->18731 18729->18732 18731->18732 18732->18687 18733->18727 18735 7ff72f962bc7 18734->18735 18736 7ff72f962bd1 18735->18736 18782 7ff72f960cb8 EnterCriticalSection 18735->18782 18740 7ff72f962c43 18736->18740 18741 7ff72f95aa9c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18736->18741 18740->18713 18743 7ff72f962c5b 18741->18743 18745 7ff72f962cb2 18743->18745 18746 7ff72f95b7e4 50 API calls 18743->18746 18745->18713 18747 7ff72f962c9c 18746->18747 18748 7ff72f962934 65 API calls 18747->18748 18748->18745 18750 7ff72f954f98 45 API calls 18749->18750 18751 7ff72f962648 18750->18751 18752 7ff72f962654 GetOEMCP 18751->18752 18753 7ff72f962666 18751->18753 18755 7ff72f96267b 18752->18755 18754 7ff72f96266b GetACP 18753->18754 18753->18755 18754->18755 18755->18716 18755->18732 18757 7ff72f962634 47 API calls 18756->18757 18758 7ff72f962d09 18757->18758 18759 7ff72f962e5f 18758->18759 18761 7ff72f962d46 IsValidCodePage 18758->18761 18766 7ff72f962d60 memcpy_s 18758->18766 18760 7ff72f94bcc0 _wfindfirst32i64 8 API calls 18759->18760 18762 7ff72f962aa1 18760->18762 18761->18759 18763 7ff72f962d57 18761->18763 18762->18723 18762->18726 18764 7ff72f962d86 GetCPInfo 18763->18764 18763->18766 18764->18759 18764->18766 18783 7ff72f96274c 18766->18783 18839 7ff72f960cb8 EnterCriticalSection 18767->18839 18784 7ff72f962789 GetCPInfo 18783->18784 18785 7ff72f96287f 18783->18785 18784->18785 18791 7ff72f96279c 18784->18791 18786 7ff72f94bcc0 _wfindfirst32i64 8 API calls 18785->18786 18788 7ff72f96291e 18786->18788 18787 7ff72f9634b0 48 API calls 18789 7ff72f962813 18787->18789 18788->18759 18794 7ff72f968454 18789->18794 18791->18787 18793 7ff72f968454 54 API calls 18793->18785 18795 7ff72f954f98 45 API calls 18794->18795 18796 7ff72f968479 18795->18796 18799 7ff72f968120 18796->18799 18800 7ff72f968161 18799->18800 18801 7ff72f95fc00 _fread_nolock MultiByteToWideChar 18800->18801 18804 7ff72f9681ab 18801->18804 18802 7ff72f968429 18803 7ff72f94bcc0 _wfindfirst32i64 8 API calls 18802->18803 18805 7ff72f962846 18803->18805 18804->18802 18806 7ff72f95dbbc _fread_nolock 12 API calls 18804->18806 18807 7ff72f9682e1 18804->18807 18809 7ff72f9681e3 18804->18809 18805->18793 18806->18809 18807->18802 18808 7ff72f95af0c __free_lconv_mon 11 API calls 18807->18808 18808->18802 18809->18807 18810 7ff72f95fc00 _fread_nolock MultiByteToWideChar 18809->18810 18811 7ff72f968256 18810->18811 18811->18807 18830 7ff72f95f5a4 18811->18830 18814 7ff72f9682a1 18814->18807 18817 7ff72f95f5a4 __crtLCMapStringW 6 API calls 18814->18817 18815 7ff72f9682f2 18816 7ff72f95dbbc _fread_nolock 12 API calls 18815->18816 18818 7ff72f9683c4 18815->18818 18820 7ff72f968310 18815->18820 18816->18820 18817->18807 18818->18807 18819 7ff72f95af0c __free_lconv_mon 11 API calls 18818->18819 18819->18807 18820->18807 18821 7ff72f95f5a4 __crtLCMapStringW 6 API calls 18820->18821 18822 7ff72f968390 18821->18822 18822->18818 18823 7ff72f9683c6 18822->18823 18824 7ff72f9683b0 18822->18824 18826 7ff72f9604c8 WideCharToMultiByte 18823->18826 18825 7ff72f9604c8 WideCharToMultiByte 18824->18825 18827 7ff72f9683be 18825->18827 18826->18827 18827->18818 18828 7ff72f9683de 18827->18828 18828->18807 18829 7ff72f95af0c __free_lconv_mon 11 API calls 18828->18829 18829->18807 18831 7ff72f95f1d0 __crtLCMapStringW 5 API calls 18830->18831 18832 7ff72f95f5e2 18831->18832 18833 7ff72f95f5ea 18832->18833 18836 7ff72f95f690 18832->18836 18833->18807 18833->18814 18833->18815 18835 7ff72f95f653 LCMapStringW 18835->18833 18837 7ff72f95f1d0 __crtLCMapStringW 5 API calls 18836->18837 18838 7ff72f95f6be __crtLCMapStringW 18837->18838 18838->18835

                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                            Function 00007FF72F966370 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 133 7ff72f966370-7ff72f9663ab call 7ff72f965cf8 call 7ff72f965d00 call 7ff72f965d68 140 7ff72f9665d5-7ff72f966621 call 7ff72f95aec4 call 7ff72f965cf8 call 7ff72f965d00 call 7ff72f965d68 133->140 141 7ff72f9663b1-7ff72f9663bc call 7ff72f965d08 133->141 168 7ff72f966627-7ff72f966632 call 7ff72f965d08 140->168 169 7ff72f96675f-7ff72f9667cd call 7ff72f95aec4 call 7ff72f961be8 140->169 141->140 146 7ff72f9663c2-7ff72f9663cc 141->146 149 7ff72f9663ee-7ff72f9663f2 146->149 150 7ff72f9663ce-7ff72f9663d1 146->150 151 7ff72f9663f5-7ff72f9663fd 149->151 153 7ff72f9663d4-7ff72f9663df 150->153 151->151 154 7ff72f9663ff-7ff72f966412 call 7ff72f95dbbc 151->154 156 7ff72f9663ea-7ff72f9663ec 153->156 157 7ff72f9663e1-7ff72f9663e8 153->157 163 7ff72f96642a-7ff72f966436 call 7ff72f95af0c 154->163 164 7ff72f966414-7ff72f966416 call 7ff72f95af0c 154->164 156->149 160 7ff72f96641b-7ff72f966429 156->160 157->153 157->156 173 7ff72f96643d-7ff72f966445 163->173 164->160 168->169 177 7ff72f966638-7ff72f966643 call 7ff72f965d38 168->177 185 7ff72f9667db-7ff72f9667de 169->185 186 7ff72f9667cf-7ff72f9667d6 169->186 173->173 176 7ff72f966447-7ff72f966458 call 7ff72f960e54 173->176 176->140 187 7ff72f96645e-7ff72f9664b4 call 7ff72f94d0e0 * 4 call 7ff72f96628c 176->187 177->169 188 7ff72f966649-7ff72f96666c call 7ff72f95af0c GetTimeZoneInformation 177->188 191 7ff72f966815-7ff72f966828 call 7ff72f95dbbc 185->191 192 7ff72f9667e0 185->192 190 7ff72f96686b-7ff72f96686e 186->190 245 7ff72f9664b6-7ff72f9664ba 187->245 201 7ff72f966734-7ff72f96675e call 7ff72f965cf0 call 7ff72f965ce0 call 7ff72f965ce8 188->201 202 7ff72f966672-7ff72f966693 188->202 194 7ff72f9667e3 call 7ff72f9665ec 190->194 197 7ff72f966874-7ff72f96687c call 7ff72f966370 190->197 211 7ff72f96682a 191->211 212 7ff72f966833-7ff72f96684e call 7ff72f961be8 191->212 192->194 205 7ff72f9667e8-7ff72f966814 call 7ff72f95af0c call 7ff72f94bcc0 194->205 197->205 207 7ff72f96669e-7ff72f9666a5 202->207 208 7ff72f966695-7ff72f96669b 202->208 215 7ff72f9666a7-7ff72f9666af 207->215 216 7ff72f9666b9 207->216 208->207 218 7ff72f96682c-7ff72f966831 call 7ff72f95af0c 211->218 227 7ff72f966855-7ff72f966867 call 7ff72f95af0c 212->227 228 7ff72f966850-7ff72f966853 212->228 215->216 224 7ff72f9666b1-7ff72f9666b7 215->224 223 7ff72f9666bb-7ff72f96672f call 7ff72f94d0e0 * 4 call 7ff72f9631cc call 7ff72f966884 * 2 216->223 218->192 223->201 224->223 227->190 228->218 247 7ff72f9664bc 245->247 248 7ff72f9664c0-7ff72f9664c4 245->248 247->248 248->245 250 7ff72f9664c6-7ff72f9664eb call 7ff72f95706c 248->250 257 7ff72f9664ee-7ff72f9664f2 250->257 258 7ff72f9664f4-7ff72f9664ff 257->258 259 7ff72f966501-7ff72f966505 257->259 258->259 261 7ff72f966507-7ff72f96650b 258->261 259->257 263 7ff72f96658c-7ff72f966590 261->263 264 7ff72f96650d-7ff72f966535 call 7ff72f95706c 261->264 266 7ff72f966597-7ff72f9665a4 263->266 267 7ff72f966592-7ff72f966594 263->267 273 7ff72f966537 264->273 274 7ff72f966553-7ff72f966557 264->274 269 7ff72f9665a6-7ff72f9665bc call 7ff72f96628c 266->269 270 7ff72f9665bf-7ff72f9665ce call 7ff72f965cf0 call 7ff72f965ce0 266->270 267->266 269->270 270->140 277 7ff72f96653a-7ff72f966541 273->277 274->263 279 7ff72f966559-7ff72f966577 call 7ff72f95706c 274->279 277->274 280 7ff72f966543-7ff72f966551 277->280 285 7ff72f966583-7ff72f96658a 279->285 280->274 280->277 285->263 286 7ff72f966579-7ff72f96657d 285->286 286->263 287 7ff72f96657f 286->287 287->285
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF72F9663B5
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F965D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72F965D1C
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F95AF0C: RtlFreeHeap.NTDLL(?,?,?,00007FF72F963392,?,?,?,00007FF72F9633CF,?,?,00000000,00007FF72F963895,?,?,00000000,00007FF72F9637C7), ref: 00007FF72F95AF22
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F95AF0C: GetLastError.KERNEL32(?,?,?,00007FF72F963392,?,?,?,00007FF72F9633CF,?,?,00000000,00007FF72F963895,?,?,00000000,00007FF72F9637C7), ref: 00007FF72F95AF2C
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F95AEC4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF72F95AEA3,?,?,?,?,?,00007FF72F9530CC), ref: 00007FF72F95AECD
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F95AEC4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF72F95AEA3,?,?,?,?,?,00007FF72F9530CC), ref: 00007FF72F95AEF2
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF72F9663A4
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F965D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72F965D7C
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF72F96661A
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF72F96662B
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF72F96663C
                                                                                                                                                                                                                            • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF72F96687C), ref: 00007FF72F966663
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                            • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                            • API String ID: 4070488512-239921721
                                                                                                                                                                                                                            • Opcode ID: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
                                                                                                                                                                                                                            • Instruction ID: 252ad88844409e43a5bed1efb522051c52c5d9540782043b30fa89db93f048de
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CBD1AF66B0828286E720BF25DC515F9A791EF84794FC08139EA8DCB689DF3DE441CF60
                                                                                                                                                                                                                            Function 00007FF72F9672BC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 318 7ff72f9672bc-7ff72f96732f call 7ff72f966ff0 321 7ff72f967349-7ff72f967353 call 7ff72f958434 318->321 322 7ff72f967331-7ff72f96733a call 7ff72f9554a4 318->322 328 7ff72f96736e-7ff72f9673d7 CreateFileW 321->328 329 7ff72f967355-7ff72f96736c call 7ff72f9554a4 call 7ff72f9554c4 321->329 327 7ff72f96733d-7ff72f967344 call 7ff72f9554c4 322->327 342 7ff72f96768a-7ff72f9676aa 327->342 330 7ff72f9673d9-7ff72f9673df 328->330 331 7ff72f967454-7ff72f96745f GetFileType 328->331 329->327 334 7ff72f967421-7ff72f96744f GetLastError call 7ff72f955438 330->334 335 7ff72f9673e1-7ff72f9673e5 330->335 337 7ff72f9674b2-7ff72f9674b9 331->337 338 7ff72f967461-7ff72f96749c GetLastError call 7ff72f955438 CloseHandle 331->338 334->327 335->334 340 7ff72f9673e7-7ff72f96741f CreateFileW 335->340 345 7ff72f9674bb-7ff72f9674bf 337->345 346 7ff72f9674c1-7ff72f9674c4 337->346 338->327 353 7ff72f9674a2-7ff72f9674ad call 7ff72f9554c4 338->353 340->331 340->334 347 7ff72f9674ca-7ff72f96751f call 7ff72f95834c 345->347 346->347 348 7ff72f9674c6 346->348 356 7ff72f96753e-7ff72f96756f call 7ff72f966d70 347->356 357 7ff72f967521-7ff72f96752d call 7ff72f9671f8 347->357 348->347 353->327 364 7ff72f967575-7ff72f9675b7 356->364 365 7ff72f967571-7ff72f967573 356->365 357->356 363 7ff72f96752f 357->363 368 7ff72f967531-7ff72f967539 call 7ff72f95b084 363->368 366 7ff72f9675d9-7ff72f9675e4 364->366 367 7ff72f9675b9-7ff72f9675bd 364->367 365->368 370 7ff72f967688 366->370 371 7ff72f9675ea-7ff72f9675ee 366->371 367->366 369 7ff72f9675bf-7ff72f9675d4 367->369 368->342 369->366 370->342 371->370 373 7ff72f9675f4-7ff72f967639 CloseHandle CreateFileW 371->373 375 7ff72f96763b-7ff72f967669 GetLastError call 7ff72f955438 call 7ff72f958574 373->375 376 7ff72f96766e-7ff72f967683 373->376 375->376 376->370
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1617910340-0
                                                                                                                                                                                                                            • Opcode ID: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
                                                                                                                                                                                                                            • Instruction ID: 339c086bad46930323a751681da86584c3e910595ec999ea195ae53d5e8d0669
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F4C1C633B24A8685EB10DF64C8905EC7761FB88BA8B810239DE5E973D9DF39D455CB10
                                                                                                                                                                                                                            Function 00007FF72F947950 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF72F94154F), ref: 00007FF72F9479E7
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F947B60: GetEnvironmentVariableW.KERNEL32(00007FF72F943A1F), ref: 00007FF72F947B9A
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F947B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF72F947BB7
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F957DEC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72F957E05
                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32 ref: 00007FF72F947AA1
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F942B30: MessageBoxW.USER32 ref: 00007FF72F942C05
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                                                            • API String ID: 3752271684-1116378104
                                                                                                                                                                                                                            • Opcode ID: d0ee005bfdeb011a84540aff6346199bb1fc02b76f4ac94b865217064e0c6b04
                                                                                                                                                                                                                            • Instruction ID: e436f0ac328e1b5a99580c029834d8d11d6182f5fb06f3ead5abb0d2a425d06d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d0ee005bfdeb011a84540aff6346199bb1fc02b76f4ac94b865217064e0c6b04
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4C516111B096CB41F954B76A9D212FAD261DF99BC0F844435ED8EC7B9EEE2DE4018B30
                                                                                                                                                                                                                            Function 00007FF72F9665EC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 792 7ff72f9665ec-7ff72f966621 call 7ff72f965cf8 call 7ff72f965d00 call 7ff72f965d68 799 7ff72f966627-7ff72f966632 call 7ff72f965d08 792->799 800 7ff72f96675f-7ff72f9667cd call 7ff72f95aec4 call 7ff72f961be8 792->800 799->800 805 7ff72f966638-7ff72f966643 call 7ff72f965d38 799->805 811 7ff72f9667db-7ff72f9667de 800->811 812 7ff72f9667cf-7ff72f9667d6 800->812 805->800 813 7ff72f966649-7ff72f96666c call 7ff72f95af0c GetTimeZoneInformation 805->813 816 7ff72f966815-7ff72f966828 call 7ff72f95dbbc 811->816 817 7ff72f9667e0 811->817 815 7ff72f96686b-7ff72f96686e 812->815 823 7ff72f966734-7ff72f96675e call 7ff72f965cf0 call 7ff72f965ce0 call 7ff72f965ce8 813->823 824 7ff72f966672-7ff72f966693 813->824 818 7ff72f9667e3 call 7ff72f9665ec 815->818 820 7ff72f966874-7ff72f96687c call 7ff72f966370 815->820 832 7ff72f96682a 816->832 833 7ff72f966833-7ff72f96684e call 7ff72f961be8 816->833 817->818 827 7ff72f9667e8-7ff72f966814 call 7ff72f95af0c call 7ff72f94bcc0 818->827 820->827 828 7ff72f96669e-7ff72f9666a5 824->828 829 7ff72f966695-7ff72f96669b 824->829 835 7ff72f9666a7-7ff72f9666af 828->835 836 7ff72f9666b9 828->836 829->828 838 7ff72f96682c-7ff72f966831 call 7ff72f95af0c 832->838 846 7ff72f966855-7ff72f966867 call 7ff72f95af0c 833->846 847 7ff72f966850-7ff72f966853 833->847 835->836 843 7ff72f9666b1-7ff72f9666b7 835->843 842 7ff72f9666bb-7ff72f96672f call 7ff72f94d0e0 * 4 call 7ff72f9631cc call 7ff72f966884 * 2 836->842 838->817 842->823 843->842 846->815 847->838
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF72F96661A
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F965D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72F965D7C
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF72F96662B
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F965D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72F965D1C
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF72F96663C
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F965D38: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72F965D4C
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F95AF0C: RtlFreeHeap.NTDLL(?,?,?,00007FF72F963392,?,?,?,00007FF72F9633CF,?,?,00000000,00007FF72F963895,?,?,00000000,00007FF72F9637C7), ref: 00007FF72F95AF22
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F95AF0C: GetLastError.KERNEL32(?,?,?,00007FF72F963392,?,?,?,00007FF72F9633CF,?,?,00000000,00007FF72F963895,?,?,00000000,00007FF72F9637C7), ref: 00007FF72F95AF2C
                                                                                                                                                                                                                            • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF72F96687C), ref: 00007FF72F966663
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                            • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                            • API String ID: 3458911817-239921721
                                                                                                                                                                                                                            • Opcode ID: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
                                                                                                                                                                                                                            • Instruction ID: ee6028b59511d27879ef7ffbb7e4d72e1c558a8246eeaca0891810011e59fb81
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6E511E76B1868286E710FF25EC915E9A760FB88784FC44139EA8DC7699DF3CE4418F60
                                                                                                                                                                                                                            Function 00007FF72F9488D0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2295610775-0
                                                                                                                                                                                                                            • Opcode ID: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
                                                                                                                                                                                                                            • Instruction ID: f6779563c51f40ebfb7f1babaf87d1c7313b6d54e462d6379c32d0989a96e182
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 61F08622B1C6C586E770AF64E8587A9B350EB54724F400735D6AD866D8DF3CD0088E10
                                                                                                                                                                                                                            Function 00007FF72F941710 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 0 7ff72f941710-7ff72f941724 1 7ff72f94173e-7ff72f941742 0->1 2 7ff72f941726-7ff72f94173d call 7ff72f942b30 0->2 4 7ff72f941768-7ff72f94178b call 7ff72f947c10 1->4 5 7ff72f941744-7ff72f94174d call 7ff72f9412b0 1->5 13 7ff72f9417b9-7ff72f9417d4 call 7ff72f943fd0 4->13 14 7ff72f94178d-7ff72f9417b8 call 7ff72f942890 4->14 11 7ff72f94175f-7ff72f941767 5->11 12 7ff72f94174f-7ff72f94175a call 7ff72f942b30 5->12 12->11 20 7ff72f9417ee-7ff72f941801 call 7ff72f950814 13->20 21 7ff72f9417d6-7ff72f9417e9 call 7ff72f942b30 13->21 27 7ff72f941823-7ff72f941827 20->27 28 7ff72f941803-7ff72f94181e call 7ff72f942890 20->28 26 7ff72f94192f-7ff72f941932 call 7ff72f95018c 21->26 36 7ff72f941937-7ff72f94194e 26->36 31 7ff72f941829-7ff72f941835 call 7ff72f941050 27->31 32 7ff72f941841-7ff72f941861 call 7ff72f954f90 27->32 39 7ff72f941927-7ff72f94192a call 7ff72f95018c 28->39 37 7ff72f94183a-7ff72f94183c 31->37 40 7ff72f941882-7ff72f941888 32->40 41 7ff72f941863-7ff72f94187d call 7ff72f942890 32->41 37->39 39->26 44 7ff72f94188e-7ff72f941897 40->44 45 7ff72f941915-7ff72f941918 call 7ff72f954f7c 40->45 49 7ff72f94191d-7ff72f941922 41->49 48 7ff72f9418a0-7ff72f9418c2 call 7ff72f9504dc 44->48 45->49 52 7ff72f9418f5-7ff72f9418fc 48->52 53 7ff72f9418c4-7ff72f9418dc call 7ff72f950c1c 48->53 49->39 54 7ff72f941903-7ff72f94190b call 7ff72f942890 52->54 58 7ff72f9418de-7ff72f9418e1 53->58 59 7ff72f9418e5-7ff72f9418f3 53->59 62 7ff72f941910 54->62 58->48 61 7ff72f9418e3 58->61 59->54 61->62 62->45
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message
                                                                                                                                                                                                                            • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
                                                                                                                                                                                                                            • API String ID: 2030045667-3833288071
                                                                                                                                                                                                                            • Opcode ID: cba09fa3c46937763bf224ccf79537a0250a953e50f684cfd44b9af569f5ed2f
                                                                                                                                                                                                                            • Instruction ID: 59ae3a8816c1a40e2318dabdfb82397beb44b0f47d17a0fa6307bf49ef2eb427
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cba09fa3c46937763bf224ccf79537a0250a953e50f684cfd44b9af569f5ed2f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4F518E61B086C281FA15BB15EC502E9A390FF55B94FC44435DE8CD77AEEE2CE1848F20
                                                                                                                                                                                                                            Function 00007FF72F948950 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(0000000100000001,00007FF72F94414C,00007FF72F947911,?,00007FF72F947D26,?,00007FF72F941785), ref: 00007FF72F948990
                                                                                                                                                                                                                            • OpenProcessToken.ADVAPI32(?,00007FF72F947D26,?,00007FF72F941785), ref: 00007FF72F9489A1
                                                                                                                                                                                                                            • GetTokenInformation.KERNELBASE(?,00007FF72F947D26,?,00007FF72F941785), ref: 00007FF72F9489C3
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,00007FF72F947D26,?,00007FF72F941785), ref: 00007FF72F9489CD
                                                                                                                                                                                                                            • GetTokenInformation.KERNELBASE(?,00007FF72F947D26,?,00007FF72F941785), ref: 00007FF72F948A0A
                                                                                                                                                                                                                            • ConvertSidToStringSidW.ADVAPI32 ref: 00007FF72F948A1C
                                                                                                                                                                                                                            • CloseHandle.KERNELBASE(?,00007FF72F947D26,?,00007FF72F941785), ref: 00007FF72F948A34
                                                                                                                                                                                                                            • LocalFree.KERNEL32(?,00007FF72F947D26,?,00007FF72F941785), ref: 00007FF72F948A66
                                                                                                                                                                                                                            • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF72F948A8D
                                                                                                                                                                                                                            • CreateDirectoryW.KERNELBASE(?,00007FF72F947D26,?,00007FF72F941785), ref: 00007FF72F948A9E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                                                                                                                                                                                                            • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                                            • API String ID: 4998090-2855260032
                                                                                                                                                                                                                            • Opcode ID: 9d301874694f13eee612efc427f36135b77fc192910b60788b949b6aa4b4f411
                                                                                                                                                                                                                            • Instruction ID: 078849f561b8aebad55136d2aa6bbd73d5dc8c4d2502fc286c0a66e08800700c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9d301874694f13eee612efc427f36135b77fc192910b60788b949b6aa4b4f411
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 104171317186C682EA50BF55E8446EAB360FB94794F840235EA9E8769DDF7CE444CF20
                                                                                                                                                                                                                            Function 00007FF72F941AA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _fread_nolock$Message
                                                                                                                                                                                                                            • String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                                                                                                                            • API String ID: 677216364-1384898525
                                                                                                                                                                                                                            • Opcode ID: 5b7a928fe3b090b613d0a81bb3db786e508de928f0a6ff40b90f534a933a81a0
                                                                                                                                                                                                                            • Instruction ID: 0573600fa2b863ca1ffdc9975cdd5b77e2f7f06499d48c6c2ef416a157c3e521
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5b7a928fe3b090b613d0a81bb3db786e508de928f0a6ff40b90f534a933a81a0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7A514D71B0968286EB15FF28DC501B8B7A0EF58B84B954135DA8CC77ADEE7CE4408F54
                                                                                                                                                                                                                            Function 00007FF72F948080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                                            • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                                            • API String ID: 2895956056-3524285272
                                                                                                                                                                                                                            • Opcode ID: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
                                                                                                                                                                                                                            • Instruction ID: 670516a88402e2be35769d3f41cdb4ed9045b65b6f59476bc78b82a2b7a8a85f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F741EE31B087C582DA20AB64E8552EAE365FB94364F900739E6ED87BD9DF7CD0448F10
                                                                                                                                                                                                                            Function 00007FF72F941000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 264COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 381 7ff72f941000-7ff72f9439d6 call 7ff72f94ff60 call 7ff72f94ff58 call 7ff72f9486b0 call 7ff72f94ff58 call 7ff72f94bc60 call 7ff72f9552f0 call 7ff72f955ef8 call 7ff72f941eb0 399 7ff72f9439dc-7ff72f9439ec call 7ff72f943ec0 381->399 400 7ff72f943ad2 381->400 399->400 406 7ff72f9439f2-7ff72f943a05 call 7ff72f943d90 399->406 402 7ff72f943ad7-7ff72f943af7 call 7ff72f94bcc0 400->402 406->400 409 7ff72f943a0b-7ff72f943a32 call 7ff72f947b60 406->409 412 7ff72f943a74-7ff72f943a9c call 7ff72f948040 call 7ff72f941cb0 409->412 413 7ff72f943a34-7ff72f943a43 call 7ff72f947b60 409->413 423 7ff72f943aa2-7ff72f943ab8 call 7ff72f941cb0 412->423 424 7ff72f943b71-7ff72f943b82 412->424 413->412 419 7ff72f943a45-7ff72f943a4b 413->419 421 7ff72f943a57-7ff72f943a71 call 7ff72f954f7c call 7ff72f948040 419->421 422 7ff72f943a4d-7ff72f943a55 419->422 421->412 422->421 440 7ff72f943aba-7ff72f943acd call 7ff72f942b30 423->440 441 7ff72f943af8-7ff72f943afb 423->441 426 7ff72f943b9e-7ff72f943ba1 424->426 427 7ff72f943b84-7ff72f943b8b 424->427 432 7ff72f943bb7-7ff72f943bcf call 7ff72f948ae0 426->432 433 7ff72f943ba3-7ff72f943ba9 426->433 427->426 430 7ff72f943b8d-7ff72f943b90 call 7ff72f9414f0 427->430 443 7ff72f943b95-7ff72f943b98 430->443 449 7ff72f943be2-7ff72f943be9 SetDllDirectoryW 432->449 450 7ff72f943bd1-7ff72f943bdd call 7ff72f942b30 432->450 437 7ff72f943bab-7ff72f943bb5 433->437 438 7ff72f943bef-7ff72f943bfc call 7ff72f946de0 433->438 437->432 437->438 451 7ff72f943c47-7ff72f943c4c call 7ff72f946d60 438->451 452 7ff72f943bfe-7ff72f943c0b call 7ff72f946a90 438->452 440->400 441->424 442 7ff72f943afd-7ff72f943b14 call 7ff72f943fd0 441->442 457 7ff72f943b1b-7ff72f943b47 call 7ff72f9482b0 442->457 458 7ff72f943b16-7ff72f943b19 442->458 443->400 443->426 449->438 450->400 460 7ff72f943c51-7ff72f943c54 451->460 452->451 466 7ff72f943c0d-7ff72f943c1c call 7ff72f9465f0 452->466 457->424 472 7ff72f943b49-7ff72f943b51 call 7ff72f95018c 457->472 462 7ff72f943b56-7ff72f943b6c call 7ff72f942b30 458->462 464 7ff72f943c5a-7ff72f943c67 460->464 465 7ff72f943d06-7ff72f943d15 call 7ff72f9434c0 460->465 462->400 469 7ff72f943c70-7ff72f943c7a 464->469 465->400 483 7ff72f943d1b-7ff72f943d6f call 7ff72f947fd0 call 7ff72f947b60 call 7ff72f943620 call 7ff72f948080 call 7ff72f946840 call 7ff72f946d60 465->483 481 7ff72f943c1e-7ff72f943c2a call 7ff72f946570 466->481 482 7ff72f943c3d-7ff72f943c42 call 7ff72f946840 466->482 474 7ff72f943c7c-7ff72f943c81 469->474 475 7ff72f943c83-7ff72f943c85 469->475 472->462 474->469 474->475 479 7ff72f943c87-7ff72f943caa call 7ff72f941ef0 475->479 480 7ff72f943cd1-7ff72f943d01 call 7ff72f943620 call 7ff72f943460 call 7ff72f943610 call 7ff72f946840 call 7ff72f946d60 475->480 479->400 494 7ff72f943cb0-7ff72f943cba 479->494 480->402 481->482 495 7ff72f943c2c-7ff72f943c3b call 7ff72f946c30 481->495 482->451 517 7ff72f943d7d-7ff72f943d87 call 7ff72f941e80 483->517 518 7ff72f943d71-7ff72f943d78 call 7ff72f947d40 483->518 498 7ff72f943cc0-7ff72f943ccf 494->498 495->460 498->480 498->498 517->402 518->517
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F943EC0: GetModuleFileNameW.KERNEL32(?,00007FF72F9439EA), ref: 00007FF72F943EF1
                                                                                                                                                                                                                            • SetDllDirectoryW.KERNEL32 ref: 00007FF72F943BE9
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F947B60: GetEnvironmentVariableW.KERNEL32(00007FF72F943A1F), ref: 00007FF72F947B9A
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F947B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF72F947BB7
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                                                                                                                            • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                                                            • API String ID: 2344891160-3602715111
                                                                                                                                                                                                                            • Opcode ID: b803b3bc41d93c8ede3c98a04fe4147212a526038ce71896a26eaf055c910cc9
                                                                                                                                                                                                                            • Instruction ID: 77d145c066b8220a9475e4f51d1c62d2b85bc09058cd01c1fb7769ef13c59aa2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b803b3bc41d93c8ede3c98a04fe4147212a526038ce71896a26eaf055c910cc9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 82B17B21B2C6C641EA65BB31AC516F9A391FF64784FC00135EACDC769EEE2CE5059F20
                                                                                                                                                                                                                            Function 00007FF72F941050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 522 7ff72f941050-7ff72f9410ab call 7ff72f94b4e0 525 7ff72f9410ad-7ff72f9410d2 call 7ff72f942b30 522->525 526 7ff72f9410d3-7ff72f9410eb call 7ff72f954f90 522->526 531 7ff72f941109-7ff72f941119 call 7ff72f954f90 526->531 532 7ff72f9410ed-7ff72f941104 call 7ff72f942890 526->532 538 7ff72f941137-7ff72f941147 531->538 539 7ff72f94111b-7ff72f941132 call 7ff72f942890 531->539 537 7ff72f94126c-7ff72f941281 call 7ff72f94b1c0 call 7ff72f954f7c * 2 532->537 554 7ff72f941286-7ff72f9412a0 537->554 541 7ff72f941150-7ff72f941175 call 7ff72f9504dc 538->541 539->537 548 7ff72f94125e 541->548 549 7ff72f94117b-7ff72f941185 call 7ff72f950250 541->549 552 7ff72f941264 548->552 549->548 556 7ff72f94118b-7ff72f941197 549->556 552->537 557 7ff72f9411a0-7ff72f9411c8 call 7ff72f949990 556->557 560 7ff72f9411ca-7ff72f9411cd 557->560 561 7ff72f941241-7ff72f94125c call 7ff72f942b30 557->561 562 7ff72f94123c 560->562 563 7ff72f9411cf-7ff72f9411d9 560->563 561->552 562->561 565 7ff72f9411db-7ff72f9411e8 call 7ff72f950c1c 563->565 566 7ff72f941203-7ff72f941206 563->566 572 7ff72f9411ed-7ff72f9411f0 565->572 569 7ff72f941219-7ff72f94121e 566->569 570 7ff72f941208-7ff72f941216 call 7ff72f94ca40 566->570 569->557 571 7ff72f941220-7ff72f941223 569->571 570->569 574 7ff72f941237-7ff72f94123a 571->574 575 7ff72f941225-7ff72f941228 571->575 576 7ff72f9411fe-7ff72f941201 572->576 577 7ff72f9411f2-7ff72f9411fc call 7ff72f950250 572->577 574->552 575->561 579 7ff72f94122a-7ff72f941232 575->579 576->561 577->569 577->576 579->541
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message
                                                                                                                                                                                                                            • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                            • API String ID: 2030045667-1655038675
                                                                                                                                                                                                                            • Opcode ID: 20f07d5497f98b98d29e47cc3211355221ae8af9de98a618917402c82fb68268
                                                                                                                                                                                                                            • Instruction ID: f8a1752013d830f9d46ce034b7919bc4edbc0bf40e4e324eb398efed2023c967
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 20f07d5497f98b98d29e47cc3211355221ae8af9de98a618917402c82fb68268
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BA51BF22B086C285FA61BB15AC403FAA290FB95794F844135EE8DD779DEF3CE5458F10
                                                                                                                                                                                                                            Function 00007FF72F95F1D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,?,?,00007FF72F95F56A,?,?,-00000018,00007FF72F95B317,?,?,?,00007FF72F95B20E,?,?,?,00007FF72F956452), ref: 00007FF72F95F34C
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,?,?,00007FF72F95F56A,?,?,-00000018,00007FF72F95B317,?,?,?,00007FF72F95B20E,?,?,?,00007FF72F956452), ref: 00007FF72F95F358
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                            • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                            • API String ID: 3013587201-537541572
                                                                                                                                                                                                                            • Opcode ID: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
                                                                                                                                                                                                                            • Instruction ID: 6fbe6125c1e0efd02a90fd6f93d77af05187c1eb5419be63017f80454c9d02e1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E241E361B19A8241FA15EB16AC006F5A391FF45BA8F894135DD8DDB78CEE3CE4498F20
                                                                                                                                                                                                                            Function 00007FF72F95C01C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 679 7ff72f95c01c-7ff72f95c042 680 7ff72f95c05d-7ff72f95c061 679->680 681 7ff72f95c044-7ff72f95c058 call 7ff72f9554a4 call 7ff72f9554c4 679->681 683 7ff72f95c437-7ff72f95c443 call 7ff72f9554a4 call 7ff72f9554c4 680->683 684 7ff72f95c067-7ff72f95c06e 680->684 699 7ff72f95c44e 681->699 702 7ff72f95c449 call 7ff72f95aea4 683->702 684->683 685 7ff72f95c074-7ff72f95c0a2 684->685 685->683 688 7ff72f95c0a8-7ff72f95c0af 685->688 691 7ff72f95c0c8-7ff72f95c0cb 688->691 692 7ff72f95c0b1-7ff72f95c0c3 call 7ff72f9554a4 call 7ff72f9554c4 688->692 697 7ff72f95c433-7ff72f95c435 691->697 698 7ff72f95c0d1-7ff72f95c0d7 691->698 692->702 700 7ff72f95c451-7ff72f95c468 697->700 698->697 703 7ff72f95c0dd-7ff72f95c0e0 698->703 699->700 702->699 703->692 706 7ff72f95c0e2-7ff72f95c107 703->706 708 7ff72f95c13a-7ff72f95c141 706->708 709 7ff72f95c109-7ff72f95c10b 706->709 710 7ff72f95c143-7ff72f95c16b call 7ff72f95dbbc call 7ff72f95af0c * 2 708->710 711 7ff72f95c116-7ff72f95c12d call 7ff72f9554a4 call 7ff72f9554c4 call 7ff72f95aea4 708->711 712 7ff72f95c10d-7ff72f95c114 709->712 713 7ff72f95c132-7ff72f95c138 709->713 744 7ff72f95c16d-7ff72f95c183 call 7ff72f9554c4 call 7ff72f9554a4 710->744 745 7ff72f95c188-7ff72f95c1b3 call 7ff72f95c844 710->745 742 7ff72f95c2c0 711->742 712->711 712->713 714 7ff72f95c1b8-7ff72f95c1cf 713->714 717 7ff72f95c24a-7ff72f95c254 call 7ff72f963f8c 714->717 718 7ff72f95c1d1-7ff72f95c1d9 714->718 729 7ff72f95c2de 717->729 730 7ff72f95c25a-7ff72f95c26f 717->730 718->717 723 7ff72f95c1db-7ff72f95c1dd 718->723 723->717 727 7ff72f95c1df-7ff72f95c1f5 723->727 727->717 732 7ff72f95c1f7-7ff72f95c203 727->732 738 7ff72f95c2e3-7ff72f95c303 ReadFile 729->738 730->729 734 7ff72f95c271-7ff72f95c283 GetConsoleMode 730->734 732->717 736 7ff72f95c205-7ff72f95c207 732->736 734->729 741 7ff72f95c285-7ff72f95c28d 734->741 736->717 743 7ff72f95c209-7ff72f95c221 736->743 739 7ff72f95c3fd-7ff72f95c406 GetLastError 738->739 740 7ff72f95c309-7ff72f95c311 738->740 749 7ff72f95c408-7ff72f95c41e call 7ff72f9554c4 call 7ff72f9554a4 739->749 750 7ff72f95c423-7ff72f95c426 739->750 740->739 746 7ff72f95c317 740->746 741->738 748 7ff72f95c28f-7ff72f95c2b1 ReadConsoleW 741->748 751 7ff72f95c2c3-7ff72f95c2cd call 7ff72f95af0c 742->751 743->717 752 7ff72f95c223-7ff72f95c22f 743->752 744->742 745->714 754 7ff72f95c31e-7ff72f95c333 746->754 756 7ff72f95c2b3 GetLastError 748->756 757 7ff72f95c2d2-7ff72f95c2dc 748->757 749->742 761 7ff72f95c42c-7ff72f95c42e 750->761 762 7ff72f95c2b9-7ff72f95c2bb call 7ff72f955438 750->762 751->700 752->717 760 7ff72f95c231-7ff72f95c233 752->760 754->751 765 7ff72f95c335-7ff72f95c340 754->765 756->762 757->754 760->717 769 7ff72f95c235-7ff72f95c245 760->769 761->751 762->742 771 7ff72f95c367-7ff72f95c36f 765->771 772 7ff72f95c342-7ff72f95c35b call 7ff72f95bc34 765->772 769->717 775 7ff72f95c3eb-7ff72f95c3f8 call 7ff72f95ba74 771->775 776 7ff72f95c371-7ff72f95c383 771->776 779 7ff72f95c360-7ff72f95c362 772->779 775->779 780 7ff72f95c3de-7ff72f95c3e6 776->780 781 7ff72f95c385 776->781 779->751 780->751 783 7ff72f95c38a-7ff72f95c391 781->783 784 7ff72f95c3cd-7ff72f95c3d8 783->784 785 7ff72f95c393-7ff72f95c397 783->785 784->780 786 7ff72f95c399-7ff72f95c3a0 785->786 787 7ff72f95c3b3 785->787 786->787 789 7ff72f95c3a2-7ff72f95c3a6 786->789 788 7ff72f95c3b9-7ff72f95c3c9 787->788 788->783 790 7ff72f95c3cb 788->790 789->787 791 7ff72f95c3a8-7ff72f95c3b1 789->791 790->780 791->788
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: be7416da91f84ed5bfdd546aa92e4ee07cb2f4e154380db95b5ab7bb0620c26f
                                                                                                                                                                                                                            • Instruction ID: 894fcc2e07e50b668608350515f8df88812e22af0338e7d966cf341719dbe3f7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: be7416da91f84ed5bfdd546aa92e4ee07cb2f4e154380db95b5ab7bb0620c26f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CAC1B332B0C7C691EA60AF6598406FDB754EB80B84FD50135DACE8779ADE7CE449CB20
                                                                                                                                                                                                                            Function 00007FF72F95D520 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 902 7ff72f95d520-7ff72f95d545 903 7ff72f95d54b-7ff72f95d54e 902->903 904 7ff72f95d813 902->904 906 7ff72f95d587-7ff72f95d5b3 903->906 907 7ff72f95d550-7ff72f95d582 call 7ff72f95add8 903->907 905 7ff72f95d815-7ff72f95d825 904->905 909 7ff72f95d5be-7ff72f95d5c4 906->909 910 7ff72f95d5b5-7ff72f95d5bc 906->910 907->905 911 7ff72f95d5d4-7ff72f95d5e9 call 7ff72f963f8c 909->911 912 7ff72f95d5c6-7ff72f95d5cf call 7ff72f95c8e0 909->912 910->907 910->909 917 7ff72f95d703-7ff72f95d70c 911->917 918 7ff72f95d5ef-7ff72f95d5f8 911->918 912->911 919 7ff72f95d70e-7ff72f95d714 917->919 920 7ff72f95d760-7ff72f95d785 WriteFile 917->920 918->917 921 7ff72f95d5fe-7ff72f95d602 918->921 924 7ff72f95d74c-7ff72f95d75e call 7ff72f95cfd8 919->924 925 7ff72f95d716-7ff72f95d719 919->925 922 7ff72f95d787-7ff72f95d78d GetLastError 920->922 923 7ff72f95d790 920->923 926 7ff72f95d604-7ff72f95d60c call 7ff72f954900 921->926 927 7ff72f95d613-7ff72f95d61e 921->927 922->923 928 7ff72f95d793 923->928 950 7ff72f95d6f0-7ff72f95d6f7 924->950 929 7ff72f95d71b-7ff72f95d71e 925->929 930 7ff72f95d738-7ff72f95d74a call 7ff72f95d1f8 925->930 926->927 932 7ff72f95d620-7ff72f95d629 927->932 933 7ff72f95d62f-7ff72f95d644 GetConsoleMode 927->933 935 7ff72f95d798 928->935 936 7ff72f95d7a4-7ff72f95d7ae 929->936 937 7ff72f95d724-7ff72f95d736 call 7ff72f95d0dc 929->937 930->950 932->917 932->933 940 7ff72f95d6fc 933->940 941 7ff72f95d64a-7ff72f95d650 933->941 943 7ff72f95d79d 935->943 944 7ff72f95d80c-7ff72f95d811 936->944 945 7ff72f95d7b0-7ff72f95d7b5 936->945 937->950 940->917 948 7ff72f95d6d9-7ff72f95d6eb call 7ff72f95cb60 941->948 949 7ff72f95d656-7ff72f95d659 941->949 943->936 944->905 951 7ff72f95d7b7-7ff72f95d7ba 945->951 952 7ff72f95d7e3-7ff72f95d7ed 945->952 948->950 955 7ff72f95d65b-7ff72f95d65e 949->955 956 7ff72f95d664-7ff72f95d672 949->956 950->935 959 7ff72f95d7bc-7ff72f95d7cb 951->959 960 7ff72f95d7d3-7ff72f95d7de call 7ff72f955480 951->960 961 7ff72f95d7f4-7ff72f95d803 952->961 962 7ff72f95d7ef-7ff72f95d7f2 952->962 955->943 955->956 957 7ff72f95d674 956->957 958 7ff72f95d6d0-7ff72f95d6d4 956->958 963 7ff72f95d678-7ff72f95d68f call 7ff72f964058 957->963 958->928 959->960 960->952 961->944 962->904 962->961 968 7ff72f95d6c7-7ff72f95d6cd GetLastError 963->968 969 7ff72f95d691-7ff72f95d69d 963->969 968->958 970 7ff72f95d6bc-7ff72f95d6c3 969->970 971 7ff72f95d69f-7ff72f95d6b1 call 7ff72f964058 969->971 970->958 973 7ff72f95d6c5 970->973 971->968 975 7ff72f95d6b3-7ff72f95d6ba 971->975 973->963 975->970
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF72F95D50B), ref: 00007FF72F95D63C
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF72F95D50B), ref: 00007FF72F95D6C7
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 953036326-0
                                                                                                                                                                                                                            • Opcode ID: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
                                                                                                                                                                                                                            • Instruction ID: 2ef330b269fd312d0a07b47abf06256e1ace9b68ff29e0d1ccb8421bb0f85ffb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AF91CA62F1C6D185F750AF6998402FDA7A0EB44B88F94413ADE8F9769DDF38D442CB20
                                                                                                                                                                                                                            Function 00007FF72F95FCEC Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4170891091-0
                                                                                                                                                                                                                            • Opcode ID: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
                                                                                                                                                                                                                            • Instruction ID: dfb7d59373874ca0d50434321ba522cbee4f247b254fa2b8fdd1541696749bbd
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 99510572F042A286EB14EF249D557FCA7A5EB4036CF900139DE5EC2ED9DB38A405CB10
                                                                                                                                                                                                                            Function 00007FF72F955854 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2780335769-0
                                                                                                                                                                                                                            • Opcode ID: 76a0635d5597b22ce5d2941ff6046abd28e8f163941117926f9164ef5776c06c
                                                                                                                                                                                                                            • Instruction ID: b39e9941cd51c96eff74f760d67cf0625d01f626a83b5d2ecbfff505ba21779c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 76a0635d5597b22ce5d2941ff6046abd28e8f163941117926f9164ef5776c06c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 42514F62B1868189F710EF61D8603BDA7A1EF44758F944535DA8D8779EDF3CD4418B20
                                                                                                                                                                                                                            Function 00007FF72F94C07C Relevance: 6.1, APIs: 4, Instructions: 94COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1452418845-0
                                                                                                                                                                                                                            • Opcode ID: 416c85195b1c4a12d0bca0f9f3e62a22dfdeb9afd9333f8228f8268f9139cf84
                                                                                                                                                                                                                            • Instruction ID: 4e4b1e60b504a8d50a942458e267debda69a917d5f1b89021556f4c866f5dcd0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 416c85195b1c4a12d0bca0f9f3e62a22dfdeb9afd9333f8228f8268f9139cf84
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8831C721B4D1C349FA24BB659C613F99391DFA5788FC44035E98E872AFDE2DA408CE31
                                                                                                                                                                                                                            Function 00007FF72F955700 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1279662727-0
                                                                                                                                                                                                                            • Opcode ID: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
                                                                                                                                                                                                                            • Instruction ID: 79229b50a1dfe1221535a7227d6b82864709274f671095a24d4bfa0527470b4b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8041A462E187C183F754AF2099003A9A360FF94768F509334EADC47BDADF6CA5E08B10
                                                                                                                                                                                                                            Function 00007FF72F959FC0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1703294689-0
                                                                                                                                                                                                                            • Opcode ID: 8770705702221fa6c619df89f3c2f6fa117b36761db68559c6d5aced1687d582
                                                                                                                                                                                                                            • Instruction ID: 71e9953c93fdbb859a78d178209fb1366e4afc721a3cd73689842da5217ab917
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8770705702221fa6c619df89f3c2f6fa117b36761db68559c6d5aced1687d582
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1AD05E10B1828642FB143F321C980FC9315DF49705F80143CC88B8238BED2CE80D4B20
                                                                                                                                                                                                                            Function 00007FF72F95027C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 7abeb8fe783ee1c87e05308e58bf334fc2d3c30e054771bdd4fe3d83d7422279
                                                                                                                                                                                                                            • Instruction ID: 7d3536f07024a22c2ac2dcbf899402a86c175dffb71dee06f066c5df678baff0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7abeb8fe783ee1c87e05308e58bf334fc2d3c30e054771bdd4fe3d83d7422279
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6351B621B096C346E664BE269C007FAA681FB84FA4F944634DDED877EDDE3CD4418E20
                                                                                                                                                                                                                            Function 00007FF72F95C6F4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2976181284-0
                                                                                                                                                                                                                            • Opcode ID: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
                                                                                                                                                                                                                            • Instruction ID: ea9932a286c82b65006fd99d3c610683db6103bc082a556b415fecc2005c5b2e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B211B261718AC181DA10AB35A8041A9A361EB44BF4F940331EAFD87BDDCF3CD051CB40
                                                                                                                                                                                                                            Function 00007FF72F9559FC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72F955911), ref: 00007FF72F955A2F
                                                                                                                                                                                                                            • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72F955911), ref: 00007FF72F955A45
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1707611234-0
                                                                                                                                                                                                                            • Opcode ID: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
                                                                                                                                                                                                                            • Instruction ID: 73e37706f6bd6e804cdad8a9e4606c13e7b0752c87f6a08f3206de3d1bad51b7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A5118F6270C68281EA94AB55A8511BEF7A0FF85765F900235EADDC5ADCEF2CD044CF20
                                                                                                                                                                                                                            Function 00007FF72F95AF0C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RtlFreeHeap.NTDLL(?,?,?,00007FF72F963392,?,?,?,00007FF72F9633CF,?,?,00000000,00007FF72F963895,?,?,00000000,00007FF72F9637C7), ref: 00007FF72F95AF22
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00007FF72F963392,?,?,?,00007FF72F9633CF,?,?,00000000,00007FF72F963895,?,?,00000000,00007FF72F9637C7), ref: 00007FF72F95AF2C
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 485612231-0
                                                                                                                                                                                                                            • Opcode ID: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
                                                                                                                                                                                                                            • Instruction ID: 84a92ca511e6ff548b81c581fefd87c772a065a80135146d8263e2bf481feeb8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 79E0BF50F096C246FB157BB25C551B99551DF84741FC44474DD8DC625AEE2CA8894E20
                                                                                                                                                                                                                            Function 00007FF72F9586A8 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DeleteErrorFileLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2018770650-0
                                                                                                                                                                                                                            • Opcode ID: 4ec91da2963a3bb04052aa88cca811f321d2e1bc87a8cb66c404f3cefda0a691
                                                                                                                                                                                                                            • Instruction ID: d602c4df18f699543ccfce8aeed9a49d6d893540b62b63abc0d2fd6f236ebeea
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4ec91da2963a3bb04052aa88cca811f321d2e1bc87a8cb66c404f3cefda0a691
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 01D01214F1A5C381E7143F760C495F99194EF94725FD00634C0ADC12E9EE6CA0850E31
                                                                                                                                                                                                                            Function 00007FF72F957E24 Relevance: 3.0, APIs: 2, Instructions: 12COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 377330604-0
                                                                                                                                                                                                                            • Opcode ID: 77acb875fdee33a12be4fb2ce6bc4fe447f240992313a5771dda9a679e1972f9
                                                                                                                                                                                                                            • Instruction ID: 96e7bc03b17965455f14f2c1ff889d0f4994e89972a6939cfbbdc807d39c706d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 77acb875fdee33a12be4fb2ce6bc4fe447f240992313a5771dda9a679e1972f9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 19D0C910F1968781E6243B711C851B99191AF55735FD01634C0ADC02E9EE2CA9890D32
                                                                                                                                                                                                                            Function 00007FF72F95B11C Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CloseHandle.KERNELBASE(?,?,?,00007FF72F95AF99,?,?,00000000,00007FF72F95B04E), ref: 00007FF72F95B18A
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00007FF72F95AF99,?,?,00000000,00007FF72F95B04E), ref: 00007FF72F95B194
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 918212764-0
                                                                                                                                                                                                                            • Opcode ID: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
                                                                                                                                                                                                                            • Instruction ID: 64bab4352f83ddb84f26f1479d6d702cf0b9abae7441adef8ed47d69fba68e77
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DF21A461F196C241FEA07F609C542F99281DF847E8F844235DA9EC73DEDE6CA4458B21
                                                                                                                                                                                                                            Function 00007FF72F947D40 Relevance: 1.6, APIs: 1, Instructions: 141COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F948AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF72F942ABB), ref: 00007FF72F948B1A
                                                                                                                                                                                                                            • _findclose.LIBCMT ref: 00007FF72F947F99
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWide_findclose
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2772937645-0
                                                                                                                                                                                                                            • Opcode ID: 6a56ecc169b874fe1e233505f6f9a5acf1cae56fd8a9bc6900038e6ac80cd412
                                                                                                                                                                                                                            • Instruction ID: b854123bfb2585fc4feaa2a552de3b7b12d3bad631d820867c53159e3bee4a51
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6a56ecc169b874fe1e233505f6f9a5acf1cae56fd8a9bc6900038e6ac80cd412
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F571B652E18BC581E611EB2CC9452FDA370F7A9B4CF94E321DB9C52596EF28E2D9C700
                                                                                                                                                                                                                            Function 00007FF72F95C46C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 491d756dfbf5d606f7e783a7bab36e7eaa3001c20d525fc7b9da7dd63869e3d6
                                                                                                                                                                                                                            • Instruction ID: adce92bcb57ed73ff78d4949c9284fee812a2d89844ce844e8476221cb643853
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 491d756dfbf5d606f7e783a7bab36e7eaa3001c20d525fc7b9da7dd63869e3d6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E541B372B0828187EA64EB79A9401B9B7A0EB55B45F900131E7CEC7699CF2DE403CF70
                                                                                                                                                                                                                            Function 00007FF72F9482B0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _fread_nolock
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 840049012-0
                                                                                                                                                                                                                            • Opcode ID: 0fe9bd809d16dbb081c5160e2147b47f25fe8d51a8aa5299c63491277047e199
                                                                                                                                                                                                                            • Instruction ID: d099fc6be8c6f79ed34dc14c214ca53727a3de0e41e641bbad35c8e190d71b23
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0fe9bd809d16dbb081c5160e2147b47f25fe8d51a8aa5299c63491277047e199
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7C21A021B082D246EA54BB166D14BFAE655FF55BD4FCC5430EE8D8B78ACE3DE0018A20
                                                                                                                                                                                                                            Function 00007FF72F95BEFC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 33c1c355f770a45dc32ec47b5556db51f5a056321d098f55ce731dda09118c74
                                                                                                                                                                                                                            • Instruction ID: bdc39c65ff9a4f4c017c7f063ab438dba3450337d19510924ab39a19324e0460
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 33c1c355f770a45dc32ec47b5556db51f5a056321d098f55ce731dda09118c74
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4C316F62B1869286F651BF669C413FCA650EF80BA5F810235EE9D873D7CE7CE4418F21
                                                                                                                                                                                                                            Function 00007FF72F959EF1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3947729631-0
                                                                                                                                                                                                                            • Opcode ID: faec72fd928e516d4d760f4a89c99e996b8e0a7f11e884b20412009018256aa7
                                                                                                                                                                                                                            • Instruction ID: de5dbf597749e64801590550964e18f749829fde1a586948b0051fa901d0072b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: faec72fd928e516d4d760f4a89c99e996b8e0a7f11e884b20412009018256aa7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 92217F32B047818EFB24AF64D8502EC77A4EB04718F884639EA9D86AC9DF38D944CF50
                                                                                                                                                                                                                            Function 00007FF72F9564A8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
                                                                                                                                                                                                                            • Instruction ID: d288ed4be269d8764996f7c691ed5cabdc00700997d108b04577bc013418c6fa
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9F113E21B1C6C182EA60BF5198012BAE264EFC5B84F844431EACD87A9ADE7DE5408F20
                                                                                                                                                                                                                            Function 00007FF72F966CAC Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
                                                                                                                                                                                                                            • Instruction ID: 339ffd4be6b4483b75c828e7b143f0768dd26f9b55b0e1d604d14edd59782e89
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3B218632718AC186D761AF18D8407B9B6A0EB84B54F944238DB9DCB6DDDF3DD4058F10
                                                                                                                                                                                                                            Function 00007FF72F9504FC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
                                                                                                                                                                                                                            • Instruction ID: 9a7644ffe51eef1163e7add5b995404c97ede00f7d3ec0f8a878dc29c9b0210e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F1018221B0878241EA04BB575D002A9E691FF85FE0B884631DE9C97BEECE3DD4024B10
                                                                                                                                                                                                                            Function 00007FF72F9483E0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 377330604-0
                                                                                                                                                                                                                            • Opcode ID: 6c4021a24106022541deb1ea3fd86a243cef3e71c1828bca464903daed120211
                                                                                                                                                                                                                            • Instruction ID: 67d3fc916c0c3b23f9c57a38adf0729998b88e7247fdf2ae167c3007d181fe32
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6c4021a24106022541deb1ea3fd86a243cef3e71c1828bca464903daed120211
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 61418616E1C6C581E721BB2899116FDA360FBB5744F849232DBCD82197EF28E6D8C720
                                                                                                                                                                                                                            Function 00007FF72F95F158 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • HeapAlloc.KERNEL32(?,?,00000000,00007FF72F95B9A6,?,?,?,00007FF72F95AB67,?,?,00000000,00007FF72F95AE02), ref: 00007FF72F95F1AD
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AllocHeap
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4292702814-0
                                                                                                                                                                                                                            • Opcode ID: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
                                                                                                                                                                                                                            • Instruction ID: 8ef4a746f1181c04944a7d9610fcfd8195a9c141f6c8d791621723e255174481
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F5F06D45B0928685FE647A61DD103F9C291DF88BA8FCC4430CD8EC63DAEF2CE4808A30
                                                                                                                                                                                                                            Function 00007FF72F95DBBC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • HeapAlloc.KERNEL32(?,?,?,00007FF72F950D24,?,?,?,00007FF72F952236,?,?,?,?,?,00007FF72F953829), ref: 00007FF72F95DBFA
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AllocHeap
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4292702814-0
                                                                                                                                                                                                                            • Opcode ID: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
                                                                                                                                                                                                                            • Instruction ID: 6d4220ff8cb02fd4775d102c8ca091293d0e9452af90b073b66a76a354a5c2f5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 97F08240B0D2C745FE547B659C006F9D290DF847A4F880631DCAFC63CADE6CA4818E30

                                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                                            Function 00007FF72F946EF0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressProc
                                                                                                                                                                                                                            • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                            • API String ID: 190572456-2208601799
                                                                                                                                                                                                                            • Opcode ID: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
                                                                                                                                                                                                                            • Instruction ID: cb8fe6505fefc76965f78caaf2fb2304a65d6e17342b8b8b3b57fff92e97d617
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6EE1D9A0B0DB8790FA55BB0AAC501F4E7A5EF14744BC4543AC8DE866ACEF7DB5448E20
                                                                                                                                                                                                                            Function 00007FF72F941F50 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
                                                                                                                                                                                                                            • String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                                                                                                                            • API String ID: 2446303242-1601438679
                                                                                                                                                                                                                            • Opcode ID: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
                                                                                                                                                                                                                            • Instruction ID: 952f5b9af5d80b3cc3172299edef3e7b1e5b7b4ffe45e3f97a8e5dc45a3bcb4f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F4A15876708BC586E7149F21E8547AAB760F788B84F90412AEB9D43B28DF3DE164CF50
                                                                                                                                                                                                                            Function 00007FF72F94C57C Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3140674995-0
                                                                                                                                                                                                                            • Opcode ID: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
                                                                                                                                                                                                                            • Instruction ID: 54c3b3b9a5cfc4acaaf5c6b307dda1d35d2149e0317c5348d2cba59304f2a4ad
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 79313672709AC19AE760AF60E8503ED7364FB54748F844039DA8D87A98EF38D548CB24
                                                                                                                                                                                                                            Function 00007FF72F95ABD8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1239891234-0
                                                                                                                                                                                                                            • Opcode ID: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
                                                                                                                                                                                                                            • Instruction ID: 6b5df905715b92111c8520a0ae5199df15e04f7eb4a1ad5ce81be21591b7e2ec
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B2315036708B8186DB60AF25E8402EDB3A4FB84754F900135EA9D83B58EF38D545CF10
                                                                                                                                                                                                                            Function 00007FF72F961EE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2227656907-0
                                                                                                                                                                                                                            • Opcode ID: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
                                                                                                                                                                                                                            • Instruction ID: b9cd5d5cb5a5fa7f6f802c715ca8e6411c060ddbde88e460ed65c65638c5a967
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7DB1A122B1C6D241EE60AB229C041F9A390EB44BD4F844139EE9E87B8DDF3CE445CB10
                                                                                                                                                                                                                            Function 00007FF72F9451E0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressProc
                                                                                                                                                                                                                            • String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                            • API String ID: 190572456-4266016200
                                                                                                                                                                                                                            • Opcode ID: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
                                                                                                                                                                                                                            • Instruction ID: 159b8581e26e17962d9223aace01f0047e022e5ec9ec8291ca40f833f6910ce5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CC12B264B0EBC391FA15FB44AC501F4A2A5EF14745BC4543AD99ECA3ACFF7CA548CA20
                                                                                                                                                                                                                            Function 00007FF72F9412B0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message_fread_nolock
                                                                                                                                                                                                                            • String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
                                                                                                                                                                                                                            • API String ID: 3065259568-2316137593
                                                                                                                                                                                                                            • Opcode ID: 2cd6527208e1f56145baded65ec3c2f26d5e0465bce0863e974b3b89b8bc57ca
                                                                                                                                                                                                                            • Instruction ID: a09a759358ad097a17fc583ba735bd8df463bd7bff2a0b13640e438d38d78e99
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2cd6527208e1f56145baded65ec3c2f26d5e0465bce0863e974b3b89b8bc57ca
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C7518E21B086C745FA25BB15AC516FAA394EF54784FC04031EECD97A9EEE3CE5418F10
                                                                                                                                                                                                                            Function 00007FF72F9423F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                            • String ID: P%
                                                                                                                                                                                                                            • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                            • Opcode ID: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
                                                                                                                                                                                                                            • Instruction ID: 74d9f1ef6454d7252c45f4de49a6c012aaf3470f3056fcc1431b5fd67da8b0d2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4351E8266147E186D634AF26E4181BAF7A1F798B61F404125EBDE83798DF3CD045DB20
                                                                                                                                                                                                                            Function 00007FF72F948560 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetLastError.KERNEL32(00000000,00007FF72F942A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF72F94101D), ref: 00007FF72F948587
                                                                                                                                                                                                                            • FormatMessageW.KERNEL32 ref: 00007FF72F9485B6
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32 ref: 00007FF72F94860C
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9429E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF72F9487F2,?,?,?,?,?,?,?,?,?,?,?,00007FF72F94101D), ref: 00007FF72F942A14
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9429E0: MessageBoxW.USER32 ref: 00007FF72F942AF0
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLastMessage$ByteCharFormatMultiWide
                                                                                                                                                                                                                            • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                                            • API String ID: 2920928814-2573406579
                                                                                                                                                                                                                            • Opcode ID: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
                                                                                                                                                                                                                            • Instruction ID: efd1e699a12d6583e16d36981bdfd010c62040882e823e67594e8ac0ec3872e6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 55213071B18AC692E660BF16EC546E5A265FF98384FC40139D6CDC66ACEF3CD1458F20
                                                                                                                                                                                                                            Function 00007FF72F9567A4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: -$:$f$p$p
                                                                                                                                                                                                                            • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                            • Opcode ID: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
                                                                                                                                                                                                                            • Instruction ID: 9560e975291d6343dbc9b7593e7185b8641e76bb4258785593260ad7f5d31bed
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A0126C62F0C2C386FB64BA15E9546F9E6A1EB80754FC44535E6CA866CCDF3CE4848F24
                                                                                                                                                                                                                            Function 00007FF72F951108 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: f$f$p$p$f
                                                                                                                                                                                                                            • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                            • Opcode ID: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
                                                                                                                                                                                                                            • Instruction ID: fd0ba416e364681edf1763d48349d4e5c8d0004f3cd49f52a92b0df2477eccd1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EF127F26F0C1C386FB64BA15A8546FAF262EB80754FC44135E6DA866DCDB7DE4C08F20
                                                                                                                                                                                                                            Function 00007FF72F9415A0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message
                                                                                                                                                                                                                            • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                            • API String ID: 2030045667-3659356012
                                                                                                                                                                                                                            • Opcode ID: f4caf56583cd4aacf67c55de06545714ec535bae85a6d7c4a0c947baae243c15
                                                                                                                                                                                                                            • Instruction ID: 20415e236109c50c734b3936bf778f04d3583ef094e94806fb59cdc0a579b96e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f4caf56583cd4aacf67c55de06545714ec535bae85a6d7c4a0c947baae243c15
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AF314C21B086C246FA25BB51AC505FAE3A0EF547D4FC84032DE8D97A5DEE3CE5858F20
                                                                                                                                                                                                                            Function 00007FF72F94EB00 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                            • String ID: csm$csm$csm
                                                                                                                                                                                                                            • API String ID: 849930591-393685449
                                                                                                                                                                                                                            • Opcode ID: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
                                                                                                                                                                                                                            • Instruction ID: 4a505d92dd63935ac7d5719af97d6ed6bbd3d10bab229c1f1ac628398e87876e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEE16372B0878186EB20FB6598403EEB7A4FB65798F500535EE8D97B99DF38E540CB10
                                                                                                                                                                                                                            Function 00007FF72F9486B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF72F94101D), ref: 00007FF72F948747
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF72F94101D), ref: 00007FF72F94879E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWide
                                                                                                                                                                                                                            • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                            • API String ID: 626452242-27947307
                                                                                                                                                                                                                            • Opcode ID: 3d8cc197ee630c3fb00dd31b72f24074ca9fe52add05c6a83a64952da4f63ba4
                                                                                                                                                                                                                            • Instruction ID: 4beb6837331693eede134c273c3c916b082d9e9fa37e97aa8fd8ba7d68349374
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3d8cc197ee630c3fb00dd31b72f24074ca9fe52add05c6a83a64952da4f63ba4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 52418B32B08AC282E660FF1AAC501BAF6A1FB94794F944135DEDD87B98DF3CD0558B10
                                                                                                                                                                                                                            Function 00007FF72F948BF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(?,00007FF72F9439EA), ref: 00007FF72F948C31
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9429E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF72F9487F2,?,?,?,?,?,?,?,?,?,?,?,00007FF72F94101D), ref: 00007FF72F942A14
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9429E0: MessageBoxW.USER32 ref: 00007FF72F942AF0
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(?,00007FF72F9439EA), ref: 00007FF72F948CA5
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                                                                                                                            • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                            • API String ID: 3723044601-27947307
                                                                                                                                                                                                                            • Opcode ID: 93215b2962e715be9f5aa91d99be70836a612e16585fb8aee950a2577366c4a3
                                                                                                                                                                                                                            • Instruction ID: 546c46567840bbf70b31137e27e106c221d2c135c232371c16c72f39dce028e5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 93215b2962e715be9f5aa91d99be70836a612e16585fb8aee950a2577366c4a3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 89217331709BC295EB10FF16AD540B9B251FB94BC0B944135D68EC7B98EF3CE5058B10
                                                                                                                                                                                                                            Function 00007FF72F9475A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo$_fread_nolock
                                                                                                                                                                                                                            • String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
                                                                                                                                                                                                                            • API String ID: 3231891352-3501660386
                                                                                                                                                                                                                            • Opcode ID: e98872a19d9130f130bbde9962ddc68dd11f225a0d4d19563b9e793c459c0872
                                                                                                                                                                                                                            • Instruction ID: 0f8abba27da3a2eef73f9261002762b50aa37e8181e4fb01b543e197ea7df6f1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e98872a19d9130f130bbde9962ddc68dd11f225a0d4d19563b9e793c459c0872
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9B515E60B0D6CB45F910BB259D502F992A1DFA5B90FC40031ED8DC76DEEE2DE5018F62
                                                                                                                                                                                                                            Function 00007FF72F94DDB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(?,?,?,00007FF72F94E06A,?,?,?,00007FF72F94DD5C,?,?,00000001,00007FF72F94D979), ref: 00007FF72F94DE3D
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00007FF72F94E06A,?,?,?,00007FF72F94DD5C,?,?,00000001,00007FF72F94D979), ref: 00007FF72F94DE4B
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(?,?,?,00007FF72F94E06A,?,?,?,00007FF72F94DD5C,?,?,00000001,00007FF72F94D979), ref: 00007FF72F94DE75
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,?,?,00007FF72F94E06A,?,?,?,00007FF72F94DD5C,?,?,00000001,00007FF72F94D979), ref: 00007FF72F94DEBB
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,?,?,00007FF72F94E06A,?,?,?,00007FF72F94DD5C,?,?,00000001,00007FF72F94D979), ref: 00007FF72F94DEC7
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                            • String ID: api-ms-
                                                                                                                                                                                                                            • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                            • Opcode ID: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
                                                                                                                                                                                                                            • Instruction ID: 9f066dd8574b9b532e2c56c2956bb147e536c4a66283f4324a02340452432df6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0431C825B1A68291EE12FB05AC005F6A3D4FF64B64F990536DE9E87358EF3CE4458B20
                                                                                                                                                                                                                            Function 00007FF72F947420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F948AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF72F942ABB), ref: 00007FF72F948B1A
                                                                                                                                                                                                                            • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF72F9479A1,00000000,?,00000000,00000000,?,00007FF72F94154F), ref: 00007FF72F94747F
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F942B30: MessageBoxW.USER32 ref: 00007FF72F942C05
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF72F9474DA
                                                                                                                                                                                                                            • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF72F947456
                                                                                                                                                                                                                            • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF72F947493
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                            • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                                                                                            • API String ID: 1662231829-3498232454
                                                                                                                                                                                                                            • Opcode ID: 5e8575f0beacdb372a81e9debe9bb6d766e8e255e7029f60019f70bf69282784
                                                                                                                                                                                                                            • Instruction ID: bf93844a1b944e0bed726ed7486d31308dde8a8b8c9c82930eef13a623b104d7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5e8575f0beacdb372a81e9debe9bb6d766e8e255e7029f60019f70bf69282784
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 31318851F1C7C640FA60BB259D553F99251EFA8780FC40436DA8EC679EEE2DE1048E21
                                                                                                                                                                                                                            Function 00007FF72F948AE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF72F942ABB), ref: 00007FF72F948B1A
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9429E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF72F9487F2,?,?,?,?,?,?,?,?,?,?,?,00007FF72F94101D), ref: 00007FF72F942A14
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9429E0: MessageBoxW.USER32 ref: 00007FF72F942AF0
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF72F942ABB), ref: 00007FF72F948BA0
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                                                                                                                            • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                            • API String ID: 3723044601-876015163
                                                                                                                                                                                                                            • Opcode ID: 2a7f0904e5ec1897560545d2159a663e9c273eaf1fea03a0d1ae7df506dc6c73
                                                                                                                                                                                                                            • Instruction ID: 82bf48c00cee3c20b6293f259b98543f66daec56d24d40016ec2006477029488
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2a7f0904e5ec1897560545d2159a663e9c273eaf1fea03a0d1ae7df506dc6c73
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 09216422B08AC281EB50FB1AFC101A5E361FB947C4B984136DB9CD3B6DEF2CD5418B10
                                                                                                                                                                                                                            Function 00007FF72F95B710 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Value$ErrorLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2506987500-0
                                                                                                                                                                                                                            • Opcode ID: 5e25a57dc3899cb5d9e1114fbc8c557aa55031a2469902f6cab5e8a78f8e35b9
                                                                                                                                                                                                                            • Instruction ID: a122d02f8a8fe2fab9cdbb103ed2c651c00ba7c51fe490c862b9848fecabb1a1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5e25a57dc3899cb5d9e1114fbc8c557aa55031a2469902f6cab5e8a78f8e35b9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E0215064B0C2C241FA657B315E562F9E282DF447B4F944734E8BEC6BDEDE2CA4014E20
                                                                                                                                                                                                                            Function 00007FF72F9685BC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                            • String ID: CONOUT$
                                                                                                                                                                                                                            • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                            • Opcode ID: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
                                                                                                                                                                                                                            • Instruction ID: eee9587eeb524041ad4ddba5daee5f367ec4d5875c4ab1ba07641779d7d77297
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AB118461B18BC186E750AB42EC54769A7A4FB48BE4F440238D99DC77A8DF3CD4448F50
                                                                                                                                                                                                                            Function 00007FF72F95B888 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00007FF72F9554CD,?,?,?,?,00007FF72F95F1BF,?,?,00000000,00007FF72F95B9A6,?,?,?), ref: 00007FF72F95B897
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72F9554CD,?,?,?,?,00007FF72F95F1BF,?,?,00000000,00007FF72F95B9A6,?,?,?), ref: 00007FF72F95B8CD
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72F9554CD,?,?,?,?,00007FF72F95F1BF,?,?,00000000,00007FF72F95B9A6,?,?,?), ref: 00007FF72F95B8FA
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72F9554CD,?,?,?,?,00007FF72F95F1BF,?,?,00000000,00007FF72F95B9A6,?,?,?), ref: 00007FF72F95B90B
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72F9554CD,?,?,?,?,00007FF72F95F1BF,?,?,00000000,00007FF72F95B9A6,?,?,?), ref: 00007FF72F95B91C
                                                                                                                                                                                                                            • SetLastError.KERNEL32(?,?,?,00007FF72F9554CD,?,?,?,?,00007FF72F95F1BF,?,?,00000000,00007FF72F95B9A6,?,?,?), ref: 00007FF72F95B937
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Value$ErrorLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2506987500-0
                                                                                                                                                                                                                            • Opcode ID: 941158fb4e6d3a9375e13d6d10033e8ffcdbbced4d4dd5e625aa307a16b34608
                                                                                                                                                                                                                            • Instruction ID: bd4b9e3d95b0bc3364ddc4f2162d303359169287e90e40bcc4aeadccf7954a12
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 941158fb4e6d3a9375e13d6d10033e8ffcdbbced4d4dd5e625aa307a16b34608
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 19114F60B087C642FA687B315D552B9E291DF447B4FD45734D9BECA6CEDE2CA4024E20
                                                                                                                                                                                                                            Function 00007FF72F94D778 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                            • String ID: csm$f
                                                                                                                                                                                                                            • API String ID: 2395640692-629598281
                                                                                                                                                                                                                            • Opcode ID: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
                                                                                                                                                                                                                            • Instruction ID: 3d535e186894bbe4525e7d8d0dbac2f6bbc916c8075a18d60afcf31a5b22ed87
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5F51D936B1968186E714FB19E804AB9B755FB50B98F908136DACFC774CDF38E8408B10
                                                                                                                                                                                                                            Function 00007FF72F942600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                            • String ID: Unhandled exception in script
                                                                                                                                                                                                                            • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                            • Opcode ID: ef2f79dabe8b940bf64869f24e404b0ac86445532df2e67e8084f44f9f65f5c2
                                                                                                                                                                                                                            • Instruction ID: 4da9111f3fa6d36e1b3f1fd314ae7e4a760e77d8e6b6237f45e50dcdc0af8217
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ef2f79dabe8b940bf64869f24e404b0ac86445532df2e67e8084f44f9f65f5c2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 57311876B19AC685EB20FF65EC552F9A360FF89784F800135EA8D8BA59DF3CD1058B10
                                                                                                                                                                                                                            Function 00007FF72F9429E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetLastError.KERNEL32(00000000,00000000,00000000,00007FF72F9487F2,?,?,?,?,?,?,?,?,?,?,?,00007FF72F94101D), ref: 00007FF72F942A14
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F948560: GetLastError.KERNEL32(00000000,00007FF72F942A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF72F94101D), ref: 00007FF72F948587
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F948560: FormatMessageW.KERNEL32 ref: 00007FF72F9485B6
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F948AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF72F942ABB), ref: 00007FF72F948B1A
                                                                                                                                                                                                                            • MessageBoxW.USER32 ref: 00007FF72F942AF0
                                                                                                                                                                                                                            • MessageBoxA.USER32 ref: 00007FF72F942B0C
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$ErrorLast$ByteCharFormatMultiWide
                                                                                                                                                                                                                            • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                                                            • API String ID: 2806210788-2410924014
                                                                                                                                                                                                                            • Opcode ID: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
                                                                                                                                                                                                                            • Instruction ID: 4b6fee08ebb0f59c4725d84e3bf706f0c1c252e8cf63ab48a622df8bfebbf711
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 24313C72728AC291E620BB14E8516EAA364FB94784F804036EACD96A9DDF3CD645CF50
                                                                                                                                                                                                                            Function 00007FF72F95A018 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                            • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                            • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                            • Opcode ID: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
                                                                                                                                                                                                                            • Instruction ID: e61f932710d68dd29790f5e43500f0304006f81f46734c0e76ce3ab49dd423a3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A4F03161B1974241EA146B24EC443B99360EF45765F940239C5AD851E8DF3DD4888F64
                                                                                                                                                                                                                            Function 00007FF72F969C40 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _set_statfp
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1156100317-0
                                                                                                                                                                                                                            • Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                                                                                                                                                                                                                            • Instruction ID: 2b7493b25cc878bbad0e97b387006e0b3197ac54f56f2ce55ff96b423feaf9f1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 18116032F18A8349F7583228ED623F594A0EF54364E84063DE5EF862DECE2D78814A20
                                                                                                                                                                                                                            Function 00007FF72F95B950 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FlsGetValue.KERNEL32(?,?,?,00007FF72F95AB67,?,?,00000000,00007FF72F95AE02,?,?,?,?,?,00007FF72F9530CC), ref: 00007FF72F95B96F
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72F95AB67,?,?,00000000,00007FF72F95AE02,?,?,?,?,?,00007FF72F9530CC), ref: 00007FF72F95B98E
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72F95AB67,?,?,00000000,00007FF72F95AE02,?,?,?,?,?,00007FF72F9530CC), ref: 00007FF72F95B9B6
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72F95AB67,?,?,00000000,00007FF72F95AE02,?,?,?,?,?,00007FF72F9530CC), ref: 00007FF72F95B9C7
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72F95AB67,?,?,00000000,00007FF72F95AE02,?,?,?,?,?,00007FF72F9530CC), ref: 00007FF72F95B9D8
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Value
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3702945584-0
                                                                                                                                                                                                                            • Opcode ID: 4fc6ccaa14371e387e5c22fb95057e46c3ade10dd54edcd3ce0e48e5b46d1de5
                                                                                                                                                                                                                            • Instruction ID: e944dd67a55ddcde63ebc57a5852ac86849e5043c04c49f0d8ecb21879daf9ef
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4fc6ccaa14371e387e5c22fb95057e46c3ade10dd54edcd3ce0e48e5b46d1de5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 041130A0B086C241FA657B269D612F9E141EF447B4F944334EAFDC67DEDE2CE4428E21
                                                                                                                                                                                                                            Function 00007FF72F95B7E4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Value
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3702945584-0
                                                                                                                                                                                                                            • Opcode ID: 64fe73475c7f3c5e3ff0e30dd8e21900901c314ca9004384e47b330d372873f3
                                                                                                                                                                                                                            • Instruction ID: b1a1df987c5936709ab5a81ff9c67c77eb09007cfeca312f947568ed45536a57
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 64fe73475c7f3c5e3ff0e30dd8e21900901c314ca9004384e47b330d372873f3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CF11DA90F0928741F96C7A315C122F99181DF45374E945734DABECD2DADD2CB4024E21
                                                                                                                                                                                                                            Function 00007FF72F9564B4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: verbose
                                                                                                                                                                                                                            • API String ID: 3215553584-579935070
                                                                                                                                                                                                                            • Opcode ID: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
                                                                                                                                                                                                                            • Instruction ID: 71fdf45a73d88d45f78ae5e02f7c49f534d9857060914c8416cc5a07097b63ae
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1B91A122B0978645E761AE25D8603BDB6A0EB40B54FC44136DADD873D9DE3DE845CF20
                                                                                                                                                                                                                            Function 00007FF72F9605A8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                            • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                            • Opcode ID: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
                                                                                                                                                                                                                            • Instruction ID: b1ee9da92c78f877814da1808a07ba4f1d8c429db8a501ab43f89157cc45e47f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 43818671F0828285FB64AF258E902F8B690EB11F84FD5403DDAC9D72BDDA2DE5019F61
                                                                                                                                                                                                                            Function 00007FF72F94EFD8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                            • String ID: MOC$RCC
                                                                                                                                                                                                                            • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                            • Opcode ID: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
                                                                                                                                                                                                                            • Instruction ID: d89ea45b62947343a61e1eae43369fb547aaf97e7a5542c1d257fe1314d57129
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BA614D32B08A8686E720AF65D8403EDB7A0F758B8CF544225EF8D57B99DB38E155CB10
                                                                                                                                                                                                                            Function 00007FF72F94F334 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                            • String ID: csm$csm
                                                                                                                                                                                                                            • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                            • Opcode ID: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
                                                                                                                                                                                                                            • Instruction ID: f3f205cb4fe1910c00b9b698b7791c21f90cff61b381f86e8b86498510d766be
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6C519F32A086C386EA74BF1599443B9B7A0EB64B88F944135DADDC7B99CF3CE4508F10
                                                                                                                                                                                                                            Function 00007FF72F942890 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                            • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                                                            • API String ID: 1878133881-2410924014
                                                                                                                                                                                                                            • Opcode ID: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
                                                                                                                                                                                                                            • Instruction ID: 1e8eccb4aecad731f5d3e692dbfe8e399f94bfb187ab8ce416d105185b6c8d1a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3A312D727286C291E620FB14E8516EAA3A4FF94784F804136E6CD87A9DDF3CD605CF60
                                                                                                                                                                                                                            Function 00007FF72F943EC0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(?,00007FF72F9439EA), ref: 00007FF72F943EF1
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9429E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF72F9487F2,?,?,?,?,?,?,?,?,?,?,?,00007FF72F94101D), ref: 00007FF72F942A14
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9429E0: MessageBoxW.USER32 ref: 00007FF72F942AF0
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFileLastMessageModuleName
                                                                                                                                                                                                                            • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                                            • API String ID: 2581892565-1977442011
                                                                                                                                                                                                                            • Opcode ID: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
                                                                                                                                                                                                                            • Instruction ID: 767341a3ae4c06c180b9798db3ac1bf264a88260518231ba87b3fba46a975ae6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8401BC20B2D6C280FE20BB21EC557F59260EF28384FC00036E8CDCA69EEE1CE1058F20
                                                                                                                                                                                                                            Function 00007FF72F95CB60 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2718003287-0
                                                                                                                                                                                                                            • Opcode ID: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
                                                                                                                                                                                                                            • Instruction ID: 498e8f7bcfef760b6456bdc778c9a3aaa76016da18d8af1a94f9a6d03bf72c7f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 66D12472B18A8189E710DF75D8402ECB7B1FB44B98B844235DE9DA7B9DDE38E406CB10
                                                                                                                                                                                                                            Function 00007FF72F942330 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1956198572-0
                                                                                                                                                                                                                            • Opcode ID: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
                                                                                                                                                                                                                            • Instruction ID: 24780e48dd99a45fa085c7465611e46b0edf6e1e20052bea7c187bc4192bb5d6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2911A921F181C242F654BB6AFD446F992A1FF94F80FC48174EA8946B9EDE2CD4C14A10
                                                                                                                                                                                                                            Function 00007FF72F94C460 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2933794660-0
                                                                                                                                                                                                                            • Opcode ID: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
                                                                                                                                                                                                                            • Instruction ID: 3892672d97b29d72cc250b718a2423252ecd8836d477f23486d7cadd5629996b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 62115122B14F4589EB00EF60EC442BD73A4F719758F440E35DAAD8A7A8DF78D1548790
                                                                                                                                                                                                                            Function 00007FF72F96628C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: ?
                                                                                                                                                                                                                            • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                            • Opcode ID: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
                                                                                                                                                                                                                            • Instruction ID: 767c203911f852b1aac409cd43683a66b8f6d2a8d509c2d6471a28ec06cb75e0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8641D622B182C242FB64AB25D8557B9D650EB80BA4F944239EFDC8AADDDE3CD441CF10
                                                                                                                                                                                                                            Function 00007FF72F9595A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _invalid_parameter_noinfo.LIBCMT ref: 00007FF72F9595D6
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F95AF0C: RtlFreeHeap.NTDLL(?,?,?,00007FF72F963392,?,?,?,00007FF72F9633CF,?,?,00000000,00007FF72F963895,?,?,00000000,00007FF72F9637C7), ref: 00007FF72F95AF22
                                                                                                                                                                                                                              • Part of subcall function 00007FF72F95AF0C: GetLastError.KERNEL32(?,?,?,00007FF72F963392,?,?,?,00007FF72F9633CF,?,?,00000000,00007FF72F963895,?,?,00000000,00007FF72F9637C7), ref: 00007FF72F95AF2C
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF72F94BFE5), ref: 00007FF72F9595F4
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\hotmailpulse.exe
                                                                                                                                                                                                                            • API String ID: 3580290477-2902798801
                                                                                                                                                                                                                            • Opcode ID: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
                                                                                                                                                                                                                            • Instruction ID: 71881684061666d57e6b17718f6c281790cf33f8da1aa298d5f76fad07c25737
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CD416F72B097928AFB54EF219C500FDA794EF84B84F944035E98E87B99DE3DD4458B20
                                                                                                                                                                                                                            Function 00007FF72F95D1F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                            • String ID: U
                                                                                                                                                                                                                            • API String ID: 442123175-4171548499
                                                                                                                                                                                                                            • Opcode ID: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
                                                                                                                                                                                                                            • Instruction ID: 5caf471f744ae745994678f05358d8c04591734e7496ac74a458ec487ac8d719
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B0418262B19A8185EB20AF69E8443E9A760FB94794F804036EE8EC7758EF3CD441CB50
                                                                                                                                                                                                                            Function 00007FF72F95F918 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentDirectory
                                                                                                                                                                                                                            • String ID: :
                                                                                                                                                                                                                            • API String ID: 1611563598-336475711
                                                                                                                                                                                                                            • Opcode ID: 4482f0b2aa88d097fa4b172b4d0b9d8fa621ceaf6a6e580bcf5a02da10cef38f
                                                                                                                                                                                                                            • Instruction ID: 690e3b58a214c5dcc9ecce71cabde7ee07db362e0cd7f2d89a8f4b6eee7d5af7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4482f0b2aa88d097fa4b172b4d0b9d8fa621ceaf6a6e580bcf5a02da10cef38f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3721D262B08AC181EB20AB15D8553ADA3B1FB84B48FD14035DBCD8768CDF7CE9458F61
                                                                                                                                                                                                                            Function 00007FF72F942C50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                            • String ID: Error detected
                                                                                                                                                                                                                            • API String ID: 1878133881-3513342764
                                                                                                                                                                                                                            • Opcode ID: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
                                                                                                                                                                                                                            • Instruction ID: 18655605f0f30269ededb37f4e898f7dac48a79358be407b9a064be68f0de27a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B72160727286C581E720FB14E8916EAA364FF94784FC05136E68D87A69DF3CD205CF20
                                                                                                                                                                                                                            Function 00007FF72F942B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                            • String ID: Fatal error detected
                                                                                                                                                                                                                            • API String ID: 1878133881-4025702859
                                                                                                                                                                                                                            • Opcode ID: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
                                                                                                                                                                                                                            • Instruction ID: 041fce5dabd7f5eb9f95598595162b8c25c197b3a37974efa007e058f19bc9b9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 832121727286C191E660FB14E8516EAA364FF94784FC05136E6CD87A69DF3CD205CF60
                                                                                                                                                                                                                            Function 00007FF72F94FE80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                            • String ID: csm
                                                                                                                                                                                                                            • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                            • Opcode ID: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
                                                                                                                                                                                                                            • Instruction ID: 83087ce916ee8fbe933102111c661d733fe0b5897f881a2c28711f183d62834e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DB112E32618B8182EB619F15F84029AB7E5FB98B88F984234DECC47759EF3CD5518B00
                                                                                                                                                                                                                            Function 00007FF72F96041C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000002.00000002.1877164024.00007FF72F941000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF72F940000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877125868.00007FF72F940000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877210110.00007FF72F96B000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F97E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877252578.00007FF72F980000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000002.00000002.1877330039.00007FF72F982000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_7ff72f940000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: :
                                                                                                                                                                                                                            • API String ID: 2595371189-336475711
                                                                                                                                                                                                                            • Opcode ID: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
                                                                                                                                                                                                                            • Instruction ID: 75d94a047ce2d6ff6e9ed04fbc4767fa5d456614a29f1aaade4790ef35188597
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 24012551B1828686F771BF6098A12BEA390EF94705FC40039D58DC6699EE2CE544CE24

                                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                                            Execution Coverage:3.5%
                                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                            Signature Coverage:6.4%
                                                                                                                                                                                                                            Total number of Nodes:860
                                                                                                                                                                                                                            Total number of Limit Nodes:101
                                                                                                                                                                                                                            execution_graph 58317 7ff81ff307f9 58320 7ff81ff338d0 58317->58320 58319 7ff81ff3080c 58321 7ff81ff33938 58320->58321 58327 7ff81ff3390f 58320->58327 58322 7ff81ff33950 SendMessageW 58321->58322 58323 7ff81ff33967 58321->58323 58322->58323 58324 7ff81ff33971 58323->58324 58326 7ff81ff33a32 memcpy 58323->58326 58325 7ff81ff3397a GetWindowTextW 58324->58325 58324->58327 58325->58327 58326->58327 58329 7ff81ff33a8f 58326->58329 58327->58319 58329->58327 58330 7ff81ff33ac5 SetWindowTextW 58329->58330 58330->58327 58331 7ff81ff77b7d 58337 7ff81ff77b90 58331->58337 58332 7ff81ff77bc7 strncmp 58332->58337 58333 7ff81ff77c0a strncmp 58333->58337 58334 7ff81ff77c4c strncmp 58334->58337 58335 7ff81ff77cfe 58355 7ff81ffe3870 strrchr 58335->58355 58336 7ff81ff77cc4 strncmp 58336->58337 58337->58332 58337->58333 58337->58334 58337->58335 58337->58336 58338 7ff81ff77c8b strncmp 58337->58338 58338->58337 58340 7ff81ff77d54 58341 7ff81ffaac60 3 API calls 58340->58341 58342 7ff81ff77dfa 58340->58342 58354 7ff81ff780c4 58340->58354 58341->58342 58343 7ff81ff77e45 58342->58343 58359 7ff81ffaac60 58342->58359 58345 7ff81ff77e8a 58343->58345 58346 7ff81ffaac60 3 API calls 58343->58346 58343->58354 58347 7ff81ff77ea8 58345->58347 58348 7ff81ffaac60 3 API calls 58345->58348 58346->58345 58350 7ff81ff77eec 58347->58350 58366 7ff81ffe1dd0 7 API calls 58347->58366 58348->58347 58351 7ff81ff77fc8 memset 58350->58351 58350->58354 58352 7ff81ff78014 58351->58352 58352->58354 58367 7ff81ff786a0 58352->58367 58356 7ff81ffe3908 58355->58356 58358 7ff81ffe38b1 58355->58358 58357 7ff81ffe3929 strncpy 58356->58357 58356->58358 58357->58358 58358->58340 58360 7ff81ffaac99 58359->58360 58361 7ff81ffaacb2 strchr 58360->58361 58371 7ff81ffabb10 58360->58371 58363 7ff81ffaacd4 58361->58363 58364 7ff81ffaae05 strncpy 58363->58364 58365 7ff81ffaae26 58363->58365 58364->58365 58365->58343 58366->58350 58369 7ff81ff786e5 58367->58369 58370 7ff81ff7882d 58369->58370 58375 7ff81ff9f900 58369->58375 58370->58354 58372 7ff81ffabb4b 58371->58372 58373 7ff81ffabe43 memcpy 58372->58373 58374 7ff81ffabe6c 58372->58374 58373->58374 58374->58361 58381 7ff81ff9f939 58375->58381 58376 7ff81ff9fa17 58379 7ff81ff9fbd8 58376->58379 58384 7ff81ff9fa36 58376->58384 58377 7ff81ff9fc20 58378 7ff81ff35150 9 API calls 58377->58378 58385 7ff81ff9fb74 58378->58385 58397 7ff81ff35150 58379->58397 58381->58376 58381->58377 58382 7ff81ff9fb2b 58387 7ff81ff28720 58382->58387 58384->58382 58393 7ff81ff9d1e0 58384->58393 58385->58370 58388 7ff81ff28748 58387->58388 58389 7ff81ff28785 DestroyMenu CreateMenu 58388->58389 58392 7ff81ff287c3 58388->58392 58390 7ff81ff287ad 58389->58390 58391 7ff81ff35150 9 API calls 58390->58391 58391->58392 58392->58385 58396 7ff81ff9d229 58393->58396 58395 7ff81ff9d448 58395->58382 58396->58395 58405 7ff81ffa1050 58396->58405 58398 7ff81ff351c0 58397->58398 58399 7ff81ff35175 58397->58399 58398->58385 58400 7ff81ff351a8 58399->58400 58401 7ff81ff3518d SetMenu 58399->58401 58400->58398 58402 7ff81ff351fa 58400->58402 58401->58400 58415 7ff81ff9fe20 58402->58415 58404 7ff81ff3521b SendMessageW 58404->58398 58406 7ff81ffa1097 58405->58406 58407 7ff81ffa1319 DeleteObject 58406->58407 58408 7ff81ffa11f7 58406->58408 58407->58408 58409 7ff81ffa1565 58408->58409 58410 7ff81ffa16b0 DeleteObject 58408->58410 58411 7ff81ffa1950 DeleteObject 58409->58411 58413 7ff81ffa182c 58409->58413 58410->58409 58411->58413 58412 7ff81ffa1ae0 58412->58396 58413->58412 58414 7ff81ffa1c13 DeleteObject 58413->58414 58414->58412 58416 7ff81ff9fe3f 58415->58416 58418 7ff81ff9fe97 GetModuleHandleW 58416->58418 58419 7ff81ff9fea6 RegisterClassW 58416->58419 58422 7ff81ff9ff17 58416->58422 58418->58419 58420 7ff81ff9feef RegisterClassW 58419->58420 58421 7ff81ff9fede 58419->58421 58420->58422 58421->58420 58423 7ff81ff9ff7a 58422->58423 58424 7ff81ff2b320 58422->58424 58423->58404 58425 7ff81ff2b343 58424->58425 58426 7ff81ff2b352 GetModuleHandleW 58425->58426 58427 7ff81ff2b361 CreateWindowExW 58425->58427 58426->58427 58428 7ff81ff2b3b4 58427->58428 58429 7ff81ff2b3e0 CreateWindowExW 58428->58429 58430 7ff81ff2b3d1 GetModuleHandleW 58428->58430 58431 7ff81ff2b431 58429->58431 58430->58429 58432 7ff81ff35eff 58433 7ff81ff35f09 58432->58433 58441 7ff81ff35dc1 58432->58441 58442 7ff81ff21ed0 58433->58442 58434 7ff81ff35de7 GetWindowLongPtrW 58434->58441 58436 7ff81ff36189 58439 7ff81ff361a0 SetFocus 58436->58439 58440 7ff81ff361d1 58436->58440 58437 7ff81ff35f1a 58438 7ff81ff36200 DefWindowProcW 58438->58437 58439->58437 58440->58437 58440->58438 58441->58434 58441->58436 58443 7ff81ff21f0d 58442->58443 58444 7ff81ff21f11 memset SystemParametersInfoW 58442->58444 58443->58444 58445 7ff81ff22083 SystemParametersInfoW 58444->58445 58446 7ff81ff21f47 CreateFontIndirectW 58444->58446 58447 7ff81ff220d0 6 API calls 58445->58447 58448 7ff81ff220a2 CreateFontIndirectW 58445->58448 58471 7ff81ff21e00 58446->58471 58452 7ff81ff21e00 22 API calls 58447->58452 58450 7ff81ff21e00 22 API calls 58448->58450 58453 7ff81ff220c4 DeleteObject 58450->58453 58451 7ff81ff21f6c DeleteObject CreateFontIndirectW 58454 7ff81ff21e00 22 API calls 58451->58454 58455 7ff81ff22180 DeleteObject 58452->58455 58453->58447 58456 7ff81ff21f9a DeleteObject CreateFontIndirectW 58454->58456 58461 7ff81ff221c5 58455->58461 58463 7ff81ff22193 58455->58463 58457 7ff81ff21e00 22 API calls 58456->58457 58459 7ff81ff21fc8 DeleteObject CreateFontIndirectW 58457->58459 58458 7ff81ff221a0 GetStockObject 58460 7ff81ff21e00 22 API calls 58458->58460 58462 7ff81ff21e00 22 API calls 58459->58462 58460->58463 58461->58437 58464 7ff81ff21ff6 DeleteObject CreateFontIndirectW 58462->58464 58463->58458 58463->58461 58465 7ff81ff21e00 22 API calls 58464->58465 58466 7ff81ff22024 DeleteObject CreateFontIndirectW 58465->58466 58467 7ff81ff21e00 22 API calls 58466->58467 58468 7ff81ff2204f DeleteObject CreateFontIndirectW 58467->58468 58469 7ff81ff21e00 22 API calls 58468->58469 58470 7ff81ff2207a DeleteObject 58469->58470 58470->58445 58472 7ff81ff21e45 58471->58472 58477 7ff81ff23990 58472->58477 58474 7ff81ff21e8c 58488 7ff81ff23c50 58474->58488 58476 7ff81ff21eab 58476->58451 58478 7ff81ff239d0 GetDC SelectObject GetTextMetricsW GetTextFaceW 58477->58478 58480 7ff81ff23a2c 58478->58480 58493 7ff81ff23e40 58480->58493 58482 7ff81ff23bed GetCharWidthA 58484 7ff81ff23bf3 SelectObject ReleaseDC 58482->58484 58483 7ff81ff23be5 GetCharWidthW 58483->58484 58487 7ff81ff23c2d 58484->58487 58485 7ff81ff23b76 58485->58482 58485->58483 58487->58474 58489 7ff81ff23de5 58488->58489 58492 7ff81ff23c74 58488->58492 58489->58476 58490 7ff81ff23c90 DeleteObject 58491 7ff81ff23cac DeleteObject 58490->58491 58490->58492 58491->58492 58492->58489 58492->58490 58494 7ff81ff23e8a SelectObject GetTextFaceW 58493->58494 58495 7ff81ff23ec4 58494->58495 58496 7ff81ff23f16 SelectObject 58495->58496 58497 7ff81ff23f2d 58496->58497 58498 7ff81ff23f51 memset 58497->58498 58500 7ff81ff23f9b 58497->58500 58501 7ff81ff25080 SelectObject 58498->58501 58500->58485 58502 7ff81ff250fa GetFontData 58501->58502 58503 7ff81ff250f2 58501->58503 58504 7ff81ff2540a GetTextCharset 58502->58504 58510 7ff81ff25136 58502->58510 58503->58502 58505 7ff81ff25449 SelectObject 58504->58505 58508 7ff81ff25408 58504->58508 58506 7ff81ff25478 58505->58506 58506->58500 58507 7ff81ff25173 GetFontData 58507->58510 58508->58505 58509 7ff81ff25240 GetFontData 58509->58510 58510->58505 58510->58507 58510->58508 58510->58509 58511 7ff81ff252df GetFontData GetFontData 58510->58511 58511->58510 58512 7ff81ffe5c03 58514 7ff81ffe5c13 58512->58514 58515 7ff81ffe5d72 58514->58515 58516 7ff81fff6370 58514->58516 58522 7ff81fff63a0 58516->58522 58517 7ff81fff6687 LoadIconW LoadIconW LoadCursorW RegisterClassExW 58519 7ff81fff67ce 58517->58519 58520 7ff81fff675c CreateWindowExW SetWindowLongPtrW ShowWindow UpdateWindow 58517->58520 58518 7ff81fff6675 GetModuleHandleW 58518->58517 58524 7ff81ffe7230 58519->58524 58520->58519 58522->58517 58522->58518 58523 7ff81fff6822 58523->58515 58525 7ff81ffe7254 58524->58525 58526 7ff81ffe7280 58525->58526 58527 7ff81ffe7379 CreateBitmap CreatePatternBrush 58525->58527 58526->58523 58528 7ff81ffe73c8 58527->58528 58528->58523 58529 7ff81f011e90 PyList_New 58530 7ff81f011eae 58529->58530 58531 7ff81f011eb7 58529->58531 58532 7ff81f011f3e 58531->58532 58533 7ff81f011edf 58531->58533 58534 7ff81f011fa1 58532->58534 58535 7ff81f011f46 __acrt_iob_func 58532->58535 58536 7ff81f011fcd malloc 58533->58536 58541 7ff81f011ef1 PyErr_SetFromWindowsErr 58533->58541 58534->58536 58537 7ff81f011fad PyErr_SetString 58534->58537 58560 7ff81f011d70 __stdio_common_vfprintf swprintf_s 58535->58560 58539 7ff81f011ff1 NtQuerySystemInformation 58536->58539 58540 7ff81f011fe6 PyErr_NoMemory 58536->58540 58537->58536 58552 7ff81f011ef9 58537->58552 58545 7ff81f01200d 58539->58545 58558 7ff81f012020 58539->58558 58540->58552 58541->58552 58542 7ff81f011f6d __acrt_iob_func 58561 7ff81f011d70 __stdio_common_vfprintf swprintf_s 58542->58561 58543 7ff81f011f09 58548 7ff81f011f0e free 58543->58548 58549 7ff81f011f17 58543->58549 58544 7ff81f011f00 _Py_Dealloc 58544->58543 58563 7ff81f011350 11 API calls 58545->58563 58548->58549 58550 7ff81f012146 free 58555 7ff81f012157 58550->58555 58551 7ff81f011f87 __acrt_iob_func 58562 7ff81f011d70 __stdio_common_vfprintf swprintf_s 58551->58562 58552->58543 58552->58544 58553 7ff81f012040 Py_BuildValue 58553->58552 58556 7ff81f012112 PyList_Append 58553->58556 58555->58552 58557 7ff81f012167 _Py_Dealloc 58555->58557 58556->58555 58556->58558 58557->58552 58558->58550 58558->58553 58559 7ff81f01212e _Py_Dealloc 58558->58559 58559->58558 58560->58542 58561->58551 58562->58534 58563->58552 58564 7ff81ff35c00 58565 7ff81ff35c1b 58564->58565 58567 7ff81ff35c11 58564->58567 58566 7ff81ff35c90 58565->58566 58569 7ff81ff35c48 SendMessageW 58565->58569 58568 7ff81ff372bb 58567->58568 58570 7ff81ff3734e 58567->58570 58571 7ff81ff374e0 58567->58571 58572 7ff81ff372f2 58567->58572 58568->58572 58573 7ff81ff3732d DefWindowProcW 58568->58573 58569->58566 58570->58568 58570->58572 58570->58573 58575 7ff81ff3736b ImmGetContext 58570->58575 58583 7ff81ff381a0 TranslateCharsetInfo 58571->58583 58573->58572 58575->58573 58576 7ff81ff37379 ImmGetCompositionStringW 58575->58576 58577 7ff81ff374ac ImmReleaseContext 58576->58577 58578 7ff81ff37397 ImmGetCompositionStringW 58576->58578 58577->58572 58580 7ff81ff373cb 58578->58580 58581 7ff81ff37444 GetTickCount 58580->58581 58582 7ff81ff3745e 58581->58582 58582->58577 58583->58572 58584 7ff81ff2ff05 58587 7ff81ff31e10 58584->58587 58586 7ff81ff2ff18 58588 7ff81ff31e5b 58587->58588 58589 7ff81ff32348 58587->58589 58590 7ff81ff31ef6 58588->58590 58591 7ff81ff31e80 strcmp 58588->58591 58592 7ff81ff31f1c 58590->58592 58593 7ff81ff31fb6 58590->58593 58595 7ff81ff31e96 58590->58595 58591->58590 58591->58595 58596 7ff81ff2d870 12 API calls 58592->58596 58618 7ff81ff2df00 58593->58618 58595->58586 58596->58595 58597 7ff81ff32142 58605 7ff81ff320fd 58597->58605 58623 7ff81ff2d870 58597->58623 58602 7ff81ff3202b SHGetFileInfoW 58603 7ff81ff32064 58602->58603 58603->58597 58604 7ff81ff3207d SHGetFileInfoW 58603->58604 58606 7ff81ff320c2 58604->58606 58605->58595 58607 7ff81ff32275 CreateIconIndirect 58605->58607 58609 7ff81ff320ca 58606->58609 58610 7ff81ff32102 memset 58606->58610 58607->58595 58608 7ff81ff322b4 58607->58608 58613 7ff81ff322cb DestroyIcon 58608->58613 58614 7ff81ff322d9 58608->58614 58611 7ff81ff320cf DestroyIcon 58609->58611 58612 7ff81ff320dd DestroyIcon 58609->58612 58610->58597 58611->58612 58612->58605 58613->58595 58615 7ff81ff2d870 12 API calls 58614->58615 58616 7ff81ff32333 58615->58616 58616->58595 58648 7ff81ff2dde0 DestroyIcon 58616->58648 58620 7ff81ff2df2b 58618->58620 58619 7ff81ff2e2e4 CreateIconFromResourceEx 58619->58620 58620->58619 58621 7ff81ff2e325 CreateIconFromResource 58620->58621 58622 7ff81ff2df3d 58620->58622 58621->58620 58622->58597 58622->58602 58622->58605 58624 7ff81ff2d895 58623->58624 58625 7ff81ff2daa3 58624->58625 58626 7ff81ff2d936 58624->58626 58642 7ff81ff2d8a9 58624->58642 58627 7ff81ff2dab2 58625->58627 58628 7ff81ff2d690 5 API calls 58625->58628 58629 7ff81ff2d94b 58626->58629 58630 7ff81ff2d98c 58626->58630 58633 7ff81ff2db37 SendMessageW 58627->58633 58627->58642 58644 7ff81ff2db50 SendMessageW 58627->58644 58628->58627 58649 7ff81ff2d690 58629->58649 58631 7ff81ff2d991 SetClassLongPtrW 58630->58631 58645 7ff81ff2d9a6 SetClassLongPtrW 58630->58645 58635 7ff81ff2da4f SetClassLongPtrW 58631->58635 58634 7ff81ff2dc09 SendMessageW 58633->58634 58636 7ff81ff2dc2a 58634->58636 58634->58642 58640 7ff81ff2da79 58635->58640 58660 7ff81ff2dde0 DestroyIcon 58636->58660 58640->58642 58659 7ff81ff2dde0 DestroyIcon 58640->58659 58642->58595 58647 7ff81ff2dde0 DestroyIcon 58642->58647 58643 7ff81ff2da15 58643->58635 58644->58634 58646 7ff81ff2dbc8 58644->58646 58645->58635 58645->58643 58646->58634 58647->58605 58648->58595 58651 7ff81ff2d6bb 58649->58651 58650 7ff81ff2d80d 58650->58642 58651->58650 58652 7ff81ff2d744 58651->58652 58653 7ff81ff2d735 GetModuleHandleW 58651->58653 58654 7ff81ff2d791 58652->58654 58655 7ff81ff2d77a LoadIconW 58652->58655 58656 7ff81ff2d76b GetModuleHandleW 58652->58656 58653->58652 58657 7ff81ff2d856 58654->58657 58658 7ff81ff2d7eb LoadCursorW RegisterClassW 58654->58658 58655->58658 58656->58655 58657->58642 58658->58650 58659->58642 58660->58642 58661 7ff81ffe4255 58662 7ff81ffe4260 58661->58662 58665 7ff81ffe4297 58662->58665 58667 7ff81ff2cda0 58662->58667 58664 7ff81ffe4312 58665->58664 58666 7ff81ffe4314 SetWindowPos 58665->58666 58666->58664 58668 7ff81ff2cdbe 58667->58668 58669 7ff81ff2cdf2 CreateWindowExW SetWindowPos 58668->58669 58670 7ff81ff2cde3 GetModuleHandleW 58668->58670 58670->58669 58671 7ff81ffe5f50 GetWindowLongPtrW 58674 7ff81ffe5f92 58671->58674 58676 7ff81ffe5fd6 58671->58676 58672 7ff81ffe610d DefWindowProcW 58673 7ff81ffe612d 58672->58673 58674->58672 58675 7ff81ffe6030 GetSysColor 58675->58676 58676->58674 58676->58675 58677 7ff820004a10 58678 7ff820004abc 58677->58678 58679 7ff820004a49 58677->58679 58679->58678 58681 7ff820004460 58679->58681 58682 7ff8200044b4 58681->58682 58683 7ff820004492 58681->58683 58682->58683 58685 7ff81fff5450 58682->58685 58683->58678 58686 7ff81fff54dc 58685->58686 58688 7ff81fff547d 58685->58688 58689 7ff81fff49f0 58686->58689 58688->58683 58691 7ff81fff4a24 58689->58691 58690 7ff81fff4a89 58690->58688 58691->58690 58695 7ff81ff829e0 58691->58695 58693 7ff81fff4b60 58693->58690 58694 7ff81ff829e0 15 API calls 58693->58694 58694->58693 58696 7ff81ff82a18 58695->58696 58697 7ff81ff82a5b 58696->58697 58699 7ff81ff93050 58696->58699 58697->58693 58701 7ff81ff9308d 58699->58701 58700 7ff81ff931e4 58700->58697 58701->58700 58709 7ff81ff65df0 58701->58709 58703 7ff81ff93402 58704 7ff81ff65df0 3 API calls 58703->58704 58707 7ff81ff93418 58704->58707 58705 7ff81ff9356b 58718 7ff81ff92e30 58705->58718 58707->58705 58708 7ff81ff93689 DeleteObject 58707->58708 58708->58705 58714 7ff81ff65e12 58709->58714 58710 7ff81ff65ea5 _strnicmp 58715 7ff81ff65ecf 58710->58715 58717 7ff81ff65f1d 58710->58717 58711 7ff81ff65ee1 _stricmp 58712 7ff81ff65fe3 58711->58712 58711->58715 58716 7ff81ff65feb GetSysColor 58712->58716 58712->58717 58713 7ff81ff65e8e 58713->58703 58714->58710 58714->58713 58715->58711 58715->58717 58716->58717 58717->58703 58719 7ff81ff92e5d 58718->58719 58721 7ff81ff92e67 58718->58721 58719->58721 58741 7ff81ff93ec0 strtol strtol strtol 58719->58741 58723 7ff81ff92fce 58721->58723 58726 7ff81ff93b90 GetRgnBox 58721->58726 58724 7ff81ff92fda GetRgnBox 58723->58724 58725 7ff81ff93005 58723->58725 58724->58725 58725->58700 58727 7ff81ff93bf5 58726->58727 58729 7ff81ff93cd6 58727->58729 58730 7ff81ff93cbf DeleteObject 58727->58730 58728 7ff81ff93e6a 58728->58723 58729->58728 58731 7ff81ff93dbc 58729->58731 58732 7ff81ff93d9a 58729->58732 58734 7ff81ff93d35 58729->58734 58735 7ff81ff93d9d memset 58729->58735 58730->58729 58731->58728 58733 7ff81ff93dd8 memcpy 58731->58733 58738 7ff81ff93dfe 58731->58738 58732->58735 58733->58728 58736 7ff81ff93d5d 58734->58736 58737 7ff81ff93d3e memset 58734->58737 58735->58731 58736->58731 58739 7ff81ff93d6f memset 58736->58739 58737->58736 58738->58728 58740 7ff81ff93e40 memcpy 58738->58740 58739->58731 58740->58728 58740->58740 58741->58721 58742 7ff81f0118c0 PyModule_Create2 58743 7ff81f0118fd getenv 58742->58743 58744 7ff81f011a21 58742->58744 58758 7ff81f0113d0 PyEval_SaveThread LoadLibraryA PyEval_RestoreThread 58743->58758 58849 7ff81f01a030 8 API calls 2 library calls 58744->58849 58747 7ff81f011a33 58748 7ff81f011926 58748->58744 58749 7ff81f011940 RtlGetVersion 58748->58749 58750 7ff81f011954 GetSystemInfo InitializeCriticalSection 58749->58750 58813 7ff81f017db0 GetCurrentProcess OpenProcessToken 58750->58813 58754 7ff81f0119dd PyModule_GetState PyErr_NewException 58755 7ff81f011a13 58754->58755 58756 7ff81f011a44 36 API calls 58754->58756 58755->58744 58757 7ff81f011a18 _Py_Dealloc 58755->58757 58756->58744 58757->58744 58759 7ff81f011401 PyErr_SetFromWindowsErrWithFilename 58758->58759 58760 7ff81f011412 GetProcAddress 58758->58760 58761 7ff81f01143f 58759->58761 58762 7ff81f011458 GetModuleHandleA 58760->58762 58763 7ff81f011427 PyErr_SetFromWindowsErrWithFilename FreeLibrary 58760->58763 58761->58748 58764 7ff81f01147a GetProcAddress 58762->58764 58765 7ff81f011471 PyErr_SetFromWindowsErrWithFilename 58762->58765 58763->58761 58764->58765 58767 7ff81f0114b7 GetModuleHandleA 58764->58767 58765->58748 58768 7ff81f0114d9 GetProcAddress 58767->58768 58769 7ff81f0114d0 PyErr_SetFromWindowsErrWithFilename 58767->58769 58768->58769 58771 7ff81f011516 PyEval_SaveThread LoadLibraryA PyEval_RestoreThread 58768->58771 58769->58748 58772 7ff81f01156a GetProcAddress 58771->58772 58773 7ff81f011544 PyErr_SetFromWindowsErrWithFilename 58771->58773 58774 7ff81f01157f PyErr_SetFromWindowsErrWithFilename FreeLibrary 58772->58774 58775 7ff81f0115b0 58772->58775 58773->58748 58774->58748 58850 7ff81f0112c0 PyEval_SaveThread LoadLibraryA PyEval_RestoreThread 58775->58850 58778 7ff81f0112c0 7 API calls 58779 7ff81f0115ed 58778->58779 58779->58761 58780 7ff81f0112c0 7 API calls 58779->58780 58781 7ff81f011610 58780->58781 58781->58761 58782 7ff81f0112c0 7 API calls 58781->58782 58783 7ff81f011633 58782->58783 58783->58761 58784 7ff81f0112c0 7 API calls 58783->58784 58785 7ff81f011656 58784->58785 58785->58761 58786 7ff81f0112c0 7 API calls 58785->58786 58787 7ff81f011679 58786->58787 58787->58761 58788 7ff81f0112c0 7 API calls 58787->58788 58789 7ff81f01169c 58788->58789 58789->58761 58790 7ff81f0112c0 7 API calls 58789->58790 58791 7ff81f0116bf 58790->58791 58791->58761 58792 7ff81f0116cf GetModuleHandleA 58791->58792 58793 7ff81f0116ea GetProcAddress 58792->58793 58795 7ff81f0116e1 PyErr_SetFromWindowsErrWithFilename 58792->58795 58793->58795 58796 7ff81f011727 58793->58796 58795->58748 58797 7ff81f0112c0 7 API calls 58796->58797 58798 7ff81f011741 58797->58798 58798->58761 58799 7ff81f011751 GetModuleHandleA 58798->58799 58800 7ff81f01176c GetProcAddress 58799->58800 58801 7ff81f011763 58799->58801 58803 7ff81f011781 58800->58803 58804 7ff81f011792 58800->58804 58802 7ff81f011788 PyErr_SetFromWindowsErrWithFilename 58801->58802 58802->58804 58803->58802 58805 7ff81f0112c0 7 API calls 58804->58805 58806 7ff81f0117ac 58805->58806 58807 7ff81f0112c0 7 API calls 58806->58807 58808 7ff81f0117c6 58807->58808 58809 7ff81f0112c0 7 API calls 58808->58809 58810 7ff81f0117e0 58809->58810 58811 7ff81f0112c0 7 API calls 58810->58811 58812 7ff81f0117fa PyErr_Clear 58811->58812 58812->58748 58814 7ff81f017e09 GetLastError 58813->58814 58815 7ff81f017e9d 58813->58815 58816 7ff81f017e66 GetLastError 58814->58816 58817 7ff81f017e16 ImpersonateSelf 58814->58817 58818 7ff81f017eb1 LookupPrivilegeValueA 58815->58818 58819 7ff81f017ea7 58815->58819 58867 7ff81f011010 __stdio_common_vsprintf swprintf_s 58816->58867 58820 7ff81f017e39 OpenProcessToken 58817->58820 58821 7ff81f017e23 58817->58821 58823 7ff81f017ed1 GetLastError 58818->58823 58824 7ff81f017f03 AdjustTokenPrivileges 58818->58824 58822 7ff81f017d10 7 API calls 58819->58822 58820->58815 58827 7ff81f017e50 58820->58827 58865 7ff81f011070 11 API calls 58821->58865 58846 7ff81f017e34 58822->58846 58868 7ff81f011010 __stdio_common_vsprintf swprintf_s 58823->58868 58829 7ff81f017f7a AdjustTokenPrivileges 58824->58829 58830 7ff81f017f47 GetLastError 58824->58830 58866 7ff81f011070 11 API calls 58827->58866 58836 7ff81f017fb4 58829->58836 58837 7ff81f017fc5 RevertToSelf CloseHandle 58829->58837 58869 7ff81f011010 __stdio_common_vsprintf swprintf_s 58830->58869 58831 7ff81f017e86 PyErr_SetFromWindowsErrWithFilename 58838 7ff81f017d10 7 API calls 58831->58838 58832 7ff81f017e2f 58839 7ff81f017d10 7 API calls 58832->58839 58834 7ff81f017ef1 PyErr_SetFromWindowsErrWithFilename 58842 7ff81f017fc0 58834->58842 58870 7ff81f011070 11 API calls 58836->58870 58837->58846 58838->58846 58839->58846 58841 7ff81f017e5c 58848 7ff81f017d10 7 API calls 58841->58848 58855 7ff81f017d10 58842->58855 58843 7ff81f017f69 PyErr_SetFromWindowsErrWithFilename 58843->58842 58871 7ff81f01a030 8 API calls 2 library calls 58846->58871 58847 7ff81f0119d9 58847->58744 58847->58754 58848->58846 58849->58747 58851 7ff81f01130a GetProcAddress 58850->58851 58852 7ff81f0112fd PyErr_SetFromWindowsErrWithFilename 58850->58852 58853 7ff81f01132f 58851->58853 58854 7ff81f01131b PyErr_SetFromWindowsErrWithFilename FreeLibrary 58851->58854 58852->58853 58853->58761 58853->58778 58854->58853 58856 7ff81f017d78 GetLastError 58855->58856 58857 7ff81f017d1d __acrt_iob_func 58855->58857 58859 7ff81f017da0 PyErr_Clear 58856->58859 58860 7ff81f017d83 PyErr_WarnEx 58856->58860 58872 7ff81f011d70 __stdio_common_vfprintf swprintf_s 58857->58872 58860->58859 58861 7ff81f017d44 __acrt_iob_func 58873 7ff81f011d70 __stdio_common_vfprintf swprintf_s 58861->58873 58863 7ff81f017d5e __acrt_iob_func 58874 7ff81f011d70 __stdio_common_vfprintf swprintf_s 58863->58874 58865->58832 58866->58841 58867->58831 58868->58834 58869->58843 58870->58842 58871->58847 58872->58861 58873->58863 58874->58856 58875 7ff81f011dc0 GetSystemTimes 58876 7ff81f011dec Py_BuildValue 58875->58876 58877 7ff81f011ddd PyErr_SetFromWindowsErr 58875->58877 58878 7ff81ff21310 58879 7ff81ff21330 SendMessageW SendMessageW SendMessageW 58878->58879 58883 7ff81ff213b6 58878->58883 58880 7ff81ff213a9 58879->58880 58880->58883 58881 7ff81ff21458 58882 7ff81ff2ea7c GetFocus 58884 7ff81ff2eaa5 GetForegroundWindow 58882->58884 58885 7ff81ff2eab0 IsWindow 58882->58885 58883->58881 58883->58882 58884->58885 58887 7ff81ff2ee4f SetWindowLongPtrW 58885->58887 58888 7ff81ff2eaff 58885->58888 58889 7ff81ff2ee8c SetParent 58887->58889 58890 7ff81ff2ee77 SetWindowLongPtrW 58887->58890 58888->58887 58891 7ff81ff2ef7c 58889->58891 58892 7ff81ff2eea2 SendMessageW SendMessageW 58889->58892 58890->58889 58893 7ff81ff2ef8f SendMessageW 58891->58893 58894 7ff81ff2f001 58891->58894 58892->58891 58895 7ff81ff2eee0 GetDesktopWindow 58892->58895 58893->58894 58896 7ff81ff2efa9 SendMessageW 58893->58896 58898 7ff81ff2f03a 58894->58898 58899 7ff81ff2f017 SetWindowPos 58894->58899 58895->58891 58897 7ff81ff2eeef SetWindowLongPtrW 58895->58897 58903 7ff81ff2efdf 58896->58903 58900 7ff81ff2ef68 SetMenu DestroyWindow 58897->58900 58901 7ff81ff2ef09 58897->58901 58921 7ff81ff2f330 58898->58921 58899->58898 58900->58891 58901->58900 58914 7ff81ff2ef3f SetParent 58901->58914 58905 7ff81ff9fe20 7 API calls 58903->58905 58904 7ff81ff2f044 58906 7ff81ff2f059 SendMessageW 58904->58906 58907 7ff81ff2f06e 58904->58907 58910 7ff81ff2efe7 SendMessageW 58905->58910 58906->58907 58908 7ff81ff2f07b SendMessageW 58907->58908 58909 7ff81ff2f091 58907->58909 58908->58909 58911 7ff81ff2f109 58909->58911 58912 7ff81ff2f09d SendMessageW 58909->58912 58910->58894 58913 7ff81ff2f115 SetMenu 58911->58913 58919 7ff81ff2f12d 58911->58919 58915 7ff81ff2f0bd 58912->58915 58913->58919 58914->58901 58915->58911 58916 7ff81ff2f182 SetActiveWindow 58918 7ff81ff2f1de 58916->58918 58919->58916 58920 7ff81ff2f330 ShowWindow 58919->58920 58920->58919 58922 7ff81ff2f347 58921->58922 58925 7ff81ff2f355 58921->58925 58922->58904 58923 7ff81ff2f384 ShowWindow 58924 7ff81ff2f395 58923->58924 58924->58904 58925->58923 58925->58924 58926 7ff81ff27c90 58927 7ff81ff27cc9 58926->58927 58928 7ff81ff27d3f 58927->58928 58929 7ff81ff27d2e GetCapture 58927->58929 58930 7ff81ff27d43 DefWindowProcW 58927->58930 58931 7ff81ff27d62 58927->58931 58928->58930 58928->58931 58929->58928 58929->58931 58932 7ff81ff79ad0 58934 7ff81ff79ae6 58932->58934 58935 7ff81ff79b24 58934->58935 58936 7ff81ffe4170 58934->58936 58937 7ff81ffe4197 58936->58937 58939 7ff81ffe41bb 58936->58939 58937->58939 58940 7ff81ff2f200 58937->58940 58939->58935 58941 7ff81ff2f22d 58940->58941 58942 7ff81ff2d690 5 API calls 58941->58942 58946 7ff81ff2f23a 58941->58946 58942->58946 58943 7ff81ff2f243 58943->58939 58944 7ff81ff2f2a3 ShowWindow 58944->58943 58946->58943 58946->58944 58947 7ff81ff781d0 58948 7ff81ff781f4 58947->58948 58954 7ff81ff78220 58947->58954 58949 7ff81ff784ae 58950 7ff81ff786a0 15 API calls 58949->58950 58952 7ff81ff78268 58950->58952 58951 7ff81ff783c5 strncmp 58951->58952 58951->58954 58953 7ff81ff783f0 strncmp 58953->58952 58953->58954 58954->58949 58954->58951 58954->58952 58954->58953 58955 7ff81ff78492 strncmp 58954->58955 58956 7ff81ff78445 strncmp 58954->58956 58955->58952 58955->58954 58956->58954 58957 7ff81ffa98e2 58958 7ff81ffa98eb 58957->58958 58961 7ff81ffa98e7 58957->58961 58963 7ff81ff73370 58958->58963 58960 7ff81ffa99ac 58961->58960 58962 7ff81ff23c50 2 API calls 58961->58962 58962->58960 58964 7ff81ff7339a 58963->58964 58967 7ff81ff733e0 58964->58967 58969 7ff81ff73417 58967->58969 58968 7ff81ff733ad 58968->58961 58969->58968 58970 7ff81ff73531 58969->58970 58974 7ff81ff73632 GetStockObject 58969->58974 58970->58968 58972 7ff81ff736ee 58970->58972 58989 7ff81ff221f0 25 API calls 58970->58989 58972->58968 58976 7ff81ff225c0 58972->58976 58975 7ff81ff23990 20 API calls 58974->58975 58975->58970 58977 7ff81ff22620 GetDC SelectObject 58976->58977 58979 7ff81ff22616 58976->58979 58978 7ff81ff22746 GetTextExtentPoint32W 58977->58978 58984 7ff81ff22673 58977->58984 58986 7ff81ff227a0 58978->58986 58979->58968 58982 7ff81ff227c3 SelectObject ReleaseDC 58982->58979 58987 7ff81ff227f6 58982->58987 58983 7ff81ff226ca GetTextExtentPoint32W 58983->58984 58984->58978 58984->58983 58985 7ff81ff22715 SelectObject 58984->58985 58984->58986 58990 7ff81ff24200 58984->58990 58985->58984 58986->58982 58987->58979 58988 7ff81ff225c0 18 API calls 58987->58988 58988->58979 58989->58972 58991 7ff81ff2469d 58990->58991 58992 7ff81ff24239 58990->58992 58993 7ff81ff242b9 GetDC 58992->58993 58994 7ff81ff2436c 58992->58994 59003 7ff81ff242d2 58993->59003 58994->58984 58995 7ff81ff2458a EnumFontFamiliesW 58999 7ff81ff245ea 58995->58999 58996 7ff81ff24310 _stricmp 58996->59003 58997 7ff81ff2464b ReleaseDC 58997->58999 58998 7ff81ff24334 _stricmp 58998->59003 58999->58997 59000 7ff81ff24bb0 13 API calls 59000->59003 59001 7ff81ff244b0 59001->58995 59001->58999 59002 7ff81ff24bb0 13 API calls 59001->59002 59002->59001 59003->58996 59003->58998 59003->58999 59003->59000 59003->59001 59004 7ff81ff27be0 59005 7ff81ff27c14 59004->59005 59006 7ff81ff27c18 DefWindowProcW 59005->59006 59007 7ff81ff27c36 59005->59007 59008 7ff81ff548a0 59009 7ff81ff548c9 59008->59009 59011 7ff81ff54a29 59009->59011 59014 7ff81ff54ea0 59009->59014 59010 7ff81ff54bd4 59011->59010 59013 7ff81ff23c50 2 API calls 59011->59013 59013->59010 59023 7ff81ffa9210 59014->59023 59016 7ff81ff54f02 59016->59011 59017 7ff81ff551bc 59018 7ff81ff553e5 fmod 59017->59018 59019 7ff81ff5540c sin cos 59018->59019 59019->59016 59021 7ff81ff54efe 59021->59016 59021->59017 59022 7ff81ff5530a DeleteObject 59021->59022 59022->59017 59024 7ff81ffa9230 59023->59024 59025 7ff81ffa9284 59023->59025 59024->59021 59026 7ff81ffaac60 3 API calls 59025->59026 59027 7ff81ffa93b7 59025->59027 59026->59025 59027->59021 59028 7ff81ff5a860 59029 7ff81ff5a883 59028->59029 59030 7ff81ff5a88e 59029->59030 59031 7ff81ffe3870 2 API calls 59029->59031 59032 7ff81ff5a8e3 59031->59032 59032->59030 59035 7ff81ff5de90 DeleteObject strchr strncpy memcpy 59032->59035 59034 7ff81ff5aba3 59035->59034 59036 7ff81ff9b430 59037 7ff81ff9b467 59036->59037 59038 7ff81ff9b470 59037->59038 59039 7ff81ff9fe20 7 API calls 59037->59039 59040 7ff81ff9b4ba 59039->59040 59041 7ff81ffe3870 2 API calls 59040->59041 59042 7ff81ff9b557 59041->59042 59043 7ff81ff9b572 memset 59042->59043 59046 7ff81ff9b72b 59042->59046 59044 7ff81ff9b5be 59043->59044 59045 7ff81ff9b7b4 CreatePopupMenu 59044->59045 59044->59046 59045->59046 59047 7ff81ff9b826 59045->59047 59048 7ff81ff9d1e0 4 API calls 59047->59048 59050 7ff81ff9b859 59048->59050 59049 7ff81ff9f900 15 API calls 59049->59050 59050->59046 59050->59049 59051 7ff81ffe3130 59053 7ff81ffe315f 59051->59053 59052 7ff81ffe31dd 59053->59052 59056 7ff81ff3b040 59053->59056 59055 7ff81ffe32b4 59057 7ff81ff3b068 59056->59057 59058 7ff81ff3b4bf memset 59057->59058 59059 7ff81ff3b4e5 59058->59059 59060 7ff81ff35f2c 59061 7ff81ff35dc1 59060->59061 59062 7ff81ff35de7 GetWindowLongPtrW 59061->59062 59063 7ff81ff35f4e 59061->59063 59064 7ff81ff36189 59061->59064 59062->59061 59066 7ff81ff361a0 SetFocus 59064->59066 59067 7ff81ff361d1 59064->59067 59065 7ff81ff36200 DefWindowProcW 59065->59063 59066->59063 59067->59063 59067->59065 59068 7ff81ff246b0 59069 7ff81ff246fd 59068->59069 59071 7ff81ff24751 59069->59071 59072 7ff81ff24bb0 59069->59072 59073 7ff81ff24bd8 59072->59073 59074 7ff81ff23e40 12 API calls 59073->59074 59077 7ff81ff24d01 59073->59077 59075 7ff81ff24c3f 59074->59075 59076 7ff81ff24cd0 memcpy 59075->59076 59075->59077 59076->59077 59077->59071 59078 7ff81ff43270 59081 7ff81ff432b0 59078->59081 59080 7ff81ff43281 59082 7ff81ff432dd 59081->59082 59083 7ff81ff432e5 GetSystemMetrics 59082->59083 59085 7ff81ff432f4 59082->59085 59083->59085 59084 7ff81ff43316 59084->59080 59085->59084 59086 7ff81ffe3870 2 API calls 59085->59086 59087 7ff81ff43378 59086->59087 59089 7ff81ff435fd 59087->59089 59090 7ff81ff43d00 59087->59090 59089->59080 59095 7ff81ff43d58 59090->59095 59091 7ff81ff44504 59091->59089 59092 7ff81ff829e0 15 API calls 59092->59095 59093 7ff81ff44470 59096 7ff81ff44570 59093->59096 59095->59091 59095->59092 59095->59093 59100 7ff81ff445e0 59096->59100 59097 7ff81ff44830 59102 7ff81ff17ce0 59097->59102 59099 7ff81ff449cf 59099->59091 59100->59097 59101 7ff81ff44984 DeleteObject 59100->59101 59101->59097 59103 7ff81ff17d1c 59102->59103 59104 7ff81ff17d71 GetModuleHandleW 59103->59104 59105 7ff81ff17d83 FindResourceW 59103->59105 59108 7ff81ff17e82 59103->59108 59104->59105 59107 7ff81ff17dcd LoadResource LockResource 59105->59107 59111 7ff81ff17dba 59105->59111 59107->59111 59115 7ff81ff74210 59108->59115 59110 7ff81ff17f91 59112 7ff81ff225c0 25 API calls 59110->59112 59111->59108 59113 7ff81ff17e33 memcpy 59111->59113 59114 7ff81ff17fe5 59112->59114 59113->59108 59114->59099 59119 7ff81ff74276 59115->59119 59116 7ff81ff225c0 25 API calls 59116->59119 59117 7ff81ff746f3 isspace 59120 7ff81ff746ee 59117->59120 59121 7ff81ff74723 59117->59121 59118 7ff81ff7459d 59118->59110 59119->59116 59119->59118 59119->59120 59120->59117 59120->59121 59121->59118 59122 7ff81ff225c0 25 API calls 59121->59122 59122->59118 59123 7ff81ff82071 59124 7ff81ff820c7 59123->59124 59125 7ff81ff82081 59123->59125 59124->59125 59127 7ff81ff8cde0 59124->59127 59128 7ff81ff8ce21 CreateRectRgnIndirect 59127->59128 59134 7ff81ff8f910 59128->59134 59131 7ff81ff8cec3 59132 7ff81ff8cf52 59131->59132 59133 7ff81ff8cf4c DeleteObject 59131->59133 59132->59125 59133->59132 59138 7ff81ff8f951 59134->59138 59135 7ff81ff8fa1b 59136 7ff81ffa9210 3 API calls 59135->59136 59141 7ff81ff8fb3c 59136->59141 59137 7ff81ff8f99d strncmp 59137->59138 59138->59135 59138->59137 59139 7ff81ff8f9da strncmp 59138->59139 59144 7ff81ff8fa44 59138->59144 59139->59138 59141->59144 59158 7ff81ff902b0 59141->59158 59142 7ff81ff8fc6a 59142->59144 59154 7ff81ff8fe74 59142->59154 59177 7ff81ff90680 59142->59177 59144->59131 59146 7ff81ff8ffb2 59146->59144 59147 7ff81ff92e30 11 API calls 59146->59147 59147->59146 59148 7ff81ff902b0 20 API calls 59150 7ff81ff8ff36 59148->59150 59150->59144 59215 7ff81ff8a940 memset 59150->59215 59152 7ff81ff902b0 20 API calls 59153 7ff81ff8fdf5 59152->59153 59153->59144 59185 7ff81ff8a5d0 memset memset 59153->59185 59189 7ff81ff84fe0 memset memset 59153->59189 59154->59144 59154->59146 59208 7ff81ff90a90 59154->59208 59160 7ff81ff902f9 59158->59160 59161 7ff81ff90651 59158->59161 59159 7ff81ff9034e GetRgnBox 59162 7ff81ff903b0 7 API calls 59159->59162 59163 7ff81ff903a2 59159->59163 59160->59159 59160->59161 59161->59142 59166 7ff81ff90452 59162->59166 59163->59162 59163->59166 59164 7ff81ff904e4 59167 7ff81ff904ec memset 59164->59167 59165 7ff81ff90478 59168 7ff81ff90480 memset 59165->59168 59169 7ff81ff90497 59165->59169 59166->59164 59166->59165 59166->59167 59176 7ff81ff905b4 59166->59176 59170 7ff81ff904d5 59167->59170 59168->59169 59169->59170 59172 7ff81ff904ad memset 59169->59172 59173 7ff81ff9052a memcpy 59170->59173 59174 7ff81ff9054c 59170->59174 59170->59176 59171 7ff81ff93b90 7 API calls 59171->59176 59172->59170 59173->59176 59175 7ff81ff90590 memcpy 59174->59175 59174->59176 59175->59175 59175->59176 59176->59161 59176->59171 59178 7ff81ff906c4 59177->59178 59179 7ff81ff9071f _strnicmp 59178->59179 59180 7ff81ff90813 59178->59180 59182 7ff81ff8fdd9 59178->59182 59221 7ff81ff84f90 memset 59178->59221 59224 7ff81ff8a420 memset memset 59178->59224 59179->59178 59181 7ff81ff9084d _strnicmp 59180->59181 59180->59182 59181->59180 59182->59144 59182->59152 59186 7ff81ff8a671 59185->59186 59188 7ff81ff8a675 59186->59188 59270 7ff81ff89b70 59186->59270 59188->59154 59195 7ff81ff85073 59189->59195 59190 7ff81ff86b70 memcpy 59191 7ff81ff85180 59190->59191 59192 7ff81ff85189 strncmp 59191->59192 59202 7ff81ff8528a 59191->59202 59193 7ff81ff851c6 59192->59193 59194 7ff81ff851a4 strncmp 59192->59194 59196 7ff81ff86b70 memcpy 59193->59196 59194->59193 59194->59202 59195->59190 59195->59202 59197 7ff81ff851e4 59196->59197 59198 7ff81ff86b70 memcpy 59197->59198 59197->59202 59199 7ff81ff85249 59198->59199 59200 7ff81ff86b70 memcpy 59199->59200 59199->59202 59204 7ff81ff853d3 59200->59204 59201 7ff81ff86b70 memcpy 59201->59204 59202->59154 59204->59201 59204->59202 59205 7ff81ff85641 59204->59205 59206 7ff81ff854ff memset 59204->59206 59295 7ff81ff85e30 memcpy 59204->59295 59205->59202 59207 7ff81ff857ac memset 59205->59207 59206->59204 59207->59202 59209 7ff81ff90ad7 59208->59209 59210 7ff81ff90b82 59209->59210 59211 7ff81ff90b2a _strnicmp 59209->59211 59213 7ff81ff8ff1a 59209->59213 59296 7ff81ff8a7e0 memset 59209->59296 59212 7ff81ff90bbd _strnicmp 59210->59212 59210->59213 59211->59209 59212->59210 59213->59144 59213->59148 59216 7ff81ff8a9b0 memset 59215->59216 59217 7ff81ff8a98f 59215->59217 59218 7ff81ff8a9fa 59216->59218 59217->59216 59219 7ff81ff89b70 4 API calls 59218->59219 59220 7ff81ff8aa02 59218->59220 59219->59220 59220->59146 59228 7ff81ff85c10 59221->59228 59223 7ff81ff84fcd 59223->59178 59225 7ff81ff8a4c9 59224->59225 59240 7ff81ff88680 59225->59240 59227 7ff81ff8a4d6 59227->59178 59236 7ff81ff86b70 59228->59236 59230 7ff81ff85c51 59231 7ff81ff85c5a strncmp 59230->59231 59234 7ff81ff85cab 59230->59234 59232 7ff81ff85c8f 59231->59232 59233 7ff81ff85c73 strncmp 59231->59233 59235 7ff81ff86b70 memcpy 59232->59235 59233->59232 59233->59234 59234->59223 59235->59234 59237 7ff81ff86bc2 59236->59237 59238 7ff81ff86b96 59236->59238 59237->59238 59239 7ff81ff86be6 memcpy 59237->59239 59238->59230 59239->59238 59265 7ff81ff87b00 59240->59265 59243 7ff81ff886c7 memcmp 59244 7ff81ff886e3 59243->59244 59245 7ff81ff88770 59243->59245 59246 7ff81ff87b00 memcpy 59244->59246 59251 7ff81ff8873f 59244->59251 59248 7ff81ff87b00 memcpy 59245->59248 59245->59251 59247 7ff81ff8871e 59246->59247 59249 7ff81ff88727 memcmp 59247->59249 59247->59251 59250 7ff81ff88824 59248->59250 59249->59245 59249->59251 59250->59251 59252 7ff81ff87b00 memcpy 59250->59252 59251->59227 59253 7ff81ff8886a 59252->59253 59253->59251 59254 7ff81ff87b00 memcpy 59253->59254 59255 7ff81ff888de 59254->59255 59255->59251 59256 7ff81ff87b00 memcpy 59255->59256 59257 7ff81ff88905 59256->59257 59257->59251 59258 7ff81ff87b00 memcpy 59257->59258 59259 7ff81ff88940 59258->59259 59259->59251 59260 7ff81ff87b00 memcpy 59259->59260 59261 7ff81ff8899d 59260->59261 59261->59251 59262 7ff81ff87b00 memcpy 59261->59262 59263 7ff81ff889fa 59262->59263 59263->59251 59269 7ff81ff87ef0 memcpy 59263->59269 59266 7ff81ff87cb7 59265->59266 59268 7ff81ff87b2d 59265->59268 59267 7ff81ff87d50 memcpy 59266->59267 59266->59268 59267->59266 59268->59243 59268->59251 59269->59251 59271 7ff81ff88680 3 API calls 59270->59271 59272 7ff81ff89bb7 59271->59272 59273 7ff81ff89e96 59272->59273 59274 7ff81ff89d0c 59272->59274 59275 7ff81ff89c30 _stricmp 59272->59275 59273->59188 59274->59273 59276 7ff81ff87b00 memcpy 59274->59276 59279 7ff81ff89dc1 59274->59279 59275->59272 59277 7ff81ff89da8 59276->59277 59277->59273 59291 7ff81ff87ef0 memcpy 59277->59291 59279->59273 59284 7ff81ff8a242 59279->59284 59285 7ff81ff898e0 59279->59285 59281 7ff81ff8a2f0 59293 7ff81ff87ef0 memcpy 59281->59293 59284->59273 59284->59281 59292 7ff81ff87fd0 memcpy 59284->59292 59288 7ff81ff89909 59285->59288 59290 7ff81ff89aab 59285->59290 59287 7ff81ff87b00 memcpy 59287->59288 59288->59287 59289 7ff81ff89abe 59288->59289 59288->59290 59289->59279 59294 7ff81ff87ef0 memcpy 59290->59294 59291->59279 59292->59284 59293->59273 59294->59289 59295->59204 59297 7ff81ff8a838 59296->59297 59298 7ff81ff8a859 memset 59296->59298 59297->59298 59299 7ff81ff8a89f 59298->59299 59300 7ff81ff88680 3 API calls 59299->59300 59301 7ff81ff8a8eb 59300->59301 59301->59209

                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                            Function 00007FF81FF21310 Relevance: 47.6, APIs: 25, Strings: 2, Instructions: 332windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 267 7ff81ff21310-7ff81ff2132a 268 7ff81ff21330-7ff81ff213a7 SendMessageW * 3 267->268 269 7ff81ff213b6-7ff81ff213be 267->269 270 7ff81ff213a9 268->270 271 7ff81ff213ac-7ff81ff213b1 268->271 272 7ff81ff213c0-7ff81ff213ce 269->272 273 7ff81ff21402-7ff81ff21409 269->273 270->271 271->269 272->273 274 7ff81ff213d0-7ff81ff213df 272->274 275 7ff81ff21458-7ff81ff2145d 273->275 276 7ff81ff2140b-7ff81ff21419 273->276 277 7ff81ff213eb-7ff81ff213f2 274->277 278 7ff81ff213e1 274->278 276->275 279 7ff81ff2141b-7ff81ff2142a 276->279 277->273 280 7ff81ff213f4-7ff81ff213f8 277->280 278->277 281 7ff81ff2142c 279->281 282 7ff81ff21436-7ff81ff2143d 279->282 280->273 284 7ff81ff213fa-7ff81ff213fd call 7ff81ff2ea00 280->284 281->282 282->275 283 7ff81ff2143f-7ff81ff21449 282->283 283->275 285 7ff81ff2144b-7ff81ff2ea72 283->285 284->273 289 7ff81ff2ea7c-7ff81ff2eaa3 GetFocus 285->289 290 7ff81ff2ea74-7ff81ff2ea77 call 7ff81ffe4230 285->290 292 7ff81ff2eab0 289->292 293 7ff81ff2eaa5-7ff81ff2eaae GetForegroundWindow 289->293 290->289 294 7ff81ff2eab8-7ff81ff2eada 292->294 293->292 293->294 296 7ff81ff2eadc-7ff81ff2eae3 294->296 297 7ff81ff2eaed-7ff81ff2eaf9 IsWindow 294->297 296->297 298 7ff81ff2ee4f-7ff81ff2ee75 SetWindowLongPtrW 297->298 299 7ff81ff2eaff-7ff81ff2eb10 297->299 300 7ff81ff2ee8c-7ff81ff2ee9c SetParent 298->300 301 7ff81ff2ee77-7ff81ff2ee86 SetWindowLongPtrW 298->301 299->298 303 7ff81ff2ef7c-7ff81ff2ef8d 300->303 304 7ff81ff2eea2-7ff81ff2eeda SendMessageW * 2 300->304 301->300 305 7ff81ff2ef8f-7ff81ff2efa7 SendMessageW 303->305 306 7ff81ff2f001-7ff81ff2f015 303->306 304->303 307 7ff81ff2eee0-7ff81ff2eee9 GetDesktopWindow 304->307 305->306 308 7ff81ff2efa9-7ff81ff2effb SendMessageW call 7ff81ff9fe20 SendMessageW 305->308 310 7ff81ff2f03a-7ff81ff2f057 call 7ff81ff2f330 306->310 311 7ff81ff2f017-7ff81ff2f034 SetWindowPos 306->311 307->303 309 7ff81ff2eeef-7ff81ff2ef07 SetWindowLongPtrW 307->309 308->306 312 7ff81ff2ef68-7ff81ff2ef76 SetMenu DestroyWindow 309->312 313 7ff81ff2ef09-7ff81ff2ef2b 309->313 319 7ff81ff2f059-7ff81ff2f068 SendMessageW 310->319 320 7ff81ff2f06e-7ff81ff2f079 310->320 311->310 312->303 313->312 324 7ff81ff2ef2d 313->324 319->320 321 7ff81ff2f07b-7ff81ff2f08b SendMessageW 320->321 322 7ff81ff2f091-7ff81ff2f09b 320->322 321->322 325 7ff81ff2f109-7ff81ff2f113 322->325 326 7ff81ff2f09d-7ff81ff2f0bb SendMessageW 322->326 327 7ff81ff2ef30-7ff81ff2ef34 324->327 330 7ff81ff2f12d-7ff81ff2f130 325->330 331 7ff81ff2f115-7ff81ff2f126 SetMenu 325->331 328 7ff81ff2f0fd-7ff81ff2f104 call 7ff81ff2cf40 326->328 329 7ff81ff2f0bd-7ff81ff2f0f6 326->329 332 7ff81ff2ef5c-7ff81ff2ef66 327->332 333 7ff81ff2ef36-7ff81ff2ef3d 327->333 328->325 329->328 337 7ff81ff2f18f-7ff81ff2f1c6 SetActiveWindow 330->337 338 7ff81ff2f132-7ff81ff2f138 330->338 331->330 332->312 332->327 333->332 334 7ff81ff2ef3f-7ff81ff2ef56 SetParent 333->334 334->332 343 7ff81ff2f1de-7ff81ff2f1f7 call 7ff82000d4a0 337->343 341 7ff81ff2f13a-7ff81ff2f148 338->341 342 7ff81ff2f182-7ff81ff2f189 338->342 341->342 344 7ff81ff2f14a-7ff81ff2f14d 341->344 342->337 346 7ff81ff2f150-7ff81ff2f154 344->346 347 7ff81ff2f176-7ff81ff2f180 346->347 348 7ff81ff2f156-7ff81ff2f15d 346->348 347->342 347->346 348->347 350 7ff81ff2f15f-7ff81ff2f172 call 7ff81ff2ea00 call 7ff81ff2f330 348->350 350->347
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSendWindow$FocusForegroundLong
                                                                                                                                                                                                                            • String ID: UpdateWrapper: Cannot find container window$UpdateWrapper: Container was destroyed
                                                                                                                                                                                                                            • API String ID: 2937761121-1156326135
                                                                                                                                                                                                                            • Opcode ID: 88f4d441e69f7a53ba1eb82c0d5a6a8a51ee67cef67a55e21da31e195bfbaba5
                                                                                                                                                                                                                            • Instruction ID: c169c74e846cf542faf0f89e759c4c1925b098b5d8d1d8e1f4d899b6bf086b93
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 88f4d441e69f7a53ba1eb82c0d5a6a8a51ee67cef67a55e21da31e195bfbaba5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CAF13E36A09A8286FB648F22E9847B973A1FB88BA4F144135CF6D07B94DF7CE455C700
                                                                                                                                                                                                                            Function 00007FF81FFF6370 Relevance: 47.5, APIs: 9, Strings: 18, Instructions: 273windowregistryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$Load$Icon$ClassCreateCursorHandleLongModuleRegisterShowUpdate
                                                                                                                                                                                                                            • String ID: 8.6$8.6.13$Button.border$P$Ttk$arrow$classic$downarrow$highlight$hsash$image$label$leftarrow$rightarrow$text$ttk::theme::classic$uparrow$vsash
                                                                                                                                                                                                                            • API String ID: 3723784198-2498008350
                                                                                                                                                                                                                            • Opcode ID: 00be10b94fce0a9a769e8a036279ef385926a26a53ab264b30358030e0d82707
                                                                                                                                                                                                                            • Instruction ID: 87dc8f5e8616b09dc9c5a734a89d7c5b5f38d9afa9c20ba39ec22f2b1c6a50ea
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 00be10b94fce0a9a769e8a036279ef385926a26a53ab264b30358030e0d82707
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F3E11565A08B8295FF04DB21ED902F963A6FB88BC4F545136EA4D07B69EF3CE145C740
                                                                                                                                                                                                                            Function 00007FF81F77DB00 Relevance: 47.4, APIs: 16, Strings: 11, Instructions: 106libraryloadermemoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1858038443.00007FF81F771000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF81F770000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1857997885.00007FF81F770000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1858081978.00007FF81F780000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1858129609.00007FF81F78E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1858170098.00007FF81F791000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81f770000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressProc$CriticalSection$AllocDeleteFreeHandleInitializeLibraryLoadModule
                                                                                                                                                                                                                            • String ID: AddAccessAllowedAce$AddAccessAllowedAceEx$AddAccessAllowedObjectAce$AddAccessDeniedAce$AddAccessDeniedAceEx$AddAccessDeniedObjectAce$AddAuditAccessAceEx$AddAuditAccessObjectAce$AddMandatoryAce$AdvAPI32.dll$SetSecurityDescriptorControl
                                                                                                                                                                                                                            • API String ID: 3842108915-2689366622
                                                                                                                                                                                                                            • Opcode ID: 00abef228cb45286ba7f1125ddbe3760151564b421905c27eb664f72b636958c
                                                                                                                                                                                                                            • Instruction ID: fbcb2c34946832a6772f3c2045d17252e0c6be205477f85c775cdc4cba823a27
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 00abef228cb45286ba7f1125ddbe3760151564b421905c27eb664f72b636958c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 14519269A19F8795EA86DB25FCA417437A0BF89BF1F541A39C84E42360EF7CA45DC300
                                                                                                                                                                                                                            Function 00007FF81FF84FE0 Relevance: 45.6, APIs: 6, Strings: 24, Instructions: 563stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 430 7ff81ff84fe0-7ff81ff85071 memset * 2 431 7ff81ff85083-7ff81ff85086 430->431 432 7ff81ff85073-7ff81ff8507e 430->432 433 7ff81ff85088-7ff81ff850a6 431->433 434 7ff81ff850b0-7ff81ff850b5 431->434 432->431 441 7ff81ff850ac 433->441 442 7ff81ff85985 433->442 435 7ff81ff850bb-7ff81ff850c7 434->435 436 7ff81ff85162-7ff81ff8517b call 7ff81ff86b70 434->436 439 7ff81ff850d0-7ff81ff8510d 435->439 440 7ff81ff85180-7ff81ff85183 436->440 439->442 448 7ff81ff85113-7ff81ff8511c 439->448 443 7ff81ff8592c-7ff81ff8594f 440->443 444 7ff81ff85189-7ff81ff851a2 strncmp 440->444 441->434 445 7ff81ff85987-7ff81ff859a9 call 7ff82000d4a0 442->445 462 7ff81ff85956-7ff81ff8597c 443->462 449 7ff81ff851c6-7ff81ff851e7 call 7ff81ff86b70 444->449 450 7ff81ff851a4-7ff81ff851c0 strncmp 444->450 452 7ff81ff852b9-7ff81ff85324 448->452 453 7ff81ff85122-7ff81ff85142 448->453 449->443 460 7ff81ff851ed-7ff81ff8521c 449->460 450->443 450->449 452->442 453->442 461 7ff81ff85148-7ff81ff8515c 453->461 463 7ff81ff858fe-7ff81ff8592a 460->463 464 7ff81ff85222-7ff81ff85225 460->464 461->436 461->439 462->442 463->462 464->463 466 7ff81ff8522b-7ff81ff8524c call 7ff81ff86b70 464->466 471 7ff81ff858f7-7ff81ff858f9 466->471 472 7ff81ff85252-7ff81ff85269 466->472 471->445 475 7ff81ff8526f-7ff81ff85284 call 7ff81ff85d00 472->475 476 7ff81ff85329-7ff81ff8533a 472->476 475->476 483 7ff81ff8528a-7ff81ff852b4 475->483 478 7ff81ff8533c-7ff81ff85340 476->478 479 7ff81ff85346-7ff81ff85359 476->479 478->479 481 7ff81ff8535b-7ff81ff85367 479->481 482 7ff81ff85369 479->482 484 7ff81ff8536f-7ff81ff85371 481->484 482->484 483->462 484->471 485 7ff81ff85377-7ff81ff85379 484->485 485->471 487 7ff81ff8537f-7ff81ff85381 485->487 487->471 488 7ff81ff85387-7ff81ff8538a 487->488 488->471 490 7ff81ff85390-7ff81ff853b2 call 7ff81ff92250 488->490 490->442 493 7ff81ff853b8-7ff81ff853d5 call 7ff81ff86b70 490->493 496 7ff81ff853db 493->496 497 7ff81ff855c7-7ff81ff855ec 493->497 498 7ff81ff853e0-7ff81ff853e9 496->498 513 7ff81ff855f3-7ff81ff8561d 497->513 499 7ff81ff853ef-7ff81ff853f1 498->499 500 7ff81ff85557-7ff81ff85574 call 7ff81ff86b70 498->500 502 7ff81ff8542c-7ff81ff8544d call 7ff81ff86b70 499->502 503 7ff81ff853f3-7ff81ff853f5 499->503 510 7ff81ff858ee-7ff81ff858f5 500->510 511 7ff81ff8557a-7ff81ff8559e call 7ff81ff85e30 500->511 519 7ff81ff8588c-7ff81ff858b8 502->519 520 7ff81ff85453-7ff81ff8549e 502->520 506 7ff81ff853fb-7ff81ff85427 503->506 507 7ff81ff855a4-7ff81ff855c1 call 7ff81ff86b70 503->507 506->513 507->497 507->498 515 7ff81ff858c4-7ff81ff858e9 510->515 511->507 529 7ff81ff858bd 511->529 524 7ff81ff85626-7ff81ff85629 513->524 515->513 519->513 521 7ff81ff854a4-7ff81ff854a6 520->521 522 7ff81ff85641-7ff81ff85643 520->522 525 7ff81ff854a8-7ff81ff854bd call 7ff81ff85d00 521->525 526 7ff81ff854c3-7ff81ff854c6 521->526 527 7ff81ff8568d-7ff81ff8572c 522->527 528 7ff81ff85645-7ff81ff8565a call 7ff81ff85d00 522->528 524->442 533 7ff81ff8562f-7ff81ff8563c 524->533 525->526 549 7ff81ff8565c-7ff81ff85688 525->549 536 7ff81ff8550e-7ff81ff85547 call 7ff81ff86020 526->536 537 7ff81ff854c8-7ff81ff854d8 526->537 538 7ff81ff85732-7ff81ff85734 527->538 539 7ff81ff85860-7ff81ff85887 527->539 528->527 528->549 529->515 533->442 536->524 553 7ff81ff8554d-7ff81ff85555 536->553 537->442 543 7ff81ff854de-7ff81ff854fd 537->543 538->539 546 7ff81ff8573a-7ff81ff85789 538->546 539->524 543->536 557 7ff81ff854ff-7ff81ff85509 memset 543->557 546->524 551 7ff81ff8578f-7ff81ff857aa 546->551 549->513 558 7ff81ff857bd-7ff81ff857fe call 7ff81ff86020 551->558 559 7ff81ff857ac-7ff81ff857b9 memset 551->559 553->507 557->536 563 7ff81ff85813-7ff81ff85853 call 7ff81ff90e40 558->563 564 7ff81ff85800-7ff81ff8580e 558->564 559->558 568 7ff81ff8585d 563->568 569 7ff81ff85855-7ff81ff85858 563->569 564->524 568->539 569->524
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memset$strncmp
                                                                                                                                                                                                                            • String ID: BAD_EXT$BOGUS_SIZE$COLOR_MAP$DIMENSIONS$GIF$GIF image file "%s" has dimension(s) <= 0$GIF87a$GIF89a$HEADER$IMAGE$NO_DATA$OPT_VALUE$PREMATURE_END$UUUU$couldn't read GIF header from file "%s"$couldn't read left/top/width/height in GIF image$error reading color map$error reading extension function code in GIF image$error reading extension in GIF image$inline data$no image data for this index$no value given for "%s" option$option name$premature end of image data for this index
                                                                                                                                                                                                                            • API String ID: 283058428-2519413577
                                                                                                                                                                                                                            • Opcode ID: e06adab41355f1c7f67f9f538d3257f95ae1ea75d1f4f1f6c23a27aaccd6ca85
                                                                                                                                                                                                                            • Instruction ID: 5a48e360c4e81e8f260ed593d9b67934406e2b343fe703ad59f061e66853235f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e06adab41355f1c7f67f9f538d3257f95ae1ea75d1f4f1f6c23a27aaccd6ca85
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F0428276A08A868AEB20CF25D8546F977A1FB88BE8F040136DA5D87B5CDF78E505C700
                                                                                                                                                                                                                            Function 00007FF81F011E90 Relevance: 43.9, APIs: 19, Strings: 6, Instructions: 182COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 571 7ff81f011e90-7ff81f011eac PyList_New 572 7ff81f011eae-7ff81f011eb6 571->572 573 7ff81f011eb7-7ff81f011edd 571->573 574 7ff81f011f3e-7ff81f011f44 573->574 575 7ff81f011edf-7ff81f011eeb 573->575 576 7ff81f011fa1-7ff81f011fab 574->576 577 7ff81f011f46-7ff81f011f9c __acrt_iob_func call 7ff81f011d70 __acrt_iob_func call 7ff81f011d70 __acrt_iob_func call 7ff81f011d70 574->577 578 7ff81f011fcd-7ff81f011fe4 malloc 575->578 585 7ff81f011ef1-7ff81f011ef3 PyErr_SetFromWindowsErr 575->585 576->578 579 7ff81f011fad-7ff81f011fc7 PyErr_SetString 576->579 577->576 583 7ff81f011ff1-7ff81f01200b NtQuerySystemInformation 578->583 584 7ff81f011fe6-7ff81f011fec PyErr_NoMemory 578->584 579->578 582 7ff81f011ef9-7ff81f011efe 579->582 587 7ff81f011f09-7ff81f011f0c 582->587 588 7ff81f011f00-7ff81f011f03 _Py_Dealloc 582->588 589 7ff81f01200d-7ff81f01201b call 7ff81f011350 583->589 590 7ff81f012020-7ff81f012023 583->590 584->582 585->582 593 7ff81f011f0e-7ff81f011f11 free 587->593 594 7ff81f011f17-7ff81f011f3d 587->594 588->587 589->582 595 7ff81f012029-7ff81f01203d 590->595 596 7ff81f012146-7ff81f01214f free 590->596 593->594 599 7ff81f012040-7ff81f01210c Py_BuildValue 595->599 601 7ff81f012157-7ff81f012161 596->601 599->582 602 7ff81f012112-7ff81f012123 PyList_Append 599->602 601->582 603 7ff81f012167-7ff81f012170 _Py_Dealloc 601->603 602->601 604 7ff81f012125-7ff81f01212c 602->604 603->582 605 7ff81f01212e-7ff81f012131 _Py_Dealloc 604->605 606 7ff81f012137-7ff81f012140 604->606 605->606 606->596 606->599
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1854881518.00007FF81F011000.00000020.00000001.01000000.00000041.sdmp, Offset: 00007FF81F010000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854838646.00007FF81F010000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854928580.00007FF81F01B000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854977217.00007FF81F020000.00000004.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1855025253.00007FF81F021000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81f010000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DeallocErr_FromList_Windowsfree
                                                                                                                                                                                                                            • String ID: (ddddd)$GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$NtQuerySystemInformation(SystemProcessorPerformanceInformation)$psutil-debug [%s:%d]> $psutil/arch/windows\cpu.c
                                                                                                                                                                                                                            • API String ID: 2064544276-4027580629
                                                                                                                                                                                                                            • Opcode ID: 7190dbfe5ddc8fd9770f88d7c9040de05d44c9cbbe8f5b86af6aa6a4fad55d9a
                                                                                                                                                                                                                            • Instruction ID: 02d119ce3adb0fc6494107c1d2499d51b7231be09c7eafae80f4e19510023a44
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7190dbfe5ddc8fd9770f88d7c9040de05d44c9cbbe8f5b86af6aa6a4fad55d9a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EE71A771B1CF42CAEE569B35A450279A3A6AF59BE4B048335FD0F62750EF3CE4858700
                                                                                                                                                                                                                            Function 00007FF81F017DB0 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 128COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1854881518.00007FF81F011000.00000020.00000001.01000000.00000041.sdmp, Offset: 00007FF81F010000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854838646.00007FF81F010000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854928580.00007FF81F01B000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854977217.00007FF81F020000.00000004.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1855025253.00007FF81F021000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81f010000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLast$Err_Process__acrt_iob_funcfprintf$FilenameFromOpenTokenWindowsWith$CurrentImpersonateSelfWarn
                                                                                                                                                                                                                            • String ID: (originated from %s)$AdjustTokenPrivileges$ImpersonateSelf$LookupPrivilegeValue$OpenProcessToken$SeDebugPrivilege
                                                                                                                                                                                                                            • API String ID: 2544101647-3705996988
                                                                                                                                                                                                                            • Opcode ID: 34da3196203b84411ab0fd01f7fc5e768038530ca3460100517b82b84452998e
                                                                                                                                                                                                                            • Instruction ID: db5337c83355d0c62c2c935e9924e9d69c514edca6d7312b78d91a1bc980ff8b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 34da3196203b84411ab0fd01f7fc5e768038530ca3460100517b82b84452998e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3B514E71A1CE46C2EF24DB60E8402BA73A5FB447E4F544636F68E026A5DF7CE549C740
                                                                                                                                                                                                                            Function 00007FF81FFE7230 Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 157windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Create$BitmapBrushPattern
                                                                                                                                                                                                                            • String ID: 8.6$Button.border$Combobox.focus$Scrollbar.trough$Ttk$alt$border$client$field$focus$slider$thumb$ttk::theme::winnative$winnative
                                                                                                                                                                                                                            • API String ID: 3280665104-2094136981
                                                                                                                                                                                                                            • Opcode ID: 595afdcf97aeff6b3cbdb58ab7e9707d33f80bc2ef0d63c850dc3ab6ed55cbd0
                                                                                                                                                                                                                            • Instruction ID: ec6b6de53cc6f6b5b4cb67a4ddfe32381f33012fe2509707415d31694943ed62
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 595afdcf97aeff6b3cbdb58ab7e9707d33f80bc2ef0d63c850dc3ab6ed55cbd0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BA712675A09B8681FF14DB61EC406AAA3A6FB48BC8F904136DA4D07BA9DF3CF155C740
                                                                                                                                                                                                                            Function 00007FF81FF8F910 Relevance: 24.5, APIs: 2, Strings: 14, Instructions: 506stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00007FF81FF8F9AA
                                                                                                                                                                                                                            • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00007FF81FF8F9E4
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strncmp
                                                                                                                                                                                                                            • String ID: -data$-format$-translation$IMAGE$MALLOC$MISSING_VALUE$PHOTO$PHOTO_FILE$SAFE$binary$can't get image from a file in a safe interpreter$not enough free memory for image buffer$value for "-data" missing$value for "-format" missing
                                                                                                                                                                                                                            • API String ID: 1114863663-986971618
                                                                                                                                                                                                                            • Opcode ID: e7b7400ba08ce212b999dd262a8f287354d99c5e8fbc816545b75bd853ceb93d
                                                                                                                                                                                                                            • Instruction ID: 5c8b01ea3abf50c461d67885a4cb306e17144b73910e55287ec0fc8e10d57feb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e7b7400ba08ce212b999dd262a8f287354d99c5e8fbc816545b75bd853ceb93d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9B325B76A08B828AEB508F26E59467977A0FB88BD4F044236DF5E037A8DF7CE455C740
                                                                                                                                                                                                                            Function 00007FF81FF25080 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 273COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DataFont$ObjectSelect$CharsetText
                                                                                                                                                                                                                            • String ID: cmap$pamc
                                                                                                                                                                                                                            • API String ID: 447340330-4234804082
                                                                                                                                                                                                                            • Opcode ID: ec84b9646085c3d108542de55fb4130f4f5abe04bf002ab4018fca5ab658880f
                                                                                                                                                                                                                            • Instruction ID: f9ab58f539c85eedf73fa3572d43d67e970b0f1ad9ca4aa76dc17012a09e23b7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ec84b9646085c3d108542de55fb4130f4f5abe04bf002ab4018fca5ab658880f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 42B11032A186A287E7548F16E84427EB7A1FBD4B90F445131EE9E47B98DFBCD845CB00
                                                                                                                                                                                                                            Function 00007FF81FF9FE20 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 97registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ClassRegister$HandleModule
                                                                                                                                                                                                                            • String ID: $EmbeddedMenuWindowClass$Failed to register embedded menu window class$Failed to register menu window class$MenuWindowClass
                                                                                                                                                                                                                            • API String ID: 1731912960-3560269961
                                                                                                                                                                                                                            • Opcode ID: a022b8830e441842a9a8304d1e35901ee6ea373eb2ea9fa27b82487967bb60bd
                                                                                                                                                                                                                            • Instruction ID: 5739c604c4400afec85ca54fe785025426700dacac0e8f100101bdb5637ac699
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a022b8830e441842a9a8304d1e35901ee6ea373eb2ea9fa27b82487967bb60bd
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FB51F471E09A4286FF009B24F89127A73A1FF487A4F405236E55E463A9DFBCE148C384
                                                                                                                                                                                                                            Function 00007FF81FF93050 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 375COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: %d/%d/%d$GC already registered in Tk_GetGC$TkImgPhotoGet couldn't find visual for window$black$called GCInit after GCCleanup$white
                                                                                                                                                                                                                            • API String ID: 0-3264705210
                                                                                                                                                                                                                            • Opcode ID: 1ee056ba85d046cfa9a995a10b0c7034cff58e1981e9b44932a63b83cc6f6b4f
                                                                                                                                                                                                                            • Instruction ID: 765448f95cb6fd098d003ea7cc3eed1085219bc078f22089d8eed7b3469d3351
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1ee056ba85d046cfa9a995a10b0c7034cff58e1981e9b44932a63b83cc6f6b4f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 101288B6A04B8186EB20CF25E8846AD77B4FB88B94F055236DF6E43758DF78E494C740
                                                                                                                                                                                                                            Function 00007FF81FF24200 Relevance: 7.8, APIs: 5, Instructions: 276COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _stricmp$EnumFamiliesFontRelease
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3617528966-0
                                                                                                                                                                                                                            • Opcode ID: 74aa1a7a7a286c07e64354c5c443cab7993a8500273f47f034a800a6a4b98b36
                                                                                                                                                                                                                            • Instruction ID: 20b9e9ac8ac4ad34a582bc2665008acf631f90d915bc31449fad3a3f6c1f8e6a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 74aa1a7a7a286c07e64354c5c443cab7993a8500273f47f034a800a6a4b98b36
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0DC14832A09F8685EB609B12F4903BAA7A4FB84BD4F455235CE5E47B59EFBCE405C700
                                                                                                                                                                                                                            Function 00007FF81F0118C0 Relevance: 142.0, APIs: 44, Strings: 37, Instructions: 235COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1854881518.00007FF81F011000.00000020.00000001.01000000.00000041.sdmp, Offset: 00007FF81F010000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854838646.00007FF81F010000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854928580.00007FF81F01B000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854977217.00007FF81F020000.00000004.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1855025253.00007FF81F021000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81f010000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Module_$Constant$Err_$Exception$Eval_ObjectThread$Create2CriticalDeallocFilenameFromInfoInitializeLibraryLoadRestoreSaveSectionStateSystemVersionWindowsWithgetenv
                                                                                                                                                                                                                            • String ID: ABOVE_NORMAL_PRIORITY_CLASS$BELOW_NORMAL_PRIORITY_CLASS$ERROR_ACCESS_DENIED$ERROR_INVALID_NAME$ERROR_PRIVILEGE_NOT_HELD$ERROR_SERVICE_DOES_NOT_EXIST$HIGH_PRIORITY_CLASS$IDLE_PRIORITY_CLASS$INFINITE$MIB_TCP_STATE_CLOSED$MIB_TCP_STATE_CLOSE_WAIT$MIB_TCP_STATE_CLOSING$MIB_TCP_STATE_DELETE_TCB$MIB_TCP_STATE_ESTAB$MIB_TCP_STATE_FIN_WAIT1$MIB_TCP_STATE_FIN_WAIT2$MIB_TCP_STATE_LAST_ACK$MIB_TCP_STATE_LISTEN$MIB_TCP_STATE_SYN_RCVD$MIB_TCP_STATE_SYN_SENT$MIB_TCP_STATE_TIME_WAIT$NORMAL_PRIORITY_CLASS$PSUTIL_CONN_NONE$PSUTIL_DEBUG$REALTIME_PRIORITY_CLASS$TimeoutAbandoned$TimeoutExpired$WINDOWS_10$WINDOWS_7$WINDOWS_8$WINDOWS_8_1$WINDOWS_VISTA$WINVER$_psutil_windows.Error$_psutil_windows.TimeoutAbandoned$_psutil_windows.TimeoutExpired$version
                                                                                                                                                                                                                            • API String ID: 887074641-2468274236
                                                                                                                                                                                                                            • Opcode ID: 4656843fcfd9a4fab3e528a616cb0e139eca0cf32d439c792de87cd9eebb126e
                                                                                                                                                                                                                            • Instruction ID: 67a74872225626257f1a66d9780813f05e732867f6633be2a6eb5d55b6a2ace7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4656843fcfd9a4fab3e528a616cb0e139eca0cf32d439c792de87cd9eebb126e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 25C1F4A4B1CE06C2FF549B11EA943782362AF49BE1F888235ED0E47B64DF6DE149C701
                                                                                                                                                                                                                            Function 00007FF81F0113D0 Relevance: 89.5, APIs: 27, Strings: 24, Instructions: 229libraryloaderthreadCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 29 7ff81f0113d0-7ff81f0113ff PyEval_SaveThread LoadLibraryA PyEval_RestoreThread 30 7ff81f011401-7ff81f011410 PyErr_SetFromWindowsErrWithFilename 29->30 31 7ff81f011412-7ff81f011425 GetProcAddress 29->31 32 7ff81f01143f-7ff81f011441 30->32 33 7ff81f011458-7ff81f01146f GetModuleHandleA 31->33 34 7ff81f011427-7ff81f011439 PyErr_SetFromWindowsErrWithFilename FreeLibrary 31->34 35 7ff81f011448-7ff81f011457 32->35 36 7ff81f01147a-7ff81f01148d GetProcAddress 33->36 37 7ff81f011471-7ff81f011478 33->37 34->32 39 7ff81f01148f 36->39 40 7ff81f0114b7-7ff81f0114ce GetModuleHandleA 36->40 38 7ff81f011496-7ff81f0114b6 PyErr_SetFromWindowsErrWithFilename 37->38 39->38 41 7ff81f0114d9-7ff81f0114ec GetProcAddress 40->41 42 7ff81f0114d0-7ff81f0114d7 40->42 44 7ff81f0114ee 41->44 45 7ff81f011516-7ff81f011542 PyEval_SaveThread LoadLibraryA PyEval_RestoreThread 41->45 43 7ff81f0114f5-7ff81f011515 PyErr_SetFromWindowsErrWithFilename 42->43 44->43 46 7ff81f01156a-7ff81f01157d GetProcAddress 45->46 47 7ff81f011544-7ff81f011569 PyErr_SetFromWindowsErrWithFilename 45->47 48 7ff81f01157f-7ff81f0115af PyErr_SetFromWindowsErrWithFilename FreeLibrary 46->48 49 7ff81f0115b0-7ff81f0115d4 call 7ff81f0112c0 46->49 49->35 52 7ff81f0115da-7ff81f0115f7 call 7ff81f0112c0 49->52 52->35 55 7ff81f0115fd-7ff81f01161a call 7ff81f0112c0 52->55 55->35 58 7ff81f011620-7ff81f01163d call 7ff81f0112c0 55->58 58->35 61 7ff81f011643-7ff81f011660 call 7ff81f0112c0 58->61 61->35 64 7ff81f011666-7ff81f011683 call 7ff81f0112c0 61->64 64->35 67 7ff81f011689-7ff81f0116a6 call 7ff81f0112c0 64->67 67->35 70 7ff81f0116ac-7ff81f0116c9 call 7ff81f0112c0 67->70 70->35 73 7ff81f0116cf-7ff81f0116df GetModuleHandleA 70->73 74 7ff81f0116ea-7ff81f0116fd GetProcAddress 73->74 75 7ff81f0116e1-7ff81f0116e8 73->75 77 7ff81f0116ff 74->77 78 7ff81f011727-7ff81f01174b call 7ff81f0112c0 74->78 76 7ff81f011706-7ff81f011726 PyErr_SetFromWindowsErrWithFilename 75->76 77->76 78->35 81 7ff81f011751-7ff81f011761 GetModuleHandleA 78->81 82 7ff81f01176c-7ff81f01177f GetProcAddress 81->82 83 7ff81f011763-7ff81f01176a 81->83 85 7ff81f011781 82->85 86 7ff81f011792-7ff81f0117c1 call 7ff81f0112c0 * 2 82->86 84 7ff81f011788-7ff81f011790 PyErr_SetFromWindowsErrWithFilename 83->84 84->86 85->84 90 7ff81f0117c6-7ff81f011813 call 7ff81f0112c0 * 2 PyErr_Clear 86->90
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1854881518.00007FF81F011000.00000020.00000001.01000000.00000041.sdmp, Offset: 00007FF81F010000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854838646.00007FF81F010000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854928580.00007FF81F01B000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854977217.00007FF81F020000.00000004.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1855025253.00007FF81F021000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81f010000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Err_FilenameFromWindowsWith$AddressEval_LibraryProcThread$FreeHandleLoadModuleRestoreSave
                                                                                                                                                                                                                            • String ID: GetActiveProcessorCount$GetExtendedTcpTable$GetExtendedUdpTable$GetLogicalProcessorInformationEx$GetTickCount64$NtQueryInformationProcess$NtQueryObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtResumeProcess$NtSetInformationProcess$NtSuspendProcess$RtlGetVersion$RtlIpv4AddressToStringA$RtlIpv6AddressToStringA$RtlNtStatusToDosErrorNoTeb$WTSEnumerateSessionsW$WTSFreeMemory$WTSQuerySessionInformationW$iphlpapi.dll$kernel32$ntdll$ntdll.dll$wtsapi32.dll
                                                                                                                                                                                                                            • API String ID: 3787047288-761253638
                                                                                                                                                                                                                            • Opcode ID: 6b7c78cd98652e75907c508de1284e9f0e804c7fc3037098929c04c6a191e3dd
                                                                                                                                                                                                                            • Instruction ID: 608dc69ad135639129d0656329d5ef08643bc9a5342311156353b6741c7ac0af
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6b7c78cd98652e75907c508de1284e9f0e804c7fc3037098929c04c6a191e3dd
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D3C1E2A0A0DF07C1FF59DB54E8842B923A6BF48BE4F885739E40D466A4EF6CE159C350
                                                                                                                                                                                                                            Function 00007FF81FF21ED0 Relevance: 63.2, APIs: 27, Strings: 9, Instructions: 183COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Object$CreateDeleteFontIndirect$InfoParametersSystem$CapsDeviceReleaseStockmemset
                                                                                                                                                                                                                            • String ID: TkCaptionFont$TkDefaultFont$TkFixedFont$TkHeadingFont$TkIconFont$TkMenuFont$TkSmallCaptionFont$TkTextFont$TkTooltipFont
                                                                                                                                                                                                                            • API String ID: 3615235001-2508811397
                                                                                                                                                                                                                            • Opcode ID: a82d3f6cb50e21364844548cdebd91498e273ccc3c2b102633b852e5f67892c9
                                                                                                                                                                                                                            • Instruction ID: 9417f6de5618eee44a61ca6b47043d1792fadac73db25fc90c1c8dc8c6e6b386
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a82d3f6cb50e21364844548cdebd91498e273ccc3c2b102633b852e5f67892c9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E7811935A08A428AFF10DB62EC142F963A1FB88BD9F944136DA0E57B58DE3CF149D740
                                                                                                                                                                                                                            Function 00007FF81FF89B70 Relevance: 56.5, APIs: 1, Strings: 31, Instructions: 510COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 127 7ff81ff89b70-7ff81ff89bba call 7ff81ff88680 130 7ff81ff89bc0-7ff81ff89bd8 127->130 131 7ff81ff89f2d 127->131 132 7ff81ff89d0c-7ff81ff89d2e call 7ff81ff88080 130->132 133 7ff81ff89bde-7ff81ff89bfd 130->133 134 7ff81ff89f32-7ff81ff89f64 call 7ff82000d4a0 131->134 132->131 141 7ff81ff89d34-7ff81ff89d42 132->141 133->131 140 7ff81ff89c03-7ff81ff89c08 133->140 140->132 142 7ff81ff89c0e-7ff81ff89c1d 140->142 143 7ff81ff89ff8-7ff81ff89ffb 141->143 144 7ff81ff89d48-7ff81ff89d53 141->144 147 7ff81ff89c20-7ff81ff89c42 _stricmp 142->147 145 7ff81ff8a001-7ff81ff8a034 143->145 146 7ff81ff89e38-7ff81ff89e3e 143->146 148 7ff81ff89fc0-7ff81ff89ff3 144->148 149 7ff81ff89d59-7ff81ff89d60 144->149 174 7ff81ff89efe-7ff81ff89f24 145->174 150 7ff81ff89e40-7ff81ff89e58 call 7ff81ff88ad0 146->150 151 7ff81ff89e8a-7ff81ff89e90 146->151 163 7ff81ff89c48-7ff81ff89c84 147->163 164 7ff81ff89cec-7ff81ff89cf1 147->164 148->174 152 7ff81ff89d66-7ff81ff89d6c 149->152 153 7ff81ff89f88-7ff81ff89fbb 149->153 150->131 171 7ff81ff89e5e-7ff81ff89e80 call 7ff81ff88080 150->171 155 7ff81ff89e96-7ff81ff89ec9 151->155 156 7ff81ff8a039-7ff81ff8a063 call 7ff81ff92250 151->156 152->153 159 7ff81ff89d72-7ff81ff89d85 152->159 153->174 155->174 156->131 175 7ff81ff8a069-7ff81ff8a082 156->175 159->153 166 7ff81ff89d8b-7ff81ff89dab call 7ff81ff87b00 159->166 163->131 183 7ff81ff89c8a-7ff81ff89c91 163->183 167 7ff81ff89cf5-7ff81ff89d06 164->167 166->131 185 7ff81ff89db1-7ff81ff89dc4 call 7ff81ff87ef0 166->185 167->132 167->147 171->131 188 7ff81ff89e86 171->188 174->131 181 7ff81ff8a084-7ff81ff8a0b0 175->181 182 7ff81ff8a0bc-7ff81ff8a0c9 175->182 181->182 186 7ff81ff8a0d5-7ff81ff8a0fb 182->186 187 7ff81ff8a0cb-7ff81ff8a0d3 182->187 190 7ff81ff89f65-7ff81ff89f86 183->190 191 7ff81ff89c97-7ff81ff89cb0 183->191 185->131 198 7ff81ff89dca-7ff81ff89dcf 185->198 194 7ff81ff8a107-7ff81ff8a14a 186->194 195 7ff81ff8a0fd 186->195 192 7ff81ff8a101 187->192 188->151 190->131 191->167 197 7ff81ff89cb2-7ff81ff89ccc 191->197 192->194 215 7ff81ff8a19c-7ff81ff8a1a0 194->215 216 7ff81ff8a14c-7ff81ff8a197 194->216 195->192 197->131 205 7ff81ff89cd2-7ff81ff89cd7 197->205 200 7ff81ff89dd1-7ff81ff89ddb 198->200 201 7ff81ff89e08-7ff81ff89e2e call 7ff81ff88080 198->201 206 7ff81ff89de0-7ff81ff89e06 200->206 201->131 212 7ff81ff89e34 201->212 208 7ff81ff89ecb-7ff81ff89ef7 205->208 209 7ff81ff89cdd-7ff81ff89ce6 205->209 206->201 206->206 208->174 209->164 209->208 212->146 217 7ff81ff8a1e1-7ff81ff8a1ed 215->217 218 7ff81ff8a1a2-7ff81ff8a1b9 215->218 216->131 222 7ff81ff8a1f0-7ff81ff8a200 call 7ff81ff898e0 217->222 220 7ff81ff8a1c2-7ff81ff8a1cb 218->220 221 7ff81ff8a1bb-7ff81ff8a1c0 218->221 224 7ff81ff8a1ce-7ff81ff8a1dd 220->224 221->224 228 7ff81ff8a205-7ff81ff8a208 222->228 226 7ff81ff8a242-7ff81ff8a258 224->226 227 7ff81ff8a1df 224->227 234 7ff81ff8a290-7ff81ff8a296 226->234 235 7ff81ff8a25a-7ff81ff8a284 226->235 227->222 228->131 230 7ff81ff8a20e-7ff81ff8a230 call 7ff81ff88080 228->230 230->131 239 7ff81ff8a236-7ff81ff8a240 230->239 237 7ff81ff8a2f0-7ff81ff8a2f5 234->237 238 7ff81ff8a298 234->238 235->234 240 7ff81ff8a2f7-7ff81ff8a323 237->240 241 7ff81ff8a32f-7ff81ff8a342 call 7ff81ff87ef0 237->241 243 7ff81ff8a2a0-7ff81ff8a2b8 call 7ff81ff87fd0 238->243 239->222 239->226 240->241 241->131 250 7ff81ff8a348-7ff81ff8a351 241->250 243->131 251 7ff81ff8a2be-7ff81ff8a2e0 call 7ff81ff88080 243->251 253 7ff81ff8a353 250->253 254 7ff81ff8a359-7ff81ff8a371 250->254 251->131 261 7ff81ff8a2e6-7ff81ff8a2ee 251->261 253->254 257 7ff81ff8a3e0-7ff81ff8a417 call 7ff81ff90e40 253->257 254->257 258 7ff81ff8a373-7ff81ff8a377 254->258 257->134 259 7ff81ff8a379 258->259 260 7ff81ff8a3ba-7ff81ff8a3bf 258->260 263 7ff81ff8a380-7ff81ff8a3b6 259->263 264 7ff81ff8a3c0-7ff81ff8a3de 260->264 261->237 261->243 263->263 266 7ff81ff8a3b8 263->266 264->257 264->264 266->257
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memcmp$_stricmp
                                                                                                                                                                                                                            • String ID: -alpha value must be between 0.0 and 1.0$BAD_ALPHA$BAD_IEND$BAD_PLTE$DNEI$DNEI$ETLP$EXTRA_DATA$IEND chunk contents must be empty$IMAGE$LINE_SIZE$MALLOC$NEED_IDAT$NEED_PLTE$PLTE chunk required for indexed color$PLTE chunk type forbidden for grayscale$PLTE_UNEXPECTED$PNG$SNRt$TADI$TADI$TADI$VUUU$at least one IDAT chunk is required$invalid palette chunk size$line size is out of supported range on this architecture$memory allocation failed$option$png$unfinalized data stream in PNG data$value
                                                                                                                                                                                                                            • API String ID: 190063134-2027502129
                                                                                                                                                                                                                            • Opcode ID: 52a1c36424f3056b56b6027db8e8dd1d2be4b929ad735ed3b2e2001585230572
                                                                                                                                                                                                                            • Instruction ID: 6054e033c96bbbedb1e1b3818aca616dff891d6f10114433c1721401760fa40c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 52a1c36424f3056b56b6027db8e8dd1d2be4b929ad735ed3b2e2001585230572
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6632C572A08A8286EB64CF25E9906BD77A1FB45FD4F044232DA5E53768CF7DE444C700
                                                                                                                                                                                                                            Function 00007FF81FF77B7D Relevance: 36.3, APIs: 6, Strings: 18, Instructions: 337stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 647 7ff81ff77b7d-7ff81ff77b8b 648 7ff81ff77b90-7ff81ff77bb6 647->648 650 7ff81ff77bbc-7ff81ff77bc0 648->650 651 7ff81ff77cf0-7ff81ff77cf8 648->651 652 7ff81ff77bff-7ff81ff77c03 650->652 653 7ff81ff77bc2-7ff81ff77bc5 650->653 651->648 654 7ff81ff77cfe-7ff81ff77d06 651->654 658 7ff81ff77c05-7ff81ff77c08 652->658 659 7ff81ff77c40-7ff81ff77c44 652->659 653->652 655 7ff81ff77bc7-7ff81ff77bdc strncmp 653->655 656 7ff81ff77d1a-7ff81ff77dcf call 7ff81ffe4ed0 call 7ff81ffe3870 654->656 657 7ff81ff77d08-7ff81ff77d16 654->657 662 7ff81ff77bde-7ff81ff77bf3 655->662 663 7ff81ff77bf8 655->663 689 7ff81ff78137 656->689 690 7ff81ff77dd5-7ff81ff77de2 656->690 657->656 658->659 665 7ff81ff77c0a-7ff81ff77c1f strncmp 658->665 660 7ff81ff77c7f-7ff81ff77c83 659->660 661 7ff81ff77c46-7ff81ff77c4a 659->661 667 7ff81ff77cbe-7ff81ff77cc2 660->667 668 7ff81ff77c85-7ff81ff77c89 660->668 661->660 666 7ff81ff77c4c-7ff81ff77c61 strncmp 661->666 662->651 663->652 670 7ff81ff77c39 665->670 671 7ff81ff77c21-7ff81ff77c34 665->671 673 7ff81ff77c78 666->673 674 7ff81ff77c63-7ff81ff77c76 666->674 667->651 672 7ff81ff77cc4-7ff81ff77cd9 strncmp 667->672 668->667 676 7ff81ff77c8b-7ff81ff77ca0 strncmp 668->676 670->659 671->651 672->651 678 7ff81ff77cdb-7ff81ff77ceb 672->678 673->660 674->651 679 7ff81ff77cb7 676->679 680 7ff81ff77ca2-7ff81ff77cb5 676->680 678->651 679->667 680->651 693 7ff81ff7813c-7ff81ff78162 689->693 691 7ff81ff77e16-7ff81ff77e2d call 7ff81ff7b480 call 7ff81ffab2e0 690->691 692 7ff81ff77de4-7ff81ff77e00 call 7ff81ffaac60 690->692 701 7ff81ff77e2f-7ff81ff77e40 call 7ff81ffaac60 691->701 702 7ff81ff77e4d-7ff81ff77e52 691->702 692->691 698 7ff81ff77e02-7ff81ff77e0e 692->698 698->691 708 7ff81ff77e45-7ff81ff77e4b 701->708 704 7ff81ff77e6a-7ff81ff77e72 702->704 705 7ff81ff77e54-7ff81ff77e64 call 7ff81ff214f0 702->705 706 7ff81ff77e8d-7ff81ff77e90 704->706 707 7ff81ff77e74-7ff81ff77e8a call 7ff81ffaac60 704->707 705->704 714 7ff81ff7812f-7ff81ff78132 call 7ff81ffe3b60 705->714 712 7ff81ff77e92-7ff81ff77eae call 7ff81ffaac60 706->712 713 7ff81ff77eb0-7ff81ff77ebe 706->713 707->706 708->702 708->704 712->713 724 7ff81ff77ec0 712->724 717 7ff81ff77ec3-7ff81ff77ec6 713->717 714->689 720 7ff81ff77ec8-7ff81ff77eef call 7ff81ffe1dd0 717->720 721 7ff81ff77f36-7ff81ff77f39 717->721 720->714 732 7ff81ff77ef5-7ff81ff77eff 720->732 722 7ff81ff77f3b-7ff81ff77f51 call 7ff81ffe2490 721->722 723 7ff81ff77f62-7ff81ff77f76 721->723 722->714 734 7ff81ff77f57-7ff81ff77f5d call 7ff81ffe4940 722->734 730 7ff81ff77f78-7ff81ff77f82 723->730 731 7ff81ff77f84-7ff81ff77fa2 723->731 724->717 730->731 735 7ff81ff77fb9-7ff81ff7803d memset 730->735 731->735 736 7ff81ff77fa4-7ff81ff77fab 731->736 732->721 733 7ff81ff77f01-7ff81ff77f28 732->733 733->721 737 7ff81ff77f2a-7ff81ff77f30 733->737 734->723 742 7ff81ff7803f-7ff81ff78049 735->742 743 7ff81ff78050-7ff81ff7809b call 7ff81ff6fa40 call 7ff81ff66bf0 735->743 736->735 739 7ff81ff77fad-7ff81ff77fb4 736->739 737->721 739->735 742->743 743->714 748 7ff81ff780a1-7ff81ff780c6 call 7ff81ff786a0 743->748 748->714 751 7ff81ff780c8-7ff81ff780ce 748->751 752 7ff81ff7818f-7ff81ff78193 751->752 753 7ff81ff780d4-7ff81ff780dc 751->753 754 7ff81ff781ac-7ff81ff781c9 call 7ff81ffa8fa0 752->754 755 7ff81ff78195-7ff81ff781a3 752->755 756 7ff81ff78187-7ff81ff7818a call 7ff81ff21770 753->756 757 7ff81ff780e2-7ff81ff78126 753->757 754->693 755->754 756->752 757->714
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strncmp
                                                                                                                                                                                                                            • String ID: -class$-colormap$-screen$-use$-visual$CONTAINMENT$Class$Colormap$FRAME$Use$Visual$class$colormap$use$v$visual$windows cannot have both the -use and the -container option set$b6
                                                                                                                                                                                                                            • API String ID: 1114863663-3606458496
                                                                                                                                                                                                                            • Opcode ID: ca6a58a217f93073c284f804ad35d7e14139bd0778dda11264e79cfc39aa4691
                                                                                                                                                                                                                            • Instruction ID: 4db440d83b1f85280742c7b6a8bd9ecace9aea1a17f016ba09e88b2194354c6d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ca6a58a217f93073c284f804ad35d7e14139bd0778dda11264e79cfc39aa4691
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8BF15836A19F8286FB549B12E9503B9A3A1FB49BD4F044236CE1E877A9DF7CE414C740
                                                                                                                                                                                                                            Function 00007FF81FF88680 Relevance: 28.8, APIs: 2, Strings: 17, Instructions: 255COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 764 7ff81ff88680-7ff81ff886c1 call 7ff81ff87b00 767 7ff81ff88aa5 764->767 768 7ff81ff886c7-7ff81ff886dd memcmp 764->768 771 7ff81ff88aaa-7ff81ff88aca call 7ff82000d4a0 767->771 769 7ff81ff88770-7ff81ff8878f call 7ff81ff88080 768->769 770 7ff81ff886e3-7ff81ff886e7 768->770 769->767 778 7ff81ff88795-7ff81ff8879c 769->778 773 7ff81ff886e9-7ff81ff88721 call 7ff81ff87b00 770->773 774 7ff81ff8873f-7ff81ff8876b 770->774 773->767 791 7ff81ff88727-7ff81ff8873d memcmp 773->791 788 7ff81ff88a76-7ff81ff88a9c 774->788 781 7ff81ff8879e-7ff81ff887ca 778->781 782 7ff81ff887cf-7ff81ff887d3 778->782 781->788 786 7ff81ff887d5-7ff81ff88801 782->786 787 7ff81ff88806-7ff81ff88827 call 7ff81ff87b00 782->787 786->788 787->767 794 7ff81ff8882d-7ff81ff8886d call 7ff81ff87b00 787->794 788->767 791->769 791->774 794->767 799 7ff81ff88873-7ff81ff88894 794->799 800 7ff81ff88a4a-7ff81ff88a6f 799->800 801 7ff81ff8889a-7ff81ff8889c 799->801 800->788 801->800 802 7ff81ff888a2-7ff81ff888a8 801->802 802->800 804 7ff81ff888ae-7ff81ff888b4 802->804 804->800 805 7ff81ff888ba-7ff81ff888e1 call 7ff81ff87b00 804->805 805->767 809 7ff81ff888e7-7ff81ff88908 call 7ff81ff87b00 805->809 809->767 812 7ff81ff8890e-7ff81ff8891c call 7ff81ff883b0 809->812 812->767 815 7ff81ff88922-7ff81ff88943 call 7ff81ff87b00 812->815 815->767 818 7ff81ff88949-7ff81ff8894f 815->818 819 7ff81ff88951-7ff81ff8897a 818->819 820 7ff81ff8897f-7ff81ff889a0 call 7ff81ff87b00 818->820 819->788 820->767 824 7ff81ff889a6-7ff81ff889ac 820->824 825 7ff81ff889dc-7ff81ff889fd call 7ff81ff87b00 824->825 826 7ff81ff889ae-7ff81ff889d7 824->826 825->767 831 7ff81ff88a03-7ff81ff88a09 825->831 826->788 833 7ff81ff88a39-7ff81ff88a48 call 7ff81ff87ef0 831->833 834 7ff81ff88a0b-7ff81ff88a0e 831->834 833->771 834->833 836 7ff81ff88a10-7ff81ff88a37 834->836 836->788
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memcmp$memcpy
                                                                                                                                                                                                                            • String ID: BAD_COMPRESS$BAD_FILTER$BAD_IHDR$BAD_INTERLACE$DIMENSIONS$IMAGE$NO_IHDR$NO_SIG$PNG$RDHI$data stream does not have a PNG signature$expected IHDR chunk type$image dimensions are invalid or beyond architecture limits$invalid IHDR chunk size$unknown compression method %d$unknown filter method %d$unknown interlace method %d
                                                                                                                                                                                                                            • API String ID: 231171946-3873946725
                                                                                                                                                                                                                            • Opcode ID: 96130a404e4e51ccffc943d88a0776b711f254b55585eccbcf8f741c7d52ef98
                                                                                                                                                                                                                            • Instruction ID: dc6fe6a49ab3ad492ed34b8679650c92f59f78cd4f3802e9377f8e4e6049c46a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 96130a404e4e51ccffc943d88a0776b711f254b55585eccbcf8f741c7d52ef98
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D7C17E72A08A4294FF54CF61A9546BC23A6FB48BD8F444232CE6D537A8DF7CE545C340
                                                                                                                                                                                                                            Function 00007FF81FF31E10 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 311windowstringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 883 7ff81ff31e10-7ff81ff31e55 884 7ff81ff31e5b-7ff81ff31e69 883->884 885 7ff81ff32348-7ff81ff32367 883->885 886 7ff81ff31f78-7ff81ff31f7b 884->886 887 7ff81ff31e6f-7ff81ff31e94 strcmp 884->887 888 7ff81ff31ef9-7ff81ff31f16 886->888 889 7ff81ff31f81-7ff81ff31f85 886->889 895 7ff81ff31ef6 887->895 896 7ff81ff31e96-7ff81ff31ee6 887->896 900 7ff81ff31f1c-7ff81ff31f23 888->900 901 7ff81ff31fb6-7ff81ff31fcb call 7ff81ff2df00 888->901 892 7ff81ff31f46 889->892 893 7ff81ff31f87-7ff81ff31fb4 call 7ff81ff416d0 889->893 897 7ff81ff31f48-7ff81ff31f77 call 7ff82000d4a0 892->897 893->892 895->888 918 7ff81ff31eef-7ff81ff31ef4 896->918 903 7ff81ff31f31-7ff81ff31f44 call 7ff81ff2d870 900->903 904 7ff81ff31f25-7ff81ff31f2d call 7ff81ff41910 900->904 914 7ff81ff31fd1-7ff81ff31ffb 901->914 915 7ff81ff32194-7ff81ff321b4 901->915 903->892 903->918 904->903 922 7ff81ff321d4-7ff81ff321f7 call 7ff81ff411e0 914->922 926 7ff81ff32001-7ff81ff32067 SHGetFileInfoW 914->926 921 7ff81ff321b6-7ff81ff321bf call 7ff81ff2d870 915->921 915->922 918->897 925 7ff81ff321c4-7ff81ff321c6 921->925 922->918 933 7ff81ff321fd-7ff81ff32203 922->933 925->892 929 7ff81ff321cc-7ff81ff321cf call 7ff81ff2dde0 925->929 938 7ff81ff3217d-7ff81ff32192 926->938 939 7ff81ff3206d-7ff81ff320c8 SHGetFileInfoW 926->939 929->922 933->918 935 7ff81ff32209-7ff81ff32234 933->935 940 7ff81ff32236-7ff81ff32239 935->940 941 7ff81ff32244-7ff81ff3224b 935->941 938->915 938->922 952 7ff81ff320ca-7ff81ff320cd 939->952 953 7ff81ff32102-7ff81ff32140 memset 939->953 940->941 942 7ff81ff3223b-7ff81ff32242 940->942 943 7ff81ff3224d-7ff81ff32260 941->943 944 7ff81ff32262-7ff81ff32273 941->944 942->940 942->941 943->944 950 7ff81ff32275-7ff81ff322ae CreateIconIndirect 943->950 944->943 950->892 951 7ff81ff322b4-7ff81ff322c9 950->951 959 7ff81ff322cb-7ff81ff322d4 DestroyIcon 951->959 960 7ff81ff322d9-7ff81ff32335 call 7ff81ff2d870 951->960 954 7ff81ff320cf-7ff81ff320d7 DestroyIcon 952->954 955 7ff81ff320dd-7ff81ff320fd DestroyIcon 952->955 953->938 956 7ff81ff32142-7ff81ff3217b 953->956 954->955 955->922 956->915 959->892 960->892 965 7ff81ff3233b-7ff81ff32343 call 7ff81ff2dde0 960->965 965->892
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Icon$Destroy$FileInfo$CreateIndirectmemsetstrcmp
                                                                                                                                                                                                                            • String ID: -default$H$ICONBITMAP$OPTION$Tk_SizeOfBitmap received unknown bitmap argument$illegal option "%s" must be "-default"$window ?-default? ?image?
                                                                                                                                                                                                                            • API String ID: 1970194709-3871694194
                                                                                                                                                                                                                            • Opcode ID: bcf4fbf5537657db598bd34fcbf865a3bb34e1cc3589ae7dc261e863b157a381
                                                                                                                                                                                                                            • Instruction ID: 2076c629f1343e5cc3bb5328cf5c372911fa096f16fb2417e0b4e3f9b5432323
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bcf4fbf5537657db598bd34fcbf865a3bb34e1cc3589ae7dc261e863b157a381
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6CE15976A08B8286EB54DF12E9543B963A1FB88BD4F084135CE5E07798DF7CE484C740
                                                                                                                                                                                                                            Function 00007FF81FFE3870 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 184stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 968 7ff81ffe3870-7ff81ffe38af strrchr 969 7ff81ffe38b1-7ff81ffe3903 968->969 970 7ff81ffe3908-7ff81ffe3913 968->970 986 7ff81ffe3b37-7ff81ffe3b53 call 7ff82000d4a0 969->986 971 7ff81ffe3999-7ff81ffe39a0 970->971 972 7ff81ffe3919-7ff81ffe3926 970->972 974 7ff81ffe39a2-7ff81ffe39ae 971->974 975 7ff81ffe3929-7ff81ffe393b strncpy 971->975 972->975 976 7ff81ffe393f-7ff81ffe3945 974->976 975->976 978 7ff81ffe3947-7ff81ffe394a 976->978 979 7ff81ffe39b0-7ff81ffe39c1 976->979 981 7ff81ffe3991-7ff81ffe3994 978->981 982 7ff81ffe394c-7ff81ffe3988 978->982 987 7ff81ffe39c3-7ff81ffe39c6 979->987 988 7ff81ffe3a1f 979->988 984 7ff81ffe3a23-7ff81ffe3a2b 981->984 982->981 990 7ff81ffe3a2d-7ff81ffe3a34 984->990 991 7ff81ffe3a3a-7ff81ffe3a3d 984->991 987->981 994 7ff81ffe39c8-7ff81ffe3a1d 987->994 988->984 990->991 992 7ff81ffe3a43-7ff81ffe3a4b 991->992 993 7ff81ffe3b0f-7ff81ffe3b11 991->993 996 7ff81ffe3a4d-7ff81ffe3a79 992->996 997 7ff81ffe3a7b-7ff81ffe3a7f 992->997 998 7ff81ffe3b32 993->998 994->984 1014 7ff81ffe3aad-7ff81ffe3ad2 996->1014 1002 7ff81ffe3ad4-7ff81ffe3ada 997->1002 1003 7ff81ffe3a81-7ff81ffe3aa6 997->1003 998->986 1004 7ff81ffe3adc-7ff81ffe3ae6 call 7ff81ffe2cb0 1002->1004 1005 7ff81ffe3b18-7ff81ffe3b2d call 7ff81ffe28a0 1002->1005 1003->1014 1011 7ff81ffe3aeb-7ff81ffe3b05 call 7ff81ffe2ec0 1004->1011 1005->998 1018 7ff81ffe3b07-7ff81ffe3b0a call 7ff81ffe3b60 1011->1018 1019 7ff81ffe3b13-7ff81ffe3b16 1011->1019 1014->998 1018->993 1019->998
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • strrchr.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,00007FF81FF43378), ref: 00007FF81FFE38A3
                                                                                                                                                                                                                            • strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00007FF81FF43378), ref: 00007FF81FFE3935
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strncpystrrchr
                                                                                                                                                                                                                            • String ID: .$CONTAINER$CREATE$DEAD_PARENT$LOOKUP$NO_MAIN_WINDOW$NULL main window$VALUE$WINDOW$WINDOW_PATH$bad window path name "%s"$can't create window: its parent has -container = yes$can't create window: parent has been destroyed
                                                                                                                                                                                                                            • API String ID: 3639506716-1666016940
                                                                                                                                                                                                                            • Opcode ID: 8e49b4d70c41eb17609a7b3696ac39db36366113e7fccefc7fa7609d6ce64ab5
                                                                                                                                                                                                                            • Instruction ID: ff1941a6c643414c50bebdc00bf6183788ef8f40def4d68a966a13a551fc6c38
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8e49b4d70c41eb17609a7b3696ac39db36366113e7fccefc7fa7609d6ce64ab5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 73818825A0CA8681FE409F12E9586B967A2FB48FE4F450132DE5E0B769DF7CE14AC700
                                                                                                                                                                                                                            Function 00007FF81FF2D870 Relevance: 24.8, APIs: 6, Strings: 8, Instructions: 270windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Class$LongMessageSend$HandleLoadModule$CursorIconRegister
                                                                                                                                                                                                                            • String ID: Can't set icon; window has no wrapper.$FAILED$ICON$LOOKUP$TOPLEVEL$Unable to set icon$WRAPPER$window "%s" isn't a top-level window
                                                                                                                                                                                                                            • API String ID: 3636279047-342970489
                                                                                                                                                                                                                            • Opcode ID: da1fd7731bbd19b1e962cbff28d4b8147a42c3a3081e6c2b8bc5ecc7cc46cb67
                                                                                                                                                                                                                            • Instruction ID: ad84a8ef0af91e96e5bed54a3a6ac32af74ad193ca74dab5ceddec25e45f9847
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: da1fd7731bbd19b1e962cbff28d4b8147a42c3a3081e6c2b8bc5ecc7cc46cb67
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 71C19D36A08A8686FB649F11E4606BD33A1FB85BE4F154232DA6E477D5CFBCE445C700
                                                                                                                                                                                                                            Function 00007FF81FF2DF00 Relevance: 23.1, APIs: 2, Strings: 11, Instructions: 374COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: -encoding$-translation$Error converting to internal format$FORMAT$ICON$Invalid file header$READ$binary$error opening file "%s" for reading: %s$error reading file: %s$error seeking in file: %s
                                                                                                                                                                                                                            • API String ID: 0-1482656021
                                                                                                                                                                                                                            • Opcode ID: 1d3be55ff07dc83df80faf6eef418b5ef0f003445f5813d67b438c9e71c2744b
                                                                                                                                                                                                                            • Instruction ID: b063deeb47b71b2433f6dc416b9b91b80e3be16c0d0dfff0c27797b2349c1d73
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1d3be55ff07dc83df80faf6eef418b5ef0f003445f5813d67b438c9e71c2744b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 52F18E7AA08A8286EB54CF16E89457977A1FB88FD1F558132CE5E473A8DF3CE448C740
                                                                                                                                                                                                                            Function 00007FF81FF781D0 Relevance: 22.7, APIs: 4, Strings: 11, Instructions: 243COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: -class$-colormap$-container$-screen$-use$-visual$CREATE_ONLY$FRAME$can't modify %s option after widget is created$option$option ?arg ...?
                                                                                                                                                                                                                            • API String ID: 0-2678313790
                                                                                                                                                                                                                            • Opcode ID: bbae40a61a6092869b235c9bef1c8e909cc28b9cc8cd7aff2ec56be44395932c
                                                                                                                                                                                                                            • Instruction ID: b8ae9359b4efa4783dd8528e6d4183f07a11efacf4ad2fe930f43353ef6ad759
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bbae40a61a6092869b235c9bef1c8e909cc28b9cc8cd7aff2ec56be44395932c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E8A17065A08E8682FE60DF16E8802B9A3A1FB45FE4F549236CE5E97758DF7CE445C300
                                                                                                                                                                                                                            Function 00007FF81FF902B0 Relevance: 19.8, APIs: 13, Instructions: 268COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memset$CombineCreateDeleteObjectRectmemcpy$Indirect
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2081876822-0
                                                                                                                                                                                                                            • Opcode ID: 395c8a88bfe0da4f81ccc3e86346e5f320ff3bea00b52d8b7a1456975538253d
                                                                                                                                                                                                                            • Instruction ID: beb19def0407b0a8ccab84ff519153374d9e262cc0b11a1d4ff77eb8e3cf2d2d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 395c8a88bfe0da4f81ccc3e86346e5f320ff3bea00b52d8b7a1456975538253d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C0B1C5B2A18A5286EB64DF36A44053EB7E1FB88BD4F104235EA5D53B99DF7CE441CB00
                                                                                                                                                                                                                            Function 00007FF81FF23990 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 156COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CharObjectSelectTextWidth$FaceMetricsRelease
                                                                                                                                                                                                                            • String ID: unicode$utf-16
                                                                                                                                                                                                                            • API String ID: 1149465119-3317161374
                                                                                                                                                                                                                            • Opcode ID: 762ed054ed4b536f2dee746c7582a664d586629cfade819d89095a25515d3e29
                                                                                                                                                                                                                            • Instruction ID: 0763703ad31eef51d962fb70414256daa524cd0c53c3ff94bf0f99f0b461720c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 762ed054ed4b536f2dee746c7582a664d586629cfade819d89095a25515d3e29
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E7717B72A08B868AEB21DF26E8502B977A1FB58BD4F044232DE5E43768DF3CE045C740
                                                                                                                                                                                                                            Function 00007FF81FF2B320 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 73COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateHandleModuleWindow
                                                                                                                                                                                                                            • String ID: EmbeddedMenuWindow$EmbeddedMenuWindowClass$Failed to create the embedded menu window$Failed to create the menu window$MenuWindow$MenuWindowClass
                                                                                                                                                                                                                            • API String ID: 1178124398-1932805642
                                                                                                                                                                                                                            • Opcode ID: d5b5036ffa92656af0fac3d254847f4de292e65320bca40e0d980e21efc52895
                                                                                                                                                                                                                            • Instruction ID: 153d42cca9753e1b6e5cfa76e491443fee88ea748026e98855782bb222aa9dc0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d5b5036ffa92656af0fac3d254847f4de292e65320bca40e0d980e21efc52895
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B741F536A08B8686FB508F14F890279B7E1FB98B94F14513ADA8E42B6CDF7CE145C700
                                                                                                                                                                                                                            Function 00007FF81FF90680 Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 212COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00007FF81FF90722
                                                                                                                                                                                                                            • _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF81FF90850
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _strnicmp
                                                                                                                                                                                                                            • String ID: -file option isn't supported for %s images$IMAGE$LOOKUP$NOT_FILE_FORMAT$PHOTO$PHOTO_FORMAT$UNRECOGNIZED_DATA$couldn't recognize data in image file "%s"$image file format "%s" is not supported
                                                                                                                                                                                                                            • API String ID: 2635805826-3773480712
                                                                                                                                                                                                                            • Opcode ID: 1285be5d3c5d581ab23b7d6aa6456eb392604adfaf37b6109eb9e0eafe657e0e
                                                                                                                                                                                                                            • Instruction ID: 98486261b701f9cc0f176c3945b6272ebdf90da1e9372156acbfdecb71174f72
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1285be5d3c5d581ab23b7d6aa6456eb392604adfaf37b6109eb9e0eafe657e0e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B9B12E76A08B8681EB60CF21E8543AA73A1FB89BD8F448132DE5D47758DF7CE149C740
                                                                                                                                                                                                                            Function 00007FF81FF90A90 Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 191COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00007FF81FF90B2D
                                                                                                                                                                                                                            • _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF81FF90BC0
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _strnicmp
                                                                                                                                                                                                                            • String ID: -data option isn't supported for %s images$IMAGE$LOOKUP$NOT_DATA_FORMAT$PHOTO$PHOTO_FORMAT$UNRECOGNIZED_DATA$couldn't recognize image data$image format "%s" is not supported
                                                                                                                                                                                                                            • API String ID: 2635805826-3952471749
                                                                                                                                                                                                                            • Opcode ID: fe8a1428c86a6f4c259cb3c0ceaaefa02c52ef0184d486d7fe044d9d392678df
                                                                                                                                                                                                                            • Instruction ID: 68e841ccb27d7e3c215ab9d034241ff7433b94a1e35760c8b73c3b019792818d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fe8a1428c86a6f4c259cb3c0ceaaefa02c52ef0184d486d7fe044d9d392678df
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B5913D66A08B8285FB518F21E8543B963A1FB48FE8F444232DE6E477A8DF7CE145C740
                                                                                                                                                                                                                            Function 00007FF81FF17CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 414COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • FindResourceW() failed for buttons bitmap resource, resources in tk_base.rc must be linked into Tk dll or static executable, xrefs: 00007FF81FF17DC1
                                                                                                                                                                                                                            • buttons, xrefs: 00007FF81FF17DA2
                                                                                                                                                                                                                            • abcdefghijklmnopqurstuvwzyABCDEFGHIJKLMNOPQURSTUVWZY, xrefs: 00007FF81FF17FC0
                                                                                                                                                                                                                            • Tk_SizeOfBitmap received unknown bitmap argument, xrefs: 00007FF81FF17F06
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Resource$FindHandleLoadLockModulememcpy
                                                                                                                                                                                                                            • String ID: FindResourceW() failed for buttons bitmap resource, resources in tk_base.rc must be linked into Tk dll or static executable$Tk_SizeOfBitmap received unknown bitmap argument$abcdefghijklmnopqurstuvwzyABCDEFGHIJKLMNOPQURSTUVWZY$buttons
                                                                                                                                                                                                                            • API String ID: 770267298-1510936104
                                                                                                                                                                                                                            • Opcode ID: 85d6de0c850d9727a164918e6f190f987f3df07cf4e8e77f4caa1b695bac8d1a
                                                                                                                                                                                                                            • Instruction ID: d7becd3af14156c7064344811c6061ca800c29cb4aab67376d50d64fc3deca76
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 85d6de0c850d9727a164918e6f190f987f3df07cf4e8e77f4caa1b695bac8d1a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 74020172A08B8186EB25CF25E9546B977A4FB88BD8F058339EE1E53754DF78E800C700
                                                                                                                                                                                                                            Function 00007FF81FF9B430 Relevance: 16.1, APIs: 2, Strings: 7, Instructions: 386COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memset
                                                                                                                                                                                                                            • String ID: -menu$MENU$Menu$No more menus can be allocated.$SYSTEM_RESOURCES$normal$pathName ?-option value ...?
                                                                                                                                                                                                                            • API String ID: 2221118986-2269277396
                                                                                                                                                                                                                            • Opcode ID: bc1a862d88afd8be7ff7d152eea27e09c97c4df4c8561314943e72866340e4c6
                                                                                                                                                                                                                            • Instruction ID: 6bc6da2c3e0f3b9653d8455762e4a139180292e3971c9b4be17fa70b49448ee9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bc1a862d88afd8be7ff7d152eea27e09c97c4df4c8561314943e72866340e4c6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 20024976A08B8686EB10DF11E8942A973A5FB88FD4F484236DF6E43768DF78E545C340
                                                                                                                                                                                                                            Function 00007FF81FF93B90 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 226COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • Fail to create pixmap with Tk_GetPixmap in TkImgPhotoInstanceSetSize, xrefs: 00007FF81FF93C53
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memset$memcpy$DeleteObject
                                                                                                                                                                                                                            • String ID: Fail to create pixmap with Tk_GetPixmap in TkImgPhotoInstanceSetSize
                                                                                                                                                                                                                            • API String ID: 3824102683-276313315
                                                                                                                                                                                                                            • Opcode ID: 0d7e4ba3c1fa7429d64256aee0cb097f2337c7359f90d3c0400d5dc2287be7ac
                                                                                                                                                                                                                            • Instruction ID: eac2cf6c9b19b3d4e3212f8c2bc85ff48c887b599d189f1e8f2d0189dfedc174
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0d7e4ba3c1fa7429d64256aee0cb097f2337c7359f90d3c0400d5dc2287be7ac
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 48A17B72B04A5586DB24DF29D49167DB7E6FB84B84F006236EA5E43B58EF3DE805C700
                                                                                                                                                                                                                            Function 00007FF81F77E908 Relevance: 13.7, APIs: 9, Instructions: 230COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1858038443.00007FF81F771000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF81F770000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1857997885.00007FF81F770000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1858081978.00007FF81F780000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1858129609.00007FF81F78E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1858170098.00007FF81F791000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81f770000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 349153199-0
                                                                                                                                                                                                                            • Opcode ID: 70f854044df5acb2ce3175ee53db70c69d323c809d2866dc920b2ba8ef5ec66e
                                                                                                                                                                                                                            • Instruction ID: 2efe4669b646d1a83aa86aa81f09cbbe570752be6ec159bc58d271cece84cc51
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 70f854044df5acb2ce3175ee53db70c69d323c809d2866dc920b2ba8ef5ec66e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C481D12DE2EEC386FA509B2598482B92691BF457E0F044F35D90DC73A6DE3CE84E8740
                                                                                                                                                                                                                            Function 00007FF81FFA1050 Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 693COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DeleteObject$CreateMessage$BitmapErrorFormatFreeLastLocalReleaseSection
                                                                                                                                                                                                                            • String ID: GC already registered in Tk_GetGC$called GCInit after GCCleanup$gray50
                                                                                                                                                                                                                            • API String ID: 450180425-823200916
                                                                                                                                                                                                                            • Opcode ID: 0f747f387fa2b2d42b0d9edfff7550025ffcbcdd495534c055fcb1ecd65a1cdf
                                                                                                                                                                                                                            • Instruction ID: 1e65696ddceb9fbf6b570a9eba4a972d6d8a402f3a5a0acf925db3eb98c02ce9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0f747f387fa2b2d42b0d9edfff7550025ffcbcdd495534c055fcb1ecd65a1cdf
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4B822276A04B818AEB50CF25E8806AD77B5F788BD8F118126CF9D47B58CF78E494CB40
                                                                                                                                                                                                                            Function 00007FF81FF2D690 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 113registrywindowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: HandleLoadModule$ClassCursorIconRegister
                                                                                                                                                                                                                            • String ID: TkTopLevel$Unable to register TkTopLevel class
                                                                                                                                                                                                                            • API String ID: 1220223050-2494010311
                                                                                                                                                                                                                            • Opcode ID: d95be2fde495b25a383373344f9ea24be3c5431bd0b544cf80a4d0b24179be97
                                                                                                                                                                                                                            • Instruction ID: cef16e97d366384665c859941346dfea262897160c1a9a79bb973afe6e6a000c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d95be2fde495b25a383373344f9ea24be3c5431bd0b544cf80a4d0b24179be97
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8A514632A08B8682FB55CB10F85427973A5FB84BE0F114236DA6E43B98DFBCE585C740
                                                                                                                                                                                                                            Function 00007FF81FF87B00 Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 238COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memcpy
                                                                                                                                                                                                                            • String ID: EARLY_END$EOF$IMAGE$PNG$channel read failed: %s$unexpected end of file$unexpected end of image data
                                                                                                                                                                                                                            • API String ID: 3510742995-1708351035
                                                                                                                                                                                                                            • Opcode ID: 93bced0b82a3faa930af59cd9a9970b205fb7f29d7fba7ae7f23bab67619e878
                                                                                                                                                                                                                            • Instruction ID: 14a3c02b4e80c62adde300e7aa7ff72e2b77818806b3e13764e584a1053cb963
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 93bced0b82a3faa930af59cd9a9970b205fb7f29d7fba7ae7f23bab67619e878
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 34B1AF36A08B8281EB218F26E444BB977A1FB85BD8F045232CE6D07798DF7CE555C740
                                                                                                                                                                                                                            Function 00007FF81FF54EA0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 351COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: GC already registered in Tk_GetGC$called GCInit after GCCleanup
                                                                                                                                                                                                                            • API String ID: 0-2292843906
                                                                                                                                                                                                                            • Opcode ID: 0d2ad0e2b80c5dc5339c4cf69ee0ccd291996dca119d1f326ecb3a7591b07edc
                                                                                                                                                                                                                            • Instruction ID: 7e17c718061bd034e2295023d98240449f1093cd7e489608510d48faf2fa2d6c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0d2ad0e2b80c5dc5339c4cf69ee0ccd291996dca119d1f326ecb3a7591b07edc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 28023772A04B8186EB50CF25E8847AD73B5FB88B98F154236CE5E97768DF78E440C740
                                                                                                                                                                                                                            Function 00007FF81FF225C0 Relevance: 10.8, APIs: 7, Instructions: 317COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExtentObjectPoint32SelectText
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1470722260-0
                                                                                                                                                                                                                            • Opcode ID: 5bf1d379ab913d4dcbdc601203740f0f17f5a89720c01042aed728571facf12e
                                                                                                                                                                                                                            • Instruction ID: fe50a4cad9839eca55815ca4b7ec993e5161cd243f1edfefe3ea0ba1ce96e828
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5bf1d379ab913d4dcbdc601203740f0f17f5a89720c01042aed728571facf12e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CFE16D36B08B5686FB108F6AE8802AD7BA1F748BD8F540136DE5D57B68DF78E445CB00
                                                                                                                                                                                                                            Function 00007FF81FF35C00 Relevance: 10.7, APIs: 7, Instructions: 225windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CompositionContextString$CountMessageProcReleaseSendTickWindow
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 568510177-0
                                                                                                                                                                                                                            • Opcode ID: 3af1a7b433b6aa20c32006c3ac12bcb407cb63fe6fd156464f24aec8048010e5
                                                                                                                                                                                                                            • Instruction ID: 922caad3cd25616f8fd50cf8cf8ca73304cd4c60f04d4803f2834bf7ac88ba11
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3af1a7b433b6aa20c32006c3ac12bcb407cb63fe6fd156464f24aec8048010e5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AAA1AF33E18B8286E754CB65D4442BD27A1FB88BE8F144235EE6D93B99DF78E491C700
                                                                                                                                                                                                                            Function 00007FF81FF23E40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 138COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ObjectSelect$FaceTextmemset
                                                                                                                                                                                                                            • String ID: unicode$utf-16
                                                                                                                                                                                                                            • API String ID: 920176757-3317161374
                                                                                                                                                                                                                            • Opcode ID: 0fe984b4801072c8f997a8f02d0a171ff735075120ccb3b2463026985a8a8d9c
                                                                                                                                                                                                                            • Instruction ID: 9a6d92ff2014a248b03027e9d064242dcabb303c686a0ae55bea74daf2b32d44
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0fe984b4801072c8f997a8f02d0a171ff735075120ccb3b2463026985a8a8d9c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 45511776A09B4692EF54CB12E9543BA63A1FB48BD0F448236DE6D47B98DF7CE064C340
                                                                                                                                                                                                                            Function 00007FF81F0112C0 Relevance: 10.5, APIs: 7, Instructions: 37librarythreadloaderCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1854881518.00007FF81F011000.00000020.00000001.01000000.00000041.sdmp, Offset: 00007FF81F010000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854838646.00007FF81F010000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854928580.00007FF81F01B000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854977217.00007FF81F020000.00000004.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1855025253.00007FF81F021000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81f010000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Err_Eval_FilenameFromLibraryThreadWindowsWith$AddressFreeLoadProcRestoreSave
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 568911590-0
                                                                                                                                                                                                                            • Opcode ID: e2200b3415209b6f4be3470a672ca2eac9ae6c36c8dafb9bbec9a9066c3d2c4c
                                                                                                                                                                                                                            • Instruction ID: 95429c1e9706d6a4943cc087c7fba612e4413a72aeb4c41144bf2fd0edfddc1b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e2200b3415209b6f4be3470a672ca2eac9ae6c36c8dafb9bbec9a9066c3d2c4c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7E012860B1CE46C2EE189B62B90813E6261BF4CFE0B488234ED4E07B58DF3CE0558300
                                                                                                                                                                                                                            Function 00007FF81FF8A5D0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 114COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memset
                                                                                                                                                                                                                            • String ID: IMAGE$PNG$ZLIB_INIT$zlib initialization failed
                                                                                                                                                                                                                            • API String ID: 2221118986-4061978001
                                                                                                                                                                                                                            • Opcode ID: e50892ac24cb838df17e68c29ec121b7be5c4bac6dc55d7304e68ff1a26aeda6
                                                                                                                                                                                                                            • Instruction ID: b12ed45b4d01df1dc8ea502c1b7c364a235aaeb74e1b517def0886190473729a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e50892ac24cb838df17e68c29ec121b7be5c4bac6dc55d7304e68ff1a26aeda6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 48513B36A19A8686EA20CF15E9907BD73A1FB88BD4F044231DB5E47B58DF3CE549CB40
                                                                                                                                                                                                                            Function 00007FF81FF8A940 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 94COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memset$_stricmp
                                                                                                                                                                                                                            • String ID: IMAGE$PNG$ZLIB_INIT$zlib initialization failed
                                                                                                                                                                                                                            • API String ID: 3026489053-4061978001
                                                                                                                                                                                                                            • Opcode ID: 7744ea1ffd37f5724c45f8a7fcf8a38e5c25a1d5a037d3c5dba7dd033a11c8d8
                                                                                                                                                                                                                            • Instruction ID: aa66c8734d9fd3be9182747961d131917c443b2fbf1303cd2fbafd61938d5a89
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7744ea1ffd37f5724c45f8a7fcf8a38e5c25a1d5a037d3c5dba7dd033a11c8d8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F9418F76B18A8682EB20DB11E9407BA73A1FB88BD4F444231DB5D47B58DF3CE549CB40
                                                                                                                                                                                                                            Function 00007FF81FF733E0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 313COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ObjectStock
                                                                                                                                                                                                                            • String ID: FONT$INTERNAL_PROBLEM$ansifixed$failed to allocate font due to internal system font engine problem
                                                                                                                                                                                                                            • API String ID: 3428563643-2695973982
                                                                                                                                                                                                                            • Opcode ID: 90c21c68e372a57fabfc9ba05df5e3f54cf8a360a4cf90bee0e4a2394529ac37
                                                                                                                                                                                                                            • Instruction ID: 862417e95dba96e974d7fdf6438f5d78d926d751b52b651f74e89f75e9076193
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 90c21c68e372a57fabfc9ba05df5e3f54cf8a360a4cf90bee0e4a2394529ac37
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8AE1AA76A09F8696EB60CF26E884669B3A4FB48BD4F144236CE5E83B54DF3CE054C700
                                                                                                                                                                                                                            Function 00007FF81FF338D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSendTextWindow
                                                                                                                                                                                                                            • String ID: window ?newTitle?
                                                                                                                                                                                                                            • API String ID: 893732450-417226443
                                                                                                                                                                                                                            • Opcode ID: 8c74e68171ef1c0bb3220698f2b731647f6854d312bc160e4b1651c8657b0b4a
                                                                                                                                                                                                                            • Instruction ID: 8a26303635087c8026cd979fe41b8c7911d03d503baacb4eefa11797661c81fd
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8c74e68171ef1c0bb3220698f2b731647f6854d312bc160e4b1651c8657b0b4a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0A51903AA18AC682EE54CB11E8543B96361FB88FE4F041272DE6E03798CF7CE585C740
                                                                                                                                                                                                                            Function 00007FF81FFE5F50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$ColorLongProc
                                                                                                                                                                                                                            • String ID: #%04X%04X%04X$Ttk
                                                                                                                                                                                                                            • API String ID: 3223664542-2938447076
                                                                                                                                                                                                                            • Opcode ID: b7beb31e0df3b080ec4497e91dcc1c8f8241d996f3c89413baac79b945f63759
                                                                                                                                                                                                                            • Instruction ID: 20b2478b0a5a27fcb715de6fb7c4887b5caa0a9239b5153de503d897cb95e27b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b7beb31e0df3b080ec4497e91dcc1c8f8241d996f3c89413baac79b945f63759
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A251C476A18B9682EB408F15E85477A73A1FB84BD4F505132EE5E077A8DF3CE055CB40
                                                                                                                                                                                                                            Function 00007FF81FF44570 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 272COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DeleteObject
                                                                                                                                                                                                                            • String ID: GC already registered in Tk_GetGC$called GCInit after GCCleanup$gray50
                                                                                                                                                                                                                            • API String ID: 1531683806-823200916
                                                                                                                                                                                                                            • Opcode ID: a65a69032f165da7cfdeffed71ff89b6f4e4b9a7d1781ab4bd50a8711a9c6d8e
                                                                                                                                                                                                                            • Instruction ID: 9374e4a62223247d3eb497bdff32c64b157570dad992c5a86157f3e3868e03cc
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a65a69032f165da7cfdeffed71ff89b6f4e4b9a7d1781ab4bd50a8711a9c6d8e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 56E11176A04B818AEB10CF65D4807AC37A5FB88B98F018236CF6DA7758DF78E454C740
                                                                                                                                                                                                                            Function 00007FF81FF23C50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 111COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DeleteObject
                                                                                                                                                                                                                            • String ID: unicode$utf-16
                                                                                                                                                                                                                            • API String ID: 1531683806-3317161374
                                                                                                                                                                                                                            • Opcode ID: 0756e2dfd691b1e934e4e5270af3a6727ba5a6b5723d1195d0da5b99e0b33e8b
                                                                                                                                                                                                                            • Instruction ID: efa3b3fe87fa26166bc87843160498f1b47b8483d5fedf32dfd209b00bef1926
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0756e2dfd691b1e934e4e5270af3a6727ba5a6b5723d1195d0da5b99e0b33e8b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2651377AA1AF8A82EF44CB06E99427977A5FB88FD0F454536CA1E03728DF78E454C340
                                                                                                                                                                                                                            Function 00007FF81FF2CDA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$CreateHandleModule
                                                                                                                                                                                                                            • String ID: TkChild
                                                                                                                                                                                                                            • API String ID: 1084761317-227893619
                                                                                                                                                                                                                            • Opcode ID: c9fe2abb82e580163a2428423a825b6c84ae4f00c944f8885d94c984aa77f129
                                                                                                                                                                                                                            • Instruction ID: adf4adeca1399ae89b6420a2bbdab448421d79696dacd2bdb995715ed83a0b89
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c9fe2abb82e580163a2428423a825b6c84ae4f00c944f8885d94c984aa77f129
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B821C876A08B818BEB64CF65B44061AB7E1F748BD4F545129EA8D43B28DF7CE5408B00
                                                                                                                                                                                                                            Function 00007FF81F011DC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1854881518.00007FF81F011000.00000020.00000001.01000000.00000041.sdmp, Offset: 00007FF81F010000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854838646.00007FF81F010000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854928580.00007FF81F01B000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1854977217.00007FF81F020000.00000004.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1855025253.00007FF81F021000.00000002.00000001.01000000.00000041.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81f010000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: BuildErr_FromSystemTimesValueWindows
                                                                                                                                                                                                                            • String ID: (ddd)
                                                                                                                                                                                                                            • API String ID: 2325294781-2401937087
                                                                                                                                                                                                                            • Opcode ID: ba0bdbf672466f0367906313a703a410643c45962e3f53d94245850bb14888e0
                                                                                                                                                                                                                            • Instruction ID: 0f7dadcbc539fb86e182597ec87aafaea3d110cfe9a9f18593659ef3e3db1179
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ba0bdbf672466f0367906313a703a410643c45962e3f53d94245850bb14888e0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1511B931E2DF418FC953D7359950526E3A5AFAA7D0B448322F90FB1E10EB2CE0D68B00
                                                                                                                                                                                                                            Function 00007FF81FF85C10 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 61stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FF81FF84FCD), ref: 00007FF81FF85C69
                                                                                                                                                                                                                            • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FF81FF84FCD), ref: 00007FF81FF85C85
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strncmp
                                                                                                                                                                                                                            • String ID: GIF87a$GIF89a
                                                                                                                                                                                                                            • API String ID: 1114863663-2918331024
                                                                                                                                                                                                                            • Opcode ID: 4ad089100f9efac63551899617f19a9666bb5e14fb698fd8ca6b8a58e35e1c74
                                                                                                                                                                                                                            • Instruction ID: a111236326fcbf67bb29636d56ced97b15e5fab7e5ed100b40faba63fd024d54
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4ad089100f9efac63551899617f19a9666bb5e14fb698fd8ca6b8a58e35e1c74
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 502128B271CA8142FB608B16E84097A77A1EBC47D0F548132F99E87B5DDE3CE405CB00
                                                                                                                                                                                                                            Function 00007FF81FF8CDE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateDeleteIndirectObjectRectstrncmp
                                                                                                                                                                                                                            • String ID: tried to delete photo image when instances still exist
                                                                                                                                                                                                                            • API String ID: 3169462253-2722655475
                                                                                                                                                                                                                            • Opcode ID: 419782726299dbf6c91504e9da5d62b8177e7300e44eba71a79a818844e047fc
                                                                                                                                                                                                                            • Instruction ID: e9694756e9549f9a90981b902a62d5b32c07777035cbf03cc1f9334bfde8971f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 419782726299dbf6c91504e9da5d62b8177e7300e44eba71a79a818844e047fc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A8517E76A19F8286FA50CF11E998A7873A5FB88BD4F069231DE5D47724DF78E084C340
                                                                                                                                                                                                                            Function 00007FF81FF35CC0 Relevance: 4.6, APIs: 3, Instructions: 126COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: LongWindow
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1378638983-0
                                                                                                                                                                                                                            • Opcode ID: b17fe81931004565508d44fc310c7b2da754b9edf268db10b3951263a697b7eb
                                                                                                                                                                                                                            • Instruction ID: 7f3ee27c0e0645383288b56700957d6eb3ea10957a0fa97e779de3b7a339d357
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b17fe81931004565508d44fc310c7b2da754b9edf268db10b3951263a697b7eb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FA514A76A0CB8286EB548F55E9446B977A2FB88BE4F144235DA6D03B58DFBCE484C700
                                                                                                                                                                                                                            Function 00007FF81FF432B0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 194COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetSystemMetrics.USER32 ref: 00007FF81FF432EA
                                                                                                                                                                                                                              • Part of subcall function 00007FF81FF16870: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF81FF168BB
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MetricsSystem__stdio_common_vsprintf
                                                                                                                                                                                                                            • String ID: pathName ?-option value ...?
                                                                                                                                                                                                                            • API String ID: 2968932569-1831586811
                                                                                                                                                                                                                            • Opcode ID: 9aee83e7738f853a95f63ada3deb9d4475f9baf1b7836040d08db6ecc5562b0a
                                                                                                                                                                                                                            • Instruction ID: eb07cd20011a0631e725fa4695d216261e142cd9ad33b60d65558dfa58200b45
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9aee83e7738f853a95f63ada3deb9d4475f9baf1b7836040d08db6ecc5562b0a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 01A1037AA04B8185E740DF21F9447EA33A8F744B9CF584239DE890B319DF7890A9E754
                                                                                                                                                                                                                            Function 00007FF81FF27C90 Relevance: 3.1, APIs: 2, Instructions: 87COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CaptureProcWindow
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 49417107-0
                                                                                                                                                                                                                            • Opcode ID: 88fe7894b77b440579c2f7780463d5a0d5dfb3e27490c50ef561ae9beb76d844
                                                                                                                                                                                                                            • Instruction ID: ec67d9f778710ef337b3854f151e25cc2ab1b2a6bfff563daca895944d2846ac
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 88fe7894b77b440579c2f7780463d5a0d5dfb3e27490c50ef561ae9beb76d844
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AB416236908F8682EF548B29F45427A63A1FB857E4F401236E69D43B68DFBCE544CB41
                                                                                                                                                                                                                            Function 00007FF81FF28720 Relevance: 3.1, APIs: 2, Instructions: 63windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Menu$CreateDestroy
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2649344041-0
                                                                                                                                                                                                                            • Opcode ID: be36e3a011d5829161959ccd9344094aad27dfb0e9e42241318b90816857b292
                                                                                                                                                                                                                            • Instruction ID: 5ea3a8c4982a8d1d7d87bab7be0f24512d73d104da2acc6308af3a908e298962
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: be36e3a011d5829161959ccd9344094aad27dfb0e9e42241318b90816857b292
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 20216226A04A9182FB15DB56F8542B9A3A1FB88FD0F484132DF5E43758DF3CE586C700
                                                                                                                                                                                                                            Function 00007FF81FF35150 Relevance: 3.1, APIs: 2, Instructions: 53windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MenuMessageSend
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 799077126-0
                                                                                                                                                                                                                            • Opcode ID: f10e738a3603eb4141aabde8da5c2bdb6efce21975d762610ea49445676cbec7
                                                                                                                                                                                                                            • Instruction ID: 3ffb22febd8f40487a345576eca582da12f10ea4681105d9630e7d01fb2709b8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f10e738a3603eb4141aabde8da5c2bdb6efce21975d762610ea49445676cbec7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CD214F36A04FC286EB48DB51E9482A97360FB84BE4F181131DF6D17799DF78E4A1C740
                                                                                                                                                                                                                            Function 00007FF81FFAAC60 Relevance: 2.7, APIs: 2, Instructions: 206stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strchrstrncpy
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3824778938-0
                                                                                                                                                                                                                            • Opcode ID: 7fd67b51bc1874e3c129da515a438775dd0d2560da8455aacb6ba1cd168b06a1
                                                                                                                                                                                                                            • Instruction ID: 411700e117769e3dcbd9265410bea8077490ced3c406eb33a8100b4cb6cab7af
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7fd67b51bc1874e3c129da515a438775dd0d2560da8455aacb6ba1cd168b06a1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1091AC36B05E86C6EB64CF1AD48066977A1FB88BE8B448631CF2E43755DF78E859C700
                                                                                                                                                                                                                            Function 00007FF81FF8A420 Relevance: 2.6, APIs: 2, Instructions: 96COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memcmpmemset
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1065087418-0
                                                                                                                                                                                                                            • Opcode ID: 8c2d67a6a37c98835af7ea412b45bbd055186bf5a8263d77f6ce4d48fe5e7680
                                                                                                                                                                                                                            • Instruction ID: 5e46d7a0be333a38477d653b787fdbac4dc0e9556112aed25ffbeafd9f4b833e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8c2d67a6a37c98835af7ea412b45bbd055186bf5a8263d77f6ce4d48fe5e7680
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DB414E36619A8686EA60CF15E850BAE73A1FB88F84F049231DF5D47B18DF7DE445CB40
                                                                                                                                                                                                                            Function 00007FF81FF8A7E0 Relevance: 2.6, APIs: 2, Instructions: 82COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memset
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2221118986-0
                                                                                                                                                                                                                            • Opcode ID: 0b68e7d50639de59b663d853b3b15ecc27d0476b4e892276acd6a60e22603b2f
                                                                                                                                                                                                                            • Instruction ID: 2d12c3b528ce79152d2dda69240dcd5e28dd70374270331eeda87dd979c4e4d7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0b68e7d50639de59b663d853b3b15ecc27d0476b4e892276acd6a60e22603b2f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8A314A72B18A8686EB20DF16E8407AAB3A1FB88B94F444131DB9D47759EF3CE445CB00
                                                                                                                                                                                                                            Function 00007FF81FF74210 Relevance: 2.0, APIs: 1, Instructions: 463COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: isspace
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3785662208-0
                                                                                                                                                                                                                            • Opcode ID: 79a8690a8756bf4ac284e03d323996cbf1a11a03bd64b20065679e3d4a8ffa81
                                                                                                                                                                                                                            • Instruction ID: 0584782f27507a989842aa09fccfdb58cf285cfea8e25525466650242f4a7ddb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 79a8690a8756bf4ac284e03d323996cbf1a11a03bd64b20065679e3d4a8ffa81
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DA22C076A18A81CBDB50CF19E48466EBBA0F788BD4F144236EB5E83758DF78E445CB00
                                                                                                                                                                                                                            Function 00007FF81FF92E30 Relevance: 1.6, APIs: 1, Instructions: 138COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetRgnBox.GDI32 ref: 00007FF81FF92FE3
                                                                                                                                                                                                                              • Part of subcall function 00007FF81FF93EC0: strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,00000000,00007FF81FF92E67,?,?,?,?,?,?,?,?,00000000,00007FF81FF90018), ref: 00007FF81FF93EE6
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strtol
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 76114499-0
                                                                                                                                                                                                                            • Opcode ID: 0480658d01b129d120834c146a312032185cbe3520997525b1f3b879752a20b9
                                                                                                                                                                                                                            • Instruction ID: 7ee639c864ca68b30c36110136f2e7bbaa2995c78f76cd04f3e13e1390f90566
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0480658d01b129d120834c146a312032185cbe3520997525b1f3b879752a20b9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 10615BB6A08B4186EBA4DF25E48032977A4FB44B98F445239EB9D43B94DF7CE4A0C740
                                                                                                                                                                                                                            Function 00007FF81FFE4255 Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2353593579-0
                                                                                                                                                                                                                            • Opcode ID: 9ce7a0f8117f27d62bfd851c53c3369a4642d18e4693e0e5d9290a6c8a96dc2a
                                                                                                                                                                                                                            • Instruction ID: 3ada1f14df6ee6e4a72b12a9dbdc72fcb4ce6158f38de09fe4c2ba226cd0c7a9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9ce7a0f8117f27d62bfd851c53c3369a4642d18e4693e0e5d9290a6c8a96dc2a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E441C376A05B4281EB248F15D040B7C67A1FB94FE4F0A423ACE6D0739ADFB8D440DB10
                                                                                                                                                                                                                            Function 00007FF81FF2F200 Relevance: 1.6, APIs: 1, Instructions: 60COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: HandleLoadModule$ClassCursorIconRegisterShowWindow
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3163394910-0
                                                                                                                                                                                                                            • Opcode ID: 3f086d7d6162192c85f3862b1eef622d5feb99d653a8db293011f420a0d105e9
                                                                                                                                                                                                                            • Instruction ID: bccc7cf8a00a8e86daa302308439441062ed955eb8f56f7081e1ce778271a16d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3f086d7d6162192c85f3862b1eef622d5feb99d653a8db293011f420a0d105e9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B7219736B18A8286EB548F11E5843BD37A1EB85BE4F184635CA1D473C5DFF8E882C740
                                                                                                                                                                                                                            Function 00007FF81FFABB10 Relevance: 1.6, APIs: 1, Instructions: 308COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • memcpy.VCRUNTIME140(?,?,?,?,00000008,00000000,000000D0,?,?,00007FF81FFAACB2), ref: 00007FF81FFABE59
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memcpy
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3510742995-0
                                                                                                                                                                                                                            • Opcode ID: fbcb2bb6e432a4987b9f74048de9f04632af755269406f9f8a5ac9f2ffe8a8db
                                                                                                                                                                                                                            • Instruction ID: 5334e69649317f7d25995a60cae2d9da85bbc92b549beb426ea2e52769528ca8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fbcb2bb6e432a4987b9f74048de9f04632af755269406f9f8a5ac9f2ffe8a8db
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FCF12BB7602F85CACB50CF19E4801ADB7B4F788B94B59862ACB5E43724DF78E595C700
                                                                                                                                                                                                                            Function 00007FF81FF3B040 Relevance: 1.5, APIs: 1, Instructions: 292COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memset
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2221118986-0
                                                                                                                                                                                                                            • Opcode ID: 32108d93366a595e0dde9fb969241fa5500e3fe9cf9af712be67e7bddf23e9b9
                                                                                                                                                                                                                            • Instruction ID: b422226c86d9611f493f673c59c17679596f47254e9934bd57226bdcf1cc8d74
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 32108d93366a595e0dde9fb969241fa5500e3fe9cf9af712be67e7bddf23e9b9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DDF1A971E09A8687FB44CF18EC9026433A2EB867A4F555739E52DC73E8DF2CE8458B41
                                                                                                                                                                                                                            Function 00007FF81FF2F330 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ShowWindow
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1268545403-0
                                                                                                                                                                                                                            • Opcode ID: 8bf8888a1e7a846f504f2452cd735e6b21774eebd42e8d034fae26394ca79355
                                                                                                                                                                                                                            • Instruction ID: 67a263ef1458a00466ba55863dd19ee2b292591b48c986d909b5d2e17f9dbc7c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8bf8888a1e7a846f504f2452cd735e6b21774eebd42e8d034fae26394ca79355
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 87F06272F28942C2FB614A15D5C437D1291DB98775F284131D52C5E7D8DE69ECD3C201
                                                                                                                                                                                                                            Function 00007FF81FF27BE0 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ProcWindow
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 181713994-0
                                                                                                                                                                                                                            • Opcode ID: 48856ebeb81e2535e951a81e69f187a05a3534807a87c12bc25c04f5bde8d8b6
                                                                                                                                                                                                                            • Instruction ID: c83aa8b05ad73613ecf472794def434a1a53d9ec793e4d82c10b5ff25015f9c2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 48856ebeb81e2535e951a81e69f187a05a3534807a87c12bc25c04f5bde8d8b6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9CF0F972A18B4982CB00DF55E44489D73A9F7957D4BA10132DBAC03714EF79D96ACB80
                                                                                                                                                                                                                            Function 00007FF81FF24BB0 Relevance: 1.4, APIs: 1, Instructions: 118COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF81FF24F00: _stricmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF81FF24F2F
                                                                                                                                                                                                                              • Part of subcall function 00007FF81FF24F00: _stricmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF81FF24F47
                                                                                                                                                                                                                              • Part of subcall function 00007FF81FF24F00: _stricmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF81FF24F5B
                                                                                                                                                                                                                              • Part of subcall function 00007FF81FF24F00: EnumFontFamiliesW.GDI32 ref: 00007FF81FF24FA3
                                                                                                                                                                                                                            • memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,00007FF81FF24557), ref: 00007FF81FF24CEC
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _stricmp$EnumFamiliesFontmemcpy
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1739947011-0
                                                                                                                                                                                                                            • Opcode ID: 02170863cfb94eeff9d3c9f6d751fef594f73400a83c09797d40e350083b711d
                                                                                                                                                                                                                            • Instruction ID: ef8e004b730f8a29fc09cf2d6a8a2980b48d4f0c3190fd6519c9504c70cbfced
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 02170863cfb94eeff9d3c9f6d751fef594f73400a83c09797d40e350083b711d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 09519D32A08E8681DB10CF19E4903BD7761FB88BD4F495232DA5E4776AEFB8D185C740
                                                                                                                                                                                                                            Function 00007FF81FF86B70 Relevance: 1.3, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • memcpy.VCRUNTIME140(?,?,?,00007FF81FF85C51,?,?,?,?,?,?,?,00007FF81FF84FCD), ref: 00007FF81FF86BEF
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memcpy
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3510742995-0
                                                                                                                                                                                                                            • Opcode ID: 038c49ebe7824d6f6f0c4aa13111b780684129cf1adabd8957543adf7017b704
                                                                                                                                                                                                                            • Instruction ID: 24953e0687ff2e8e25556c9bea21232bf869af190863199430f105dd89c5b6b2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 038c49ebe7824d6f6f0c4aa13111b780684129cf1adabd8957543adf7017b704
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AD21A162B08B9582EA208F16A180429A764FB45FE4F054636EFAD47BA5CFBCD841C740
                                                                                                                                                                                                                            Function 00007FF81FF84F90 Relevance: 1.3, APIs: 1, Instructions: 18COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • memset.VCRUNTIME140 ref: 00007FF81FF84FB0
                                                                                                                                                                                                                              • Part of subcall function 00007FF81FF85C10: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FF81FF84FCD), ref: 00007FF81FF85C69
                                                                                                                                                                                                                              • Part of subcall function 00007FF81FF85C10: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FF81FF84FCD), ref: 00007FF81FF85C85
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000004.00000002.1860378347.00007FF81FF11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FF81FF10000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860308325.00007FF81FF10000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860530771.00007FF82000F000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860626466.00007FF82005B000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860670177.00007FF82005C000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860751852.00007FF820060000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860799055.00007FF820061000.00000008.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860871901.00007FF820063000.00000004.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000004.00000002.1860915156.00007FF820065000.00000002.00000001.01000000.0000001D.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_4_2_7ff81ff10000_hotmailpulse.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strncmp$memset
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3268688168-0
                                                                                                                                                                                                                            • Opcode ID: 3f729a6ea6d1cace1d1004ee240682614f6c4a24807ba710acc308fdf35954c6
                                                                                                                                                                                                                            • Instruction ID: 268223b20178ddfae9d9e6c73e5bacd2758d2143365e434939b34730febb2b82
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3f729a6ea6d1cace1d1004ee240682614f6c4a24807ba710acc308fdf35954c6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9CE048327085C551DA215751F8017EB9251F799BC4F484131AE8C17749CD2CC2458B00